Function at 0x1404d929f
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
bsf ax, cx
push rbp
movsx ax, cl
rol bpl, cl
push rsi
push rdi
cdqe
push r12
sub bpl, dl
push r13
adc sil, r12b
cbw
sub bp, 0x50e0
push r14
shl bp, 0xc1
movzx r12d, r8w
push r15
movsx rax, r8w
xchg ebx, esi
shld ax, r15w, 0x10
lea rbp, [rsp - 0x230]
movsx rsi, ax
sub rsp, 0x330
sar si, cl
mov rax, qword [0x1400b7288]
rcl si, cl
xor rax, rsp
shrd si, r9w, 0x5e
sal bx, cl
mov qword [rbp + 0x220], rax
xor r12b, 0xcf
mov r12, r8
ror bx, cl
adc rbx, 0x24235404
mov rsi, rcx
jmp 0x1404d9329
movabs rbx, 0x200000000801
cmc
cmp rdx, rcx
jmp 0x1404d933c
je 0x1404d9399
mov al, byte [rdx]
cmp r12w, 0x28a1
sub al, 0x2f
jmp 0x1404d9358
cmp al, 0x2d
jmp 0x1404d935f
ja 0x1404d9378
movsx rax, al
jmp 0x1404d936e
bt rbx, rax
jb 0x1404d9399
mov rcx, rsi
jmp 0x1404d9380
call fcn.140225e28
mov rdx, rax
jmp 0x1404d9390
cmp rax, rsi
jne 0x1404d9342
mov r8b, byte [rdx]
cmc
clc
cmp r13b, spl
cmp r8b, 0x3a
jmp 0x1404d93aa
jne 0x1404d93e6
lea rax, [rsi + 1]
cmc
clc
cmp rdx, rax
jmp 0x1404d93be
je 0x1404d93e6
mov r9, r12
xor r8d, r8d
movsx rcx, r8w
sub edx, edx
not ecx
bswap ecx
mov rcx, rsi
jmp 0x1404d93dc
call fcn.1404d8f5e
jmp 0x1404d989d
sub r8b, 0x2f
cmp bp, 0x26b5
test bpl, r14b
xor edi, edi
cmp r8, r12
clc
cmp r8b, 0x2d
jmp 0x1404d9401
ja 0x1404d941e
movsx rax, r8b
cmc
clc
bt rbx, rax
mov al, 1
jmp 0x1404d9418
jb 0x1404d9428
mov al, dil
add rcx, 0x9446a25
sub rdx, rsi
inc cl
mov qword [rbp - 0x60], rdi
seta cl
inc rdx
not rcx
movsxd rcx, r14d
mov qword [rbp - 0x58], rdi
bsf cx, cx
neg al
mov qword [rbp - 0x50], rdi
not cl
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x48], rdi
jmp 0x1404d945b
sbb r13, r13
test cl, ah
jmp 0x1404d946b
mov qword [rbp - 0x40], rdi
and r13, rdx
test r10b, r13b
cmp r12w, bx
clc
mov byte [rbp - 0x38], dil
sub edx, edx
call fcn.1404a520b
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d9499
jne 0x1404d94e2
cmp byte [rsp + 0x48], dil
jmp 0x1404d94a9
je 0x1404d94d5
mov rax, qword [rsp + 0x30]
xadd r8w, r8w
rol r8b, cl
shl r8b, 0xf6
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, bpl
jmp 0x1404d94d5
mov r8d, r15d
jmp 0x1404d94dd
jmp 0x1404d954d
call fcn.1404cb2fc
test eax, eax
jmp 0x1404d94ee
jne 0x1404d952a
cmp byte [rsp + 0x48], dil
jmp 0x1404d94fe
je 0x1404d951f
mov rax, qword [rsp + 0x30]
shl r8b, 0x42
bswap r8
ror r8w, 0xc5
and dword [rax + 0x3a8], 0xfffffffd
movsxd r8, r12d
mov r8d, 1
jmp 0x1404d954d
cmp byte [rsp + 0x48], dil
jmp 0x1404d9534
je 0x1404d9547
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
cdq
mov r8d, edi
setbe dl
lea rdx, [rbp - 0x60]
mov rcx, rsi
jmp 0x1404d9559
call fcn.1404a5c27
mov rcx, qword [rbp - 0x50]
xor r8d, edi
lea r8, [rbp - 0x30]
test eax, eax
jmp 0x1404d9570
mov dword [rsp + 0x28], edi
jmp 0x1404d9579
mov qword [rsp + 0x20], rdi
jmp 0x1404d9583
cmovne rcx, rdi
cmp r15w, cx
xor r9d, r9d
jmp 0x1404d9593
xor edx, edx
jmp 0x1404d959a
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
clc
cmc
cmp r11w, r9w
cmp rax, 0xffffffffffffffff
jne 0x1404d95e4
mov r9, r12
xor cl, 0x82
inc cl
movsxd rcx, r8d
sub r8d, r8d
sar ch, cl
btc ecx, 0x3c
and ecx, edx
xor edx, edx
mov rcx, rsi
jmp 0x1404d95d3
call fcn.1404d8f5e
mov edi, eax
jmp 0x1404d95df
jmp 0x1404d9883
mov r14, qword [r12 + 8]
sar cl, cl
cmc
sub r14, qword [r12]
sar r14, 3
xor edx, edx
movsx rcx, cx
setp ch
not cl
mov qword [rsp + 0x70], rdi
mov rcx, 0x15a7197e
bswap ecx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404d961c
mov qword [rbp - 0x80], rdi
jmp 0x1404d9625
mov qword [rbp - 0x78], rdi
jmp 0x1404d962e
mov qword [rbp - 0x70], rdi
jmp 0x1404d9637
mov byte [rbp - 0x68], dil
jmp 0x1404d9640
call fcn.1404a520b
mov rax, qword [rsp + 0x58]
cmp r9, 0x7df65292
test ah, ch
cmp dword [rax + 0xc], r15d
jne 0x1404d9698
cmp byte [rsp + 0x68], dil
jmp 0x1404d9667
je 0x1404d968b
mov rax, qword [rsp + 0x50]
movzx r8w, r11b
cmp r12d, r8d
and dword [rax + 0x3a8], 0xfffffffd
movsxd r8, ebp
movsx r8, r11w
mov r8, rsp
mov r8d, r15d
jmp 0x1404d9693
jmp 0x1404d9702
call fcn.1404cb2fc
test eax, eax
jmp 0x1404d96a4
jne 0x1404d96d7
cmp byte [rsp + 0x68], dil
jmp 0x1404d96b4
je 0x1404d96cc
mov rax, qword [rsp + 0x50]
not r8
rcl r8b, cl
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404d9702
cmp byte [rsp + 0x68], dil
jmp 0x1404d96e1
je 0x1404d96fa
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
cqo
movsx r8w, dl
mov r8d, edi
not cl
bswap rcx
lea rdx, [rsp + 0x70]
xchg ch, ch
movzx cx, r11b
bswap cx
lea rcx, [rbp - 4]
jmp 0x1404d971a
call fcn.1404d879d
mov r15, qword [rbp - 0x80]
test dil, r9b
not rcx
test eax, eax
mov rcx, r15
jmp 0x1404d9733
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d973f
jne 0x1404d9771
mov al, byte [rcx + 1]
test r15b, 0xd
stc
test al, al
jmp 0x1404d9754
je 0x1404d97a3
cmp al, 0x2e
jne 0x1404d9771
cmp byte [rcx + 2], dil
jmp 0x1404d976b
je 0x1404d97a3
mov r9, r12
movzx r8d, r10w
bswap r8d
cmovg r8d, ebx
mov r8, r13
mov rdx, rsi
call fcn.1404d8f5e
mov edi, eax
stc
test eax, eax
jmp 0x1404d9794
jne 0x1404d985e
xor edi, edi
clc
cmc
jmp 0x1404d97a3
cmp byte [rbp - 0x68], dil
je 0x1404d97ba
mov rcx, r15
jmp 0x1404d97b5
call fcn.1404ca184
lea rdx, [rbp - 0x30]
not cl
movsxd rcx, edx
mov rcx, rbx
jmp 0x1404d97cb
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
clc
test dx, 0x6e30
cmp dh, 0xd0
test eax, eax
jmp 0x1404d97e7
jne 0x1404d95f4
mov rax, qword [r12]
shr dx, cl
btc dx, 0x55
clc
mov rdx, qword [r12 + 8]
cmc
cmp r9b, bpl
sub rdx, rax
cmp di, ax
cmp sil, 0x4d
jmp 0x1404d9812
sar rdx, 3
cmp r14, rdx
jmp 0x1404d981e
je 0x1404d987a
sub rdx, r14
not r8b
setbe ch
cmovbe r8w, r14w
lea rcx, [rax + r14*8]
lea r9, [0x1400acc8c]
movsx r8, di
jmp 0x1404d9849
mov r8d, 8
jmp 0x1404d9854
call fcn.1404e56d1
jmp 0x1404d987a
cmp byte [rbp - 0x68], 0
jmp 0x1404d9867
je 0x1404d987a
mov rcx, r15
jmp 0x1404d9875
call fcn.1404ca184
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404d989b
mov rcx, qword [rbp - 0x50]
jmp 0x1404d9896
call fcn.1404ca184
mov eax, edi
mov rcx, qword [rbp + 0x220]
cmc
xor rcx, rsp
jmp 0x1404d98ad
call fcn.1404a0686
mov rbx, qword [rsp + 0x388]
dec dil
rol r13w, 0xe8
add rsp, 0x330
cmovnp si, cx
pop r15
mov esi, 0x3657004a
cmovno r12d, r14d
jmp 0x1404d98dd
pop r14
movzx si, bl
mov r12b, 0x10
pop r13
pop r12
pop rdi
jmp 0x1404d98f7
pop rsi
movzx bp, dl
pop rbp
ret