Function at 0x1404d4385
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
sbb bl, spl
adc bh, 0xc4
add al, sil
push rbp
or al, sil
btr rax, rbx
push rsi
rcr sil, cl
shl si, 0x83
sar bh, cl
push rdi
push r12
rcl eax, cl
bt rbx, 0x8b
push r13
cmp r8w, r14w
shr rbx, cl
push r14
push r15
test dil, 0x2a
lea rbp, [rsp - 0x230]
sar al, cl
adc r12b, 0x8d
sub rsp, 0x330
sbb sil, bpl
mov rax, qword [0x1400b7288]
xor rax, rsp
btc ebx, ebp
cmc
shr r12b, 0xa
mov qword [rbp + 0x220], rax
btc r12w, 0x11
mov r12, r8
bswap rbx
movsx bx, r13b
shld esi, r10d, 0x76
mov rsi, rcx
btc bx, r13w
btc ebx, 0xb8
movabs rbx, 0x200000000801
cmp r15, r10
cmp rdx, rcx
jmp 0x1404d4428
je 0x1404d4479
mov al, byte [rdx]
test bp, dx
cmp r8b, sil
sub al, 0x2f
test r12w, 0x4f8c
cmp al, 0x2d
jmp 0x1404d4445
ja 0x1404d4463
movsx rax, al
jmp 0x1404d4454
bt rbx, rax
jmp 0x1404d445d
jb 0x1404d4479
mov rcx, rsi
call fcn.1400fa1b8
mov rdx, rax
clc
cmc
cmp rax, rsi
jne 0x1404d442e
mov r8b, byte [rdx]
cmp r8b, 0x3a
jmp 0x1404d4485
jne 0x1404d44be
lea rax, [rsi + 1]
test r11w, cx
clc
cmp rdx, rax
jmp 0x1404d449c
je 0x1404d44be
mov r9, r12
dec cl
xor r8d, r8d
setle ch
sub edx, edx
xchg cl, ch
mov rcx, rsi
call fcn.1404d4075
jmp 0x1404d4953
sub r8b, 0x2f
sub edi, edi
clc
cmc
cmp r8b, 0x2d
jmp 0x1404d44cf
ja 0x1404d44e5
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x1404d44f3
mov al, dil
sub ecx, edx
movsx cx, bh
btc rcx, 0xe3
sub rdx, rsi
mov qword [rbp - 0x60], rdi
inc rdx
mov qword [rbp - 0x58], rdi
sal cx, cl
neg al
movsx rcx, r15w
mov qword [rbp - 0x50], rdi
bswap ecx
movsx cx, r8b
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x48], rdi
sbb r13, r13
stc
mov qword [rbp - 0x40], rdi
cmp r14b, al
stc
cmc
and r13, rdx
clc
test r8b, cl
mov byte [rbp - 0x38], dil
test r12b, sil
cmp sil, r12b
xor edx, edx
call fcn.1404a058c
mov rax, qword [rsp + 0x38]
sal r15b, 0x29
mov r15d, 0xfde9
test r9b, r12b
cmp eax, 0x37200c20
cmp dword [rax + 0xc], r15d
jmp 0x1404d4563
jne 0x1404d459e
cmp byte [rsp + 0x48], dil
jmp 0x1404d4573
je 0x1404d4596
mov rax, qword [rsp + 0x30]
btr r8w, di
and dword [rax + 0x3a8], 0xfffffffd
xchg r8w, r8w
movsxd r8, ebp
movsx r8w, bpl
mov r8d, r15d
jmp 0x1404d4622
call fcn.1404c66cc
test eax, eax
jmp 0x1404d45aa
jne 0x1404d45f5
cmp byte [rsp + 0x48], dil
jmp 0x1404d45ba
je 0x1404d45e5
mov rax, qword [rsp + 0x30]
sal r8d, cl
movzx r8w, r12b
btc r8, 3
and dword [rax + 0x3a8], 0xfffffffd
xchg r8d, r8d
movzx r8, bp
movzx r8w, dl
mov r8d, 1
jmp 0x1404d45f0
jmp 0x1404d4622
cmp byte [rsp + 0x48], dil
jmp 0x1404d45ff
je 0x1404d461f
mov rax, qword [rsp + 0x30]
sub r8, 0x10fc5dd9
and dword [rax + 0x3a8], 0xfffffffd
xchg cx, dx
movzx ecx, r13w
mov r8d, edi
lea rdx, [rbp - 0x60]
mov cl, 0xb2
bswap ecx
mov rcx, rsi
call fcn.1404a0fa4
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
test eax, eax
jmp 0x1404d4641
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1404d464f
cmovne rcx, rdi
cmp r13b, 0x13
xor r9d, r9d
cmp r8, rbp
stc
jmp 0x1404d4663
xor edx, edx
jmp 0x1404d466a
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x1404d467c
jne 0x1404d46b7
mov r9, r12
bsf cx, ax
sal cl, 0xb5
test bpl, dil
xor r8d, r8d
movsx rcx, r13w
sub cl, 0x73
xor edx, edx
movsx rcx, r14w
movzx ecx, r13w
mov rcx, rsi
jmp 0x1404d46ab
call fcn.1404d4075
mov edi, eax
jmp 0x1404d4936
mov r14, qword [r12 + 8]
bt ecx, ebx
btr cx, r11w
rcl cl, cl
sub r14, qword [r12]
cmc
sar r14, 3
xor edx, edx
movsx rcx, r11w
mov cl, r13b
movzx rcx, r8w
mov qword [rsp + 0x70], rdi
movsx rcx, r13w
xchg rcx, rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
jmp 0x1404d46fb
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404d4708
mov byte [rbp - 0x68], dil
jmp 0x1404d4711
call fcn.1404a058c
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0xc], r15d
jmp 0x1404d4724
jne 0x1404d4757
cmp byte [rsp + 0x68], dil
jmp 0x1404d4734
je 0x1404d474a
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
bswap r8w
mov r8d, r15d
jmp 0x1404d4752
jmp 0x1404d47c9
call fcn.1404c66cc
test eax, eax
jne 0x1404d47a2
cmp byte [rsp + 0x68], dil
jmp 0x1404d476e
je 0x1404d4792
mov rax, qword [rsp + 0x50]
rcr r8w, 0x4c
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, bl
movsx r8, r13w
movzx r8, di
mov r8d, 1
jmp 0x1404d479d
jmp 0x1404d47c9
cmp byte [rsp + 0x68], dil
jmp 0x1404d47ac
je 0x1404d47c1
mov rax, qword [rsp + 0x50]
not r8b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
movsx dx, bpl
lea rdx, [rsp + 0x70]
jmp 0x1404d47dc
lea rcx, [rbp - 4]
jmp 0x1404d47e5
call fcn.1404d38e1
mov r15, qword [rbp - 0x80]
test eax, eax
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d47ff
jne 0x1404d482d
mov al, byte [rcx + 1]
test r15w, r11w
clc
stc
test al, al
je 0x1404d4865
cmp al, 0x2e
jmp 0x1404d481d
jne 0x1404d482d
cmp byte [rcx + 2], dil
je 0x1404d4865
mov r9, r12
jmp 0x1404d4839
mov r8, r13
mov dl, 0xdb
bswap dx
mov rdx, rsi
jmp 0x1404d4849
call fcn.1404d4075
mov edi, eax
clc
cmp ch, 0xe6
test eax, eax
jmp 0x1404d485b
jne 0x1404d4916
xor edi, edi
clc
stc
cmp byte [rbp - 0x68], dil
jmp 0x1404d486e
je 0x1404d4881
mov rcx, r15
jmp 0x1404d487c
call fcn.1404c558c
lea rdx, [rbp - 0x30]
movzx rcx, r8w
bswap cx
movsx ecx, ax
mov rcx, rbx
jmp 0x1404d4897
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp al, ch
test eax, eax
jmp 0x1404d48ac
jne 0x1404d46cf
mov rax, qword [r12]
and dx, 0x98b
xor dh, 0x52
sbb dl, r11b
mov rdx, qword [r12 + 8]
stc
sub rdx, rax
cmp r14w, r13w
sar rdx, 3
cmp r14, rdx
jmp 0x1404d48da
je 0x1404d492d
sub rdx, r14
movzx r9w, r14b
lea rcx, [rax + r14*8]
movsx r8d, r11w
cmovg r9d, r13d
xchg r8d, r9d
lea r9, [0x1400acc8c]
bswap r8w
xchg r8w, r8w
mov r8d, 8
call fcn.1404e071f
jmp 0x1404d492d
cmp byte [rbp - 0x68], 0
je 0x1404d492d
mov rcx, r15
jmp 0x1404d4928
call fcn.1404c558c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404d494e
mov rcx, qword [rbp - 0x50]
jmp 0x1404d4949
call fcn.1404c558c
mov eax, edi
not cl
clc
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
jmp 0x1404d4962
call fcn.14049bac2
mov rbx, qword [rsp + 0x388]
bsr r12w, r11w
adc bp, r13w
rcl r12w, 0x35
add rsp, 0x330
xchg bp, r14w
movzx rbp, r12w
pop r15
pop r14
movzx r12, sp
bswap rdi
pop r13
pop r12
movzx rdi, di
mov bp, 0x3546
pop rdi
pop rsi
movsx ebp, di
movzx ebp, r13w
pop rbp
jmp 0x1404d49b2
ret