Function at 0x1404de0a4
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
shld ax, r11w, 0x62
bt rax, 0x9e
push rbp
jmp 0x1404de0d4
push rsi
xor rax, 0x3271d2
movsx rsi, r12w
push rdi
push r12
shl bl, cl
adc r12b, sil
rcl bx, cl
push r13
xadd ax, r12w
push r14
neg ebp
rcr al, cl
inc ebp
push r15
btr esi, r14d
add sil, 0x6f
lea rbp, [rsp - 0x230]
and r12d, edx
sub rsp, 0x330
xor bl, 0x52
lahf
ror r12w, cl
mov rax, qword [0x1400b7288]
shrd r12, r8, 0x43
or ebx, r15d
movsx si, r12b
xor rax, rsp
rcl ebx, cl
mov qword [rbp + 0x220], rax
test r13b, dil
mov r12, r8
or bl, 0x19
mov rsi, rcx
cmovle rbx, r14
shr rbx, cl
movabs rbx, 0x200000000801
jmp 0x1404de166
cmp rdx, rcx
je 0x1404de1ba
mov al, byte [rdx]
sub al, 0x2f
clc
test esi, ebx
cmp al, 0x2d
jmp 0x1404de17d
ja 0x1404de196
movsx rax, al
bt rbx, rax
jmp 0x1404de190
jb 0x1404de1ba
mov rcx, rsi
jmp 0x1404de19e
call fcn.140230a60
mov rdx, rax
jmp 0x1404de1ac
cmp rax, rsi
jmp 0x1404de1b4
jne 0x1404de16f
mov r8b, byte [rdx]
cmc
cmp sp, r12w
cmp r8b, 0x3a
jmp 0x1404de1cb
jne 0x1404de204
lea rax, [rsi + 1]
cmp rdx, rax
je 0x1404de204
mov r9, r12
sub r8d, r8d
movsx cx, bpl
xor edx, edx
movzx rcx, r8w
movsx ecx, bp
mov rcx, rsi
jmp 0x1404de1fa
call fcn.1404ddd5a
jmp 0x1404de6b7
sub r8b, 0x2f
cmp dl, 0xf3
xor edi, edi
cmp r8b, 0x2d
jmp 0x1404de216
ja 0x1404de231
movsx rax, r8b
bt rbx, rax
mov al, 1
jmp 0x1404de22b
jb 0x1404de23a
mov al, dil
and cl, cl
movzx ecx, r13w
sub rdx, rsi
dec ecx
mov qword [rbp - 0x60], rdi
inc rdx
sbb rcx, rax
mov qword [rbp - 0x58], rdi
sal cx, 0x52
bts cx, bx
neg al
setbe cl
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404de268
mov qword [rbp - 0x48], rdi
jmp 0x1404de271
sbb r13, r13
mov qword [rbp - 0x40], rdi
and r13, rdx
stc
cmp bx, 0x710d
mov byte [rbp - 0x38], dil
test r11w, r11w
jmp 0x1404de28e
sub edx, edx
jmp 0x1404de295
call fcn.1404aa23f
mov rax, qword [rsp + 0x38]
movsx r15, si
xor r15b, r10b
bt r15w, 0xdf
mov r15d, 0xfde9
cmp spl, dil
cmp dword [rax + 0xc], r15d
jmp 0x1404de2be
jne 0x1404de2fc
cmp byte [rsp + 0x48], dil
jmp 0x1404de2ce
je 0x1404de2ef
mov rax, qword [rsp + 0x30]
sal r8w, 0xfe
dec r8b
and dword [rax + 0x3a8], 0xfffffffd
xchg r8b, r8b
movzx r8, r12w
mov r8d, r15d
jmp 0x1404de2f7
jmp 0x1404de363
call fcn.1404d0246
test eax, eax
jmp 0x1404de308
jne 0x1404de33e
cmp byte [rsp + 0x48], dil
jmp 0x1404de318
je 0x1404de32e
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
setns r8b
mov r8d, 1
jmp 0x1404de339
jmp 0x1404de363
cmp byte [rsp + 0x48], dil
je 0x1404de360
mov rax, qword [rsp + 0x30]
or r8b, r13b
and dword [rax + 0x3a8], 0xfffffffd
xchg cx, cx
cmovle cx, r9w
mov r8d, edi
lea rdx, [rbp - 0x60]
movzx ecx, r15w
mov rcx, rsi
jmp 0x1404de373
call fcn.1404aac1f
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
clc
test esp, 0x7dc65c18
test eax, eax
jmp 0x1404de38e
mov dword [rsp + 0x28], edi
jmp 0x1404de397
mov qword [rsp + 0x20], rdi
jmp 0x1404de3a1
cmovne rcx, rdi
clc
cmp di, 0x180e
sub r9d, r9d
stc
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
test r14, rcx
cmp rax, 0xffffffffffffffff
jmp 0x1404de3c6
jne 0x1404de3f8
mov r9, r12
neg ch
rcr ch, cl
sub r8d, r8d
or ecx, ebp
xor edx, edx
jmp 0x1404de3df
mov rcx, rsi
jmp 0x1404de3e7
call fcn.1404ddd5a
mov edi, eax
jmp 0x1404de3f3
jmp 0x1404de691
mov r14, qword [r12 + 8]
rol ecx, cl
bts ecx, r15d
sbb cx, 0x1cb7
sub r14, qword [r12]
btc ecx, 0xd6
sub cl, dh
add cl, 0xc7
sar r14, 3
cmp edx, eax
sub edx, edx
jmp 0x1404de427
mov qword [rsp + 0x70], rdi
movzx cx, bpl
movsxd rcx, r8d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404de443
mov qword [rbp - 0x80], rdi
jmp 0x1404de44c
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
jmp 0x1404de45d
call fcn.1404aa23f
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0xc], r15d
jne 0x1404de4a6
cmp byte [rsp + 0x68], dil
jmp 0x1404de47b
je 0x1404de49e
mov rax, qword [rsp + 0x50]
inc r8
and r8b, 0x40
or r8w, 0x692
and dword [rax + 0x3a8], 0xfffffffd
movsx r8, sp
mov r8d, r15d
jmp 0x1404de517
call fcn.1404d0246
test eax, eax
jmp 0x1404de4b2
jne 0x1404de4f5
cmp byte [rsp + 0x68], dil
je 0x1404de4e5
mov rax, qword [rsp + 0x50]
shld r8w, r14w, 0x3f
bts r8w, r9w
and dword [rax + 0x3a8], 0xfffffffd
cmovge r8d, edi
not r8b
movzx r8, r8w
mov r8d, 1
jmp 0x1404de4f0
jmp 0x1404de517
cmp byte [rsp + 0x68], dil
jmp 0x1404de4ff
je 0x1404de514
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
xchg r8b, cl
mov r8d, edi
lea rdx, [rsp + 0x70]
movsxd rcx, r12d
bswap rcx
jmp 0x1404de527
lea rcx, [rbp - 4]
jmp 0x1404de530
call fcn.1404dd5c8
mov r15, qword [rbp - 0x80]
rcl cx, 0x18
sal ch, 0x5f
test eax, eax
mov rcx, r15
jmp 0x1404de54a
cmovne rcx, rdi
jmp 0x1404de554
cmp byte [rcx], 0x2e
jmp 0x1404de55c
jne 0x1404de58e
mov al, byte [rcx + 1]
test al, al
jmp 0x1404de56c
je 0x1404de5c5
cmp al, 0x2e
jmp 0x1404de579
jne 0x1404de58e
cmp byte [rcx + 2], dil
jmp 0x1404de588
je 0x1404de5c5
mov r9, r12
mov r8, r13
bswap dx
movsx dx, r11b
mov rdx, rsi
jmp 0x1404de5a4
call fcn.1404ddd5a
mov edi, eax
test r12w, r14w
clc
test eax, eax
jmp 0x1404de5b7
jne 0x1404de667
sub edi, edi
test bx, 0x4b4b
clc
cmp byte [rbp - 0x68], dil
je 0x1404de5d7
mov rcx, r15
call fcn.1404cf14b
lea rdx, [rbp - 0x30]
movzx ecx, cx
jmp 0x1404de5e7
mov rcx, rbx
jmp 0x1404de5ef
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test r14b, 0x14
cmp r12w, 0x60a5
test eax, eax
jmp 0x1404de60c
jne 0x1404de41b
mov rax, qword [r12]
movsx edx, sp
mov rdx, qword [r12 + 8]
test ah, 0x89
sub rdx, rax
sar rdx, 3
jmp 0x1404de62f
cmp r14, rdx
je 0x1404de683
sub rdx, r14
lea rcx, [rax + r14*8]
movzx r9d, ax
movsxd r9, ebx
movzx r8w, r9b
lea r9, [0x1400acc8c]
mov r8d, 8
jmp 0x1404de65d
call fcn.1404ea418
jmp 0x1404de683
cmp byte [rbp - 0x68], 0
jmp 0x1404de670
je 0x1404de683
mov rcx, r15
jmp 0x1404de67e
call fcn.1404cf14b
mov rcx, rbx
jmp 0x1404de68b
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404de69a
je 0x1404de6ae
mov rcx, qword [rbp - 0x50]
jmp 0x1404de6a9
call fcn.1404cf14b
mov eax, edi
cmp dil, r15b
rcl rcx, 0xa6
mov rcx, qword [rbp + 0x220]
clc
xor rcx, rsp
jmp 0x1404de6c7
call fcn.1404a55f8
mov rbx, qword [rsp + 0x388]
movsx bp, r10b
rol si, cl
add rsp, 0x330
mov sil, al
movsx bp, bl
mov r12d, 0x42e513c8
pop r15
pop r14
movzx r13w, al
mov sil, 0x68
pop r13
pop r12
movzx bp, bl
jmp 0x1404de709
pop rdi
jmp 0x1404de718
pop rsi
setp bpl
mov bp, 0x3018
not bpl
pop rbp
ret