Function at 0x1801386f4
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
neg rax
cmp edi, r9d
push rbx
rcr bx, 0xd2
ror ax, cl
shr bp, cl
push rsi
push rdi
or bh, bh
sbb dil, r12b
push r12
and r12b, r10b
adc ebx, r9d
push r13
ror bx, 0x50
push r14
btr di, 0xa
lea rbp, [rsp - 0x240]
stc
movzx di, r8b
sub rsp, 0x340
cwde
shl bh, cl
mov rax, qword [0x180085010]
sub bh, cl
mov r12b, r10b
sal dil, 0x13
xor rax, rsp
bt r12w, 0x3d
sar bl, cl
mov qword [rbp + 0x230], rax
cmovns bx, r10w
sbb dil, 0x9f
shrd ebx, r10d, 0x74
mov r12, r8
btr edi, 0x58
mov rdi, rcx
sub rbx, 0x37b6571a
movabs rbx, 0x200000000801
cmp rdx, rcx
je 0x1801387f0
mov al, byte [rdx]
cmp rdx, r11
jmp 0x1801387a0
sub al, 0x2f
cmp al, r11b
cmp al, 0x2d
jmp 0x1801387ac
ja 0x1801387c5
movsx rax, al
bt rbx, rax
jmp 0x1801387bf
jb 0x1801387f0
mov rcx, rdi
jmp 0x1801387cd
call fcn.1800987a0
mov rdx, rax
cmp r13d, 0x1e909d5
cmc
jmp 0x1801387e2
cmp rax, rdi
jmp 0x1801387ea
jne 0x18013878f
mov r8b, byte [rdx]
cmp dh, bl
cmp r8b, 0x3a
jmp 0x1801387fe
jne 0x180138848
lea rax, [rdi + 1]
test r10b, r13b
cmp rdx, rax
jmp 0x180138813
je 0x180138848
mov r9, r12
shrd cx, r15w, 0xe9
adc cl, r8b
xor r8d, r8d
add ch, 0x55
sub edx, edx
xchg ch, cl
movsxd rcx, edx
mov cx, 0x513a
mov rcx, rdi
jmp 0x18013883e
call fcn.18013839e
jmp 0x180138db4
sub r8b, 0x2f
clc
stc
xor r14d, r14d
cmc
cmp r8b, 0x2d
ja 0x180138872
movsx rax, r8b
clc
bt rbx, rax
mov al, 1
jmp 0x18013886c
jb 0x18013887d
mov al, r14b
movsx rcx, r12w
sbb ecx, ebx
sar cl, cl
sub rdx, rdi
cmovbe cx, dx
movsx cx, dil
bswap cx
mov qword [rsp + 0x40], r14
xchg cl, ch
movzx cx, spl
cmovne cx, r12w
inc rdx
sar cl, cl
shl cx, 8
or ch, 0x2e
mov qword [rsp + 0x48], r14
sar cx, 0x70
movsx ecx, r15w
neg al
mov qword [rsp + 0x50], r14
movzx ecx, dx
bswap ecx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], r14
jmp 0x1801388d1
sbb r13, r13
clc
cmp r13b, 0x23
cmc
mov qword [rsp + 0x60], r14
cmc
jmp 0x1801388e6
and r13, rdx
cmp dil, 0x5d
mov byte [rsp + 0x68], r14b
jmp 0x1801388f7
sub edx, edx
mov qword [rsp + 0x38], r13
call fcn.180138dfb
mov rax, qword [rsp + 0x78]
bswap ecx
bts ecx, edi
movzx ecx, si
mov ecx, 0xfde9
stc
cmp dword [rax + 0xc], ecx
jmp 0x18013891e
jne 0x180138957
cmp byte [rbp - 0x78], r14b
jmp 0x18013892d
je 0x18013894a
mov rax, qword [rsp + 0x70]
and dword [rax + 0x3a8], 0xfffffffd
movzx r9, r8w
seto r9b
mov r9b, 0x5e
mov r9d, ecx
jmp 0x180138952
jmp 0x1801389cb
call fcn.18013b31f
test eax, eax
jmp 0x180138963
jne 0x18013899d
cmp byte [rbp - 0x78], r14b
jmp 0x180138972
je 0x18013898d
mov rax, qword [rsp + 0x70]
bts r9w, r11w
and dword [rax + 0x3a8], 0xfffffffd
bswap r9w
mov r9d, 1
jmp 0x180138998
jmp 0x1801389cb
cmp byte [rbp - 0x78], r14b
je 0x1801389b8
mov rax, qword [rsp + 0x70]
and dword [rax + 0x3a8], 0xfffffffd
bswap r8d
cwd
mov r9d, r14d
movzx edx, r9w
mov r8, 0x35d24d5
movzx r8w, r14b
lea r8, [rsp + 0x30]
mov rcx, rdi
cdq
lea rdx, [rsp + 0x40]
call fcn.1801378d0
mov rcx, qword [rsp + 0x50]
btc r8w, sp
setl r8b
bsr r8, r10
lea r8, [rbp - 0x20]
stc
cmp r10d, ecx
test eax, eax
jmp 0x1801389ff
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
jmp 0x180138a0e
cmovne rcx, r14
test sp, r11w
cmc
xor r9d, r9d
xor edx, edx
jmp 0x180138a21
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
test r10, r12
clc
cmp rax, 0xffffffffffffffff
jmp 0x180138a37
jne 0x180138a9d
mov r9, r12
rcl ecx, 0x10
seto ch
cmp sil, dil
xor r8d, r8d
or cx, 0x65a7
xchg cl, ch
movzx cx, dh
xor edx, edx
mov rcx, rdi
jmp 0x180138a61
call fcn.18013839e
mov ebx, eax
test r12d, 0x50a80fda
cmp r8b, bl
cmp byte [rsp + 0x68], r14b
jmp 0x180138a7c
je 0x180138a91
mov rcx, qword [rsp + 0x50]
jmp 0x180138a8c
call fcn.18013785e
mov eax, ebx
jmp 0x180138a98
jmp 0x180138db4
mov rsi, qword [r12 + 8]
and ch, 0xac
xor cl, r13b
bts rcx, r14
sub rsi, qword [r12]
movsxd rcx, r10d
sar rsi, 3
bts ecx, r12d
adc cl, 0x9f
movsx ecx, dx
xor edx, edx
movsx ecx, r13w
movsx rcx, r11w
mov cx, 0x3a2b
mov qword [rbp - 0x50], r14
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x48], r14
jmp 0x180138ae0
mov qword [rbp - 0x40], r14
jmp 0x180138ae9
mov qword [rbp - 0x38], r14
jmp 0x180138af2
mov qword [rbp - 0x30], r14
mov byte [rbp - 0x28], r14b
call fcn.180138dfb
mov rax, qword [rbp - 0x68]
adc cx, bp
shrd rcx, rbp, 0x32
adc ch, 0x79
mov ecx, 0xfde9
test dl, r12b
cmp dword [rax + 0xc], ecx
jmp 0x180138b1e
jne 0x180138b52
cmp byte [rbp - 0x58], r14b
jmp 0x180138b2d
je 0x180138b45
mov rax, qword [rbp - 0x70]
shl r9b, cl
and dword [rax + 0x3a8], 0xfffffffd
xchg r9w, r9w
mov r9d, ecx
jmp 0x180138b4d
jmp 0x180138bb7
call fcn.18013b31f
test eax, eax
jmp 0x180138b5e
jne 0x180138b91
cmp byte [rbp - 0x58], r14b
je 0x180138b81
mov rax, qword [rbp - 0x70]
mov r9w, di
setnp r9b
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x180138b8c
jmp 0x180138bb7
cmp byte [rbp - 0x58], r14b
jmp 0x180138b9a
je 0x180138bb4
mov rax, qword [rbp - 0x70]
and dword [rax + 0x3a8], 0xfffffffd
cmovl dx, sp
cqo
setle dl
mov r9d, r14d
lea r8, [rsp + 0x30]
movzx rdx, di
lea rdx, [rbp - 0x50]
movzx rcx, r13w
lea rcx, [rbp + 0xc]
jmp 0x180138bd1
call fcn.180137bc9
mov r14, qword [rbp - 0x40]
ror ch, cl
sub edx, edx
btc cx, r10w
test eax, eax
jmp 0x180138bee
mov rcx, r14
jmp 0x180138bf6
cmovne rcx, rdx
cmp byte [rcx], 0x2e
jne 0x180138c4e
mov al, byte [rcx + 1]
test al, al
jmp 0x180138c0d
jne 0x180138c33
cmp byte [rbp - 0x28], dl
jmp 0x180138c1b
je 0x180138c9d
mov rcx, r14
jmp 0x180138c29
call fcn.18013785e
jmp 0x180138c9d
cmp al, 0x2e
jmp 0x180138c3a
jne 0x180138c4e
cmp byte [rcx + 2], dl
jmp 0x180138c48
je 0x180138c13
mov r9, r12
mov r8, r13
bswap dx
mov dl, dil
movsxd rdx, r14d
mov rdx, rdi
jmp 0x180138c65
call fcn.18013839e
mov r13d, eax
test eax, eax
jne 0x180138d68
cmp byte [rbp - 0x28], al
je 0x180138c8b
mov rcx, r14
jmp 0x180138c86
call fcn.18013785e
mov r13, qword [rsp + 0x38]
movzx rcx, r8w
movsx cx, ch
jmp 0x180138c9d
lea rdx, [rbp - 0x20]
movzx ecx, r8w
mov rcx, rbx
jmp 0x180138cad
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r14d, r14d
stc
cmp r15b, sil
jmp 0x180138cbf
test eax, eax
jmp 0x180138cc6
jne 0x180138ac1
mov rax, qword [r12]
and dh, 0x7d
bsr edx, r11d
not edx
mov rdx, qword [r12 + 8]
jmp 0x180138ce6
sub rdx, rax
stc
sar rdx, 3
test si, 0x7eee
cmp rsi, rdx
jmp 0x180138cfb
je 0x180138d34
sub rdx, rsi
movsx cx, bpl
movzx r8, bx
movsxd rcx, r13d
lea rcx, [rax + rsi*8]
lea r9, [0x180067698]
cmovo r8w, r8w
mov r8b, bl
movsxd r8, esi
lea r8d, [r14 + 8]
jmp 0x180138d2f
call fcn.18013e16c
mov rcx, rbx
jmp 0x180138d3c
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], r14b
jmp 0x180138d4c
je 0x180138d61
mov rcx, qword [rsp + 0x50]
jmp 0x180138d5c
call fcn.18013785e
xor eax, eax
jmp 0x180138db4
cmp byte [rbp - 0x28], 0
jmp 0x180138d71
je 0x180138d84
mov rcx, r14
jmp 0x180138d7f
call fcn.18013785e
mov rcx, rbx
jmp 0x180138d8c
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rsp + 0x68], 0
jmp 0x180138d9c
je 0x180138db1
mov rcx, qword [rsp + 0x50]
jmp 0x180138dac
call fcn.18013785e
mov eax, r13d
mov rcx, qword [rbp + 0x230]
cmc
xor rcx, rsp
jmp 0x180138dc4
call fcn.18012808d
add rsp, 0x340
setno bpl
movzx rsi, r12w
xchg r13w, r13w
pop r14
xchg r13w, bp
pop r13
pop r12
pop rdi
xchg sil, bl
pop rsi
pop rbx
xchg bp, bp
movsx bp, bpl
pop rbp
jmp 0x180138dfa
ret