Function at 0x1404d890f
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
test r11w, 0xe84
mov rbx, rsi
push rsi
push rdi
bsf ebp, r15d
movsx ebp, r8w
push r12
sal sil, 0xa3
cmp dil, 0
movsxd rbp, r12d
push r13
bts bp, r11w
push r14
dec si
push r15
sub bp, r14w
cdqe
shrd si, r12w, 0x99
lea rbp, [rsp - 0x230]
and r12w, r12w
bsf rsi, rbp
bswap esi
sub rsp, 0x330
mov rax, qword [0x1400b7288]
xor rax, rsp
sub bx, 0x4148
mov qword [rbp + 0x220], rax
bt r12, 0x84
adc bh, 0x46
cmp r13b, r8b
mov r12, r8
mov rsi, rcx
shld bx, r15w, 0x66
bts ebx, ebx
dec bh
movabs rbx, 0x200000000801
jmp 0x1404d89aa
cmp rdx, rcx
jmp 0x1404d89b2
je 0x1404d8a02
mov al, byte [rdx]
clc
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404d89c4
ja 0x1404d89df
movsx rax, al
cmc
clc
jmp 0x1404d89d5
bt rbx, rax
jb 0x1404d8a02
mov rcx, rsi
jmp 0x1404d89e7
call fcn.1401de76e
mov rdx, rax
jmp 0x1404d89f4
cmp rax, rsi
jmp 0x1404d89fc
jne 0x1404d89b8
mov r8b, byte [rdx]
test ch, 0xf
cmc
cmp r8b, 0x3a
jmp 0x1404d8a12
jne 0x1404d8a57
lea rax, [rsi + 1]
cmp r14b, 0xc6
cmc
test r15, rcx
cmp rdx, rax
jmp 0x1404d8a2c
je 0x1404d8a57
mov r9, r12
cmp bpl, r9b
xor r8d, r8d
or cl, bh
sal cl, 0xe9
sub edx, edx
cmovno ecx, ebx
mov rcx, rsi
jmp 0x1404d8a4d
call fcn.1404d85c2
jmp 0x1404d8ece
sub r8b, 0x2f
clc
xor edi, edi
cmc
stc
cmp r8b, 0x2d
ja 0x1404d8a7a
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x1404d8a84
mov al, dil
or cl, bpl
rol cx, 0xff
sub rdx, rsi
mov qword [rbp - 0x60], rdi
bswap rcx
mov cl, 0x21
inc rdx
mov qword [rbp - 0x58], rdi
neg al
movzx ecx, dx
mov cl, 0xaa
movzx cx, r13b
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404d8ab1
mov qword [rbp - 0x48], rdi
jmp 0x1404d8aba
sbb r13, r13
stc
mov qword [rbp - 0x40], rdi
cmp dh, 0x9b
and r13, rdx
mov byte [rbp - 0x38], dil
cmp cx, 0x2853
jmp 0x1404d8ad7
sub edx, edx
jmp 0x1404d8ade
call fcn.1404a4f65
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
test r12w, di
cmp dword [rax + 0xc], r15d
jne 0x1404d8b3a
cmp byte [rsp + 0x48], dil
jmp 0x1404d8b06
je 0x1404d8b2d
mov rax, qword [rsp + 0x30]
movsx r8d, cx
adc r8, r8
xor r8, rdx
and dword [rax + 0x3a8], 0xfffffffd
movzx r8d, r13w
mov r8w, si
xchg r8, r8
mov r8d, r15d
jmp 0x1404d8b35
jmp 0x1404d8bb0
call fcn.1404cac89
test eax, eax
jmp 0x1404d8b46
jne 0x1404d8b84
cmp byte [rsp + 0x48], dil
jmp 0x1404d8b56
je 0x1404d8b74
mov rax, qword [rsp + 0x30]
and r8b, r15b
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d8b74
mov r8d, 1
jmp 0x1404d8b7f
jmp 0x1404d8bb0
cmp byte [rsp + 0x48], dil
jmp 0x1404d8b8e
je 0x1404d8ba3
mov rax, qword [rsp + 0x30]
cmp cl, r13b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
mov cx, r12w
bswap edx
movsx rcx, r11w
lea rdx, [rbp - 0x60]
movzx cx, cl
mov rcx, rsi
jmp 0x1404d8bc0
call fcn.1404a59aa
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
cmp r13b, cl
cmp r10b, 0x73
test eax, eax
jmp 0x1404d8bdb
mov dword [rsp + 0x28], edi
jmp 0x1404d8be4
mov qword [rsp + 0x20], rdi
jmp 0x1404d8bee
cmovne rcx, rdi
sub r9d, r9d
clc
xor edx, edx
jmp 0x1404d8bfd
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
jmp 0x1404d8c0b
cmp rax, 0xffffffffffffffff
jmp 0x1404d8c14
jne 0x1404d8c49
mov r9, r12
rcr cl, 0x10
xor r8d, r8d
xor edx, edx
movzx ecx, sp
cmovs cx, r14w
movsxd rcx, ebx
mov rcx, rsi
jmp 0x1404d8c38
call fcn.1404d85c2
mov edi, eax
jmp 0x1404d8c44
jmp 0x1404d8ea6
mov r14, qword [r12 + 8]
sub r14, qword [r12]
sar r14, 3
xor edx, edx
mov cl, r14b
mov qword [rsp + 0x70], rdi
movzx ecx, r13w
lea rcx, [rsp + 0x50]
jmp 0x1404d8c6e
mov qword [rsp + 0x78], rdi
jmp 0x1404d8c78
mov qword [rbp - 0x80], rdi
jmp 0x1404d8c81
mov qword [rbp - 0x78], rdi
jmp 0x1404d8c8a
mov qword [rbp - 0x70], rdi
jmp 0x1404d8c93
mov byte [rbp - 0x68], dil
jmp 0x1404d8c9c
call fcn.1404a4f65
mov rax, qword [rsp + 0x58]
stc
cmp spl, r14b
cmp dword [rax + 0xc], r15d
jmp 0x1404d8cb3
jne 0x1404d8ce2
cmp byte [rsp + 0x68], dil
jmp 0x1404d8cc3
je 0x1404d8cd5
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d8cdd
jmp 0x1404d8d4f
call fcn.1404cac89
test eax, eax
jmp 0x1404d8cee
jne 0x1404d8d23
cmp byte [rsp + 0x68], dil
je 0x1404d8d13
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
movsx r8d, dx
movzx r8d, r11w
mov r8d, 1
jmp 0x1404d8d1e
jmp 0x1404d8d4f
cmp byte [rsp + 0x68], dil
jmp 0x1404d8d2d
je 0x1404d8d47
mov rax, qword [rsp + 0x50]
movsxd r8, esp
and dword [rax + 0x3a8], 0xfffffffd
movzx dx, ch
cdq
mov r8d, edi
mov cl, 0x32
setbe ch
lea rdx, [rsp + 0x70]
movsxd rcx, ebp
mov ch, 0x29
movsx rcx, r14w
lea rcx, [rbp - 4]
jmp 0x1404d8d67
call fcn.1404d7e3d
mov r15, qword [rbp - 0x80]
test eax, eax
movsx ecx, r8w
movzx rcx, r9w
not ecx
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d8d8b
jne 0x1404d8dbc
mov al, byte [rcx + 1]
test r15b, 0xf6
test al, al
je 0x1404d8ddf
cmp al, 0x2e
jmp 0x1404d8da7
jne 0x1404d8dbc
cmp byte [rcx + 2], dil
jmp 0x1404d8db6
je 0x1404d8ddf
mov r9, r12
mov r8, r13
mov rdx, rsi
call fcn.1404d85c2
mov edi, eax
test eax, eax
jmp 0x1404d8dd3
jne 0x1404d8e86
sub edi, edi
cmp sil, 0x30
cmp byte [rbp - 0x68], dil
jmp 0x1404d8de8
je 0x1404d8dfb
mov rcx, r15
jmp 0x1404d8df6
call fcn.1404c9bb8
lea rdx, [rbp - 0x30]
movsx ecx, r13w
mov rcx, rbx
jmp 0x1404d8e0b
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jne 0x1404d8c56
mov rax, qword [r12]
add dh, 0x17
rcr dh, cl
mov rdx, qword [r12 + 8]
sub rdx, rax
test cx, r9w
sar rdx, 3
jmp 0x1404d8e40
cmp r14, rdx
jmp 0x1404d8e48
je 0x1404d8e9d
sub rdx, r14
movsx cx, bpl
movsx r8d, cx
lea rcx, [rax + r14*8]
mov r9b, 0x24
bswap r9d
lea r9, [0x1400acc8c]
mov r8d, 0x40555fea
mov r8d, 8
jmp 0x1404d8e7c
call fcn.1404e4d53
jmp 0x1404d8e9d
cmp byte [rbp - 0x68], 0
je 0x1404d8e9d
mov rcx, r15
jmp 0x1404d8e98
call fcn.1404c9bb8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d8eaf
je 0x1404d8ebe
mov rcx, qword [rbp - 0x50]
call fcn.1404c9bb8
mov eax, edi
ror cx, cl
bt ecx, 0x6b
test r13, 0x10045344
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
jmp 0x1404d8edd
call fcn.1404a0330
mov rbx, qword [rsp + 0x388]
btr edi, r14d
shl r14w, cl
inc r12d
add rsp, 0x330
jmp 0x1404d8f04
pop r15
bswap bp
not r12b
pop r14
mov r12b, 0x11
movzx esi, si
pop r13
movzx edi, cx
pop r12
pop rdi
setne bpl
pop rsi
movzx bp, sil
movsxd rbp, r9d
pop rbp
jmp 0x1404d8f2f
ret