Function at 0x18013dce3
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
or eax, 0x768500b0
shr ax, cl
push rbx
bt ebp, r14d
mov bpl, r13b
shl bx, cl
push rsi
movzx rbp, r8w
mov bh, 0x33
push rdi
test r13b, 0x9b
cmp r11, 0x42762fd4
bsf rax, rsp
push r12
adc ebx, 0x74df7283
push r13
bsr edi, r12d
mov bx, 0x1b89
push r14
sub r12, rax
shrd bx, r14w, 0x61
lea rbp, [rsp - 0x240]
add rax, rax
sub rsp, 0x340
dec di
lahf
mov rax, qword [0x180087010]
adc dil, r9b
xor rax, rsp
stc
mov qword [rbp + 0x230], rax
btc di, ax
movsx bx, spl
movsx r12d, ax
mov r12, r8
not dil
shl edi, cl
movzx rdi, ax
mov rdi, rcx
rcl bl, cl
rol bx, 0x70
bswap bx
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x18013dd8f
je 0x18013dde7
mov al, byte [rdx]
stc
clc
cmp spl, dl
sub al, 0x2f
cmc
cmp r9w, dx
cmp al, 0x2d
jmp 0x18013ddaa
ja 0x18013ddc3
movsx rax, al
bt rbx, rax
jmp 0x18013ddbd
jb 0x18013dde7
mov rcx, rdi
jmp 0x18013ddcb
call fcn.180099371
mov rdx, rax
jmp 0x18013ddd9
cmp rax, rdi
jmp 0x18013dde1
jne 0x18013dd95
mov r8b, byte [rdx]
stc
cmp r8b, 0x3a
jne 0x18013de2f
lea rax, [rdi + 1]
cmp rdx, rax
jmp 0x18013de01
je 0x18013de2f
mov r9, r12
btr cx, r10w
sbb rcx, rsp
rcl cl, cl
xor r8d, r8d
sub cx, r11w
sub edx, edx
mov rcx, rdi
jmp 0x18013de25
call fcn.18013d97d
jmp 0x18013e3a7
sub r8b, 0x2f
stc
clc
xor r14d, r14d
test cx, r15w
stc
cmp r8b, 0x2d
jmp 0x18013de46
ja 0x18013de5c
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x18013de64
mov al, r14b
xor ch, cl
rol cx, cl
sub rdx, rdi
dec cl
movsxd rcx, esp
mov qword [rsp + 0x40], r14
mov rcx, 0x6ced77e8
movzx rcx, r8w
dec cl
inc rdx
sar ch, 0x98
sar cl, cl
mov qword [rsp + 0x48], r14
clc
sal cl, cl
neg al
movzx cx, bh
bswap ecx
not ecx
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x70]
jmp 0x18013dea7
mov qword [rsp + 0x58], r14
jmp 0x18013deb1
sbb r13, r13
mov qword [rsp + 0x60], r14
cmp r14d, 0x5e2e5759
and r13, rdx
mov byte [rsp + 0x68], r14b
clc
xor edx, edx
mov qword [rsp + 0x38], r13
jmp 0x18013ded5
call fcn.18013e3ec
mov rax, qword [rsp + 0x78]
sbb ecx, 0x73812614
xor ch, 0xf
mov ecx, 0xfde9
test r10b, r14b
clc
cmp dword [rax + 0xc], ecx
jmp 0x18013def9
jne 0x18013df34
cmp byte [rbp - 0x78], r14b
jmp 0x18013df08
je 0x18013df27
mov rax, qword [rsp + 0x70]
sub r9, rax
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x18013df27
mov r9d, ecx
jmp 0x18013df2f
jmp 0x18013dfae
call fcn.1801409f1
test eax, eax
jmp 0x18013df40
jne 0x18013df89
cmp byte [rbp - 0x78], r14b
jmp 0x18013df4f
je 0x18013df79
mov rax, qword [rsp + 0x70]
jmp 0x18013df6a
and dword [rax + 0x3a8], 0xfffffffd
movsx r9d, r11w
seto r9b
mov r9d, 1
jmp 0x18013df84
jmp 0x18013dfae
cmp byte [rbp - 0x78], r14b
jmp 0x18013df92
je 0x18013dfa6
mov rax, qword [rsp + 0x70]
and dword [rax + 0x3a8], 0xfffffffd
cqo
mov r9d, r14d
movsx dx, bpl
lea r8, [rsp + 0x30]
mov dh, cl
movsx rcx, r12w
mov rcx, rdi
mov dx, 0x3735
movzx edx, r14w
movsx rdx, r8w
lea rdx, [rsp + 0x40]
call fcn.18013ce75
mov rcx, qword [rsp + 0x50]
dec r8b
btr r8d, ebp
cmp r10w, 0x6600
lea r8, [rbp - 0x20]
clc
test r12, r8
test eax, eax
mov dword [rsp + 0x28], r14d
jmp 0x18013dff8
mov qword [rsp + 0x20], r14
jmp 0x18013e002
cmovne rcx, r14
cmp dx, 0x6196
xor r9d, r9d
cmp sil, sil
sub edx, edx
jmp 0x18013e018
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp r15w, 0x6794
cmp rax, 0xffffffffffffffff
jmp 0x18013e030
jne 0x18013e08f
mov r9, r12
sal ch, 0x44
sub r8d, r8d
sbb rcx, r15
sub edx, edx
not ch
movsx ecx, r14w
cmovns ecx, esp
mov rcx, rdi
jmp 0x18013e055
call fcn.18013d97d
mov ebx, eax
test r13w, r8w
test r10b, 0xf9
cmp byte [rsp + 0x68], r14b
jmp 0x18013e06e
je 0x18013e083
mov rcx, qword [rsp + 0x50]
jmp 0x18013e07e
call fcn.18013cded
mov eax, ebx
jmp 0x18013e08a
jmp 0x18013e3a7
mov rsi, qword [r12 + 8]
sub rsi, qword [r12]
jmp 0x18013e0a6
sar rsi, 3
test r8, rsi
sub edx, edx
mov qword [rbp - 0x50], r14
lea rcx, [rbp - 0x70]
jmp 0x18013e0bc
mov qword [rbp - 0x48], r14
jmp 0x18013e0c5
mov qword [rbp - 0x40], r14
jmp 0x18013e0ce
mov qword [rbp - 0x38], r14
jmp 0x18013e0d7
mov qword [rbp - 0x30], r14
jmp 0x18013e0e0
mov byte [rbp - 0x28], r14b
jmp 0x18013e0e9
call fcn.18013e3ec
mov rax, qword [rbp - 0x68]
mov ecx, 0xfde9
cmp dword [rax + 0xc], ecx
jne 0x18013e134
cmp byte [rbp - 0x58], r14b
je 0x18013e127
mov rax, qword [rbp - 0x70]
shl r9b, 0x25
and dword [rax + 0x3a8], 0xfffffffd
movsxd r9, r13d
mov r9, 0x34670514
movzx r9d, r15w
mov r9d, ecx
jmp 0x18013e12f
jmp 0x18013e1b0
call fcn.1801409f1
test eax, eax
jmp 0x18013e140
jne 0x18013e181
cmp byte [rbp - 0x58], r14b
jmp 0x18013e14f
je 0x18013e176
mov rax, qword [rbp - 0x70]
movzx r9w, r14b
sub r9b, r10b
movzx r9, sp
and dword [rax + 0x3a8], 0xfffffffd
not r9b
movsxd r9, r10d
movzx r9, r12w
mov r9d, 1
jmp 0x18013e1b0
cmp byte [rbp - 0x58], r14b
jmp 0x18013e18a
je 0x18013e1a7
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
bswap r9
movzx dx, r8b
xchg r9w, cx
mov r9d, r14d
movsx r8d, bp
not dl
lea r8, [rsp + 0x30]
mov cx, 0x6d24
movzx ecx, r13w
lea rdx, [rbp - 0x50]
setp cl
movsxd rcx, r15d
xchg ecx, ecx
lea rcx, [rbp + 0xc]
jmp 0x18013e1d2
call fcn.18013d18f
mov r14, qword [rbp - 0x40]
xor edx, edx
test eax, eax
movzx ecx, ax
mov cl, sil
mov rcx, r14
jmp 0x18013e1ed
cmovne rcx, rdx
cmc
cmp sil, 0x33
cmp byte [rcx], 0x2e
jmp 0x18013e1fe
jne 0x18013e24a
mov al, byte [rcx + 1]
test al, al
jmp 0x18013e20e
jne 0x18013e234
cmp byte [rbp - 0x28], dl
jmp 0x18013e21c
je 0x18013e2a1
mov rcx, r14
jmp 0x18013e22a
call fcn.18013cded
jmp 0x18013e2a1
cmp al, 0x2e
jmp 0x18013e23b
jne 0x18013e24a
cmp byte [rcx + 2], dl
je 0x18013e214
mov r9, r12
mov dx, r15w
not r8b
mov r8, r13
bswap rdx
mov rdx, rdi
call fcn.18013d97d
mov r13d, eax
cmp ecx, r10d
jmp 0x18013e26e
test eax, eax
jmp 0x18013e275
jne 0x18013e35c
cmp byte [rbp - 0x28], al
jmp 0x18013e283
je 0x18013e296
mov rcx, r14
jmp 0x18013e291
call fcn.18013cded
mov r13, qword [rsp + 0x38]
cdq
jmp 0x18013e2a1
lea rdx, [rbp - 0x20]
xchg rcx, rcx
movsxd rcx, r14d
movzx cx, r11b
mov rcx, rbx
jmp 0x18013e2b8
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
sub r14d, r14d
cmc
test eax, eax
jmp 0x18013e2c9
jne 0x18013e0ad
mov rax, qword [r12]
cmp sp, 0x2daf
bt dx, 0x3d
mov rdx, qword [r12 + 8]
jmp 0x18013e2e8
sub rdx, rax
sar rdx, 3
test r10d, 0x4cdb2c70
cmc
cmp rsi, rdx
jmp 0x18013e2ff
je 0x18013e328
sub rdx, rsi
lea rcx, [rax + rsi*8]
lea r9, [0x1800697f8]
mov r8w, 0x543f
movzx r8, di
not r8b
lea r8d, [r14 + 8]
call fcn.18014388f
mov rcx, rbx
jmp 0x18013e330
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x18013e340
je 0x18013e350
mov rcx, qword [rsp + 0x50]
call fcn.18013cded
sub eax, eax
jmp 0x18013e357
jmp 0x18013e3a7
cmp byte [rbp - 0x28], 0
je 0x18013e36e
mov rcx, r14
call fcn.18013cded
mov rcx, rbx
jmp 0x18013e376
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x18013e386
je 0x18013e39b
mov rcx, qword [rsp + 0x50]
jmp 0x18013e396
call fcn.18013cded
mov eax, r13d
jmp 0x18013e3a7
mov rcx, qword [rbp + 0x230]
clc
cmc
xor rcx, rsp
jmp 0x18013e3b8
call fcn.18012d754
add rsp, 0x340
pop r14
mov r13b, sil
pop r13
not r12d
movsx edi, ax
pop r12
movzx bp, spl
pop rdi
pop rsi
mov rbp, rsp
pop rbx
mov bp, 0x2556
movzx ebp, di
pop rbp
jmp 0x18013e3eb
ret