Function at 0x1404d7f72
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
movsx rbx, r13w
push rsi
rol bx, cl
inc ah
push rdi
btc rsi, r8
push r12
bsf rax, rsp
mov bh, 0x4a
rcr bl, cl
push r13
sal si, 0x67
rol bpl, cl
sar sil, 0x3b
push r14
shld r12d, esi, 0x4f
movsx rax, r10w
lahf
push r15
lea rbp, [rsp - 0x230]
shld ax, di, 0xb0
adc r12, 0x619f1813
sub rsp, 0x330
btc esi, r11d
mov rax, qword [0x1400b7288]
movsx si, dl
xor rax, rsp
shld esi, esi, 0x13
btc si, dx
mov qword [rbp + 0x220], rax
rol bx, 0x40
mov r12, r8
mov rsi, rcx
test ebx, 0x1d840a5f
btr bx, 0x54
ror bl, cl
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d8012
je 0x1404d805b
mov al, byte [rdx]
sub al, 0x2f
cmp eax, r9d
cmc
stc
cmp al, 0x2d
jmp 0x1404d8028
ja 0x1404d803d
movsx rax, al
stc
bt rbx, rax
jb 0x1404d805b
mov rcx, rsi
jmp 0x1404d8045
call fcn.1402246e8
mov rdx, rax
cmp rax, rsi
jmp 0x1404d8055
jne 0x1404d8018
mov r8b, byte [rdx]
cmp bh, 0xe3
clc
cmp r8b, 0x3a
jne 0x1404d80b5
lea rax, [rsi + 1]
cmc
cmp sil, r11b
test bp, 0x6020
cmp rdx, rax
je 0x1404d80b5
mov r9, r12
btc ecx, 0xb3
rcl cl, 0xdd
setne cl
xor r8d, r8d
shl cl, cl
not ch
sub edx, edx
mov cl, bpl
movsx cx, r9b
movsxd rcx, ecx
mov rcx, rsi
jmp 0x1404d80ab
call fcn.1404d7c22
jmp 0x1404d8589
sub r8b, 0x2f
cmc
jmp 0x1404d80bf
xor edi, edi
cmc
cmp r8b, 0x2d
jmp 0x1404d80cb
ja 0x1404d80e8
movsx rax, r8b
stc
cmc
bt rbx, rax
mov al, 1
jmp 0x1404d80e2
jb 0x1404d80ee
mov al, dil
cmp r9b, r11b
sub rdx, rsi
movzx cx, r15b
movsx ecx, cx
mov qword [rbp - 0x60], rdi
mov rcx, 0x1da3210b
movsxd rcx, edx
jmp 0x1404d810c
inc rdx
rol ch, 0x79
dec cl
setnp cl
mov qword [rbp - 0x58], rdi
sub ecx, r10d
neg al
not ch
mov qword [rbp - 0x50], rdi
movzx rcx, di
movsx ecx, r10w
movzx ecx, bp
lea rcx, [rsp + 0x30]
jmp 0x1404d813b
mov qword [rbp - 0x48], rdi
jmp 0x1404d8144
sbb r13, r13
stc
mov qword [rbp - 0x40], rdi
test r10b, r8b
and r13, rdx
mov byte [rbp - 0x38], dil
xor edx, edx
call fcn.1404a43f4
mov rax, qword [rsp + 0x38]
shr r15b, cl
bt r15w, r11w
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d8179
jne 0x1404d81bd
cmp byte [rsp + 0x48], dil
jmp 0x1404d8189
je 0x1404d81b0
mov rax, qword [rsp + 0x30]
movsxd r8, r13d
bts r8d, ecx
movsx r8w, sil
and dword [rax + 0x3a8], 0xfffffffd
not r8w
movzx r8w, r10b
mov r8d, r15d
jmp 0x1404d81b8
jmp 0x1404d8236
call fcn.1404ca149
test eax, eax
jmp 0x1404d81c9
jne 0x1404d8208
cmp byte [rsp + 0x48], dil
jmp 0x1404d81d9
je 0x1404d81fd
mov rax, qword [rsp + 0x30]
shl r8d, 0xfa
cmovbe r8, r10
dec r8b
and dword [rax + 0x3a8], 0xfffffffd
not r8b
cmovs r8d, r12d
mov r8d, 1
jmp 0x1404d8236
cmp byte [rsp + 0x48], dil
jmp 0x1404d8212
je 0x1404d822e
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov cl, 0xfd
setle r8b
movsx r8, r14w
mov r8d, edi
cdq
cmovbe rcx, rdx
lea rdx, [rbp - 0x60]
cmovs cx, r11w
mov rcx, rsi
jmp 0x1404d8247
call fcn.1404a4de9
mov rcx, qword [rbp - 0x50]
bsr r8w, r15w
lea r8, [rbp - 0x30]
test eax, eax
jmp 0x1404d8260
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1404d826e
cmovne rcx, rdi
xor r9d, r9d
jmp 0x1404d827d
xor edx, edx
jmp 0x1404d8284
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp dh, 0xfe
cmp rax, 0xffffffffffffffff
jne 0x1404d82c6
mov r9, r12
rcl cx, 0x25
sub r8d, r8d
xor ecx, edi
sub edx, edx
mov cx, 0xcbc
movzx rcx, ax
mov ecx, esp
mov rcx, rsi
jmp 0x1404d82ba
call fcn.1404d7c22
mov edi, eax
jmp 0x1404d856c
mov r14, qword [r12 + 8]
ror rcx, cl
sub r14, qword [r12]
bswap rcx
sar r14, 3
and cl, 0x2e
cmp r9, 0x4d6916fa
sub edx, edx
cmovge ecx, r11d
mov qword [rsp + 0x70], rdi
jmp 0x1404d82f3
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404d8302
mov qword [rbp - 0x80], rdi
jmp 0x1404d830b
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404d8318
mov byte [rbp - 0x68], dil
jmp 0x1404d8321
call fcn.1404a43f4
mov rax, qword [rsp + 0x58]
cmc
cmp dword [rax + 0xc], r15d
jmp 0x1404d8335
jne 0x1404d836d
cmp byte [rsp + 0x68], dil
jmp 0x1404d8345
je 0x1404d8360
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
movzx r8d, si
movsx r8w, bl
mov r8d, r15d
jmp 0x1404d8368
jmp 0x1404d83ea
call fcn.1404ca149
test eax, eax
jmp 0x1404d8379
jne 0x1404d83b8
cmp byte [rsp + 0x68], dil
je 0x1404d83a8
mov rax, qword [rsp + 0x50]
neg r8b
adc r8b, 0xc8
and dword [rax + 0x3a8], 0xfffffffd
movzx r8, r8w
xchg r8b, r8b
not r8w
mov r8d, 1
jmp 0x1404d83b3
jmp 0x1404d83ea
cmp byte [rsp + 0x68], dil
jmp 0x1404d83c2
je 0x1404d83e1
mov rax, qword [rsp + 0x50]
movsx r8d, r14w
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, r12b
movsx rdx, dx
mov r8d, edi
not edx
mov dx, 0x63cb
lea rdx, [rsp + 0x70]
setnp ch
cmovbe cx, r14w
movsx cx, spl
lea rcx, [rbp - 4]
jmp 0x1404d8405
call fcn.1404d74b2
mov r15, qword [rbp - 0x80]
test eax, eax
mov cl, r15b
movzx rcx, cx
movsx rcx, bx
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d842a
jne 0x1404d8467
mov al, byte [rcx + 1]
test ch, 0x42
cmc
cmp rdx, 0x414f7413
test al, al
jmp 0x1404d8445
je 0x1404d849d
cmp al, 0x2e
jmp 0x1404d8452
jne 0x1404d8467
cmp byte [rcx + 2], dil
jmp 0x1404d8461
je 0x1404d849d
mov r9, r12
jmp 0x1404d8471
mov r8, r13
movsx dx, sil
setno dh
mov rdx, rsi
call fcn.1404d7c22
mov edi, eax
cmp ah, 0x7d
clc
test eax, eax
jmp 0x1404d8491
jne 0x1404d8547
xor edi, edi
stc
test bpl, bl
cmp byte [rbp - 0x68], dil
jmp 0x1404d84a6
je 0x1404d84b4
mov rcx, r15
call fcn.1404c8f69
lea rdx, [rbp - 0x30]
movzx ecx, sp
movzx rcx, r13w
movsx ecx, r13w
mov rcx, rbx
jmp 0x1404d84cb
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp rsp, 0x3b532b58
test ecx, 0x60aa77ba
test eax, eax
jne 0x1404d82e3
mov rax, qword [r12]
bts edx, r14d
mov rdx, qword [r12 + 8]
sub rdx, rax
sar rdx, 3
test dil, dil
cmp r14, rdx
jmp 0x1404d850b
je 0x1404d855e
sub rdx, r14
cmovb r8d, r14d
lea rcx, [rax + r14*8]
mov r9b, bpl
movsx r8d, r13w
lea r9, [0x1400acc8c]
jmp 0x1404d8532
mov r8d, 8
jmp 0x1404d853d
call fcn.1404e42f1
jmp 0x1404d855e
cmp byte [rbp - 0x68], 0
je 0x1404d855e
mov rcx, r15
jmp 0x1404d8559
call fcn.1404c8f69
mov rcx, rbx
jmp 0x1404d8566
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d8575
je 0x1404d8584
mov rcx, qword [rbp - 0x50]
call fcn.1404c8f69
mov eax, edi
movsxd rcx, esp
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
jmp 0x1404d8598
call fcn.14049f715
mov rbx, qword [rsp + 0x388]
shl rsi, cl
add rsp, 0x330
movsx r14, r13w
movsxd rbp, esp
pop r15
mov edi, r8d
pop r14
setg r13b
pop r13
xchg bpl, sil
movsxd rdi, r10d
pop r12
pop rdi
not esi
pop rsi
mov bpl, r12b
not bpl
pop rbp
jmp 0x1404d85db
ret