Function at 0x1404d656f
Capabilities:
Check for software breakpoints
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sbb bp, ax
bsf bx, r10w
bts bx, r8w
push rsi
push rdi
movzx rsi, r8w
stc
shr bh, 0x92
push r12
shr ax, 1
dec bh
movsx rbx, r11w
push r13
clc
push r14
setle bpl
push r15
mov r12w, cx
btc bp, 0xd4
btr eax, 0x52
lea rbp, [rsp - 0x230]
bswap bx
add al, 0x79
test sil, 0x4a
sub rsp, 0x330
bswap si
mov rax, qword [0x1400b7288]
sete bl
xor rax, rsp
xor r12w, r8w
bts r12w, r11w
mov qword [rbp + 0x220], rax
rcl r12, cl
cmp r9d, 0x524d56c4
test spl, 0xed
mov r12, r8
sbb bl, 0x9a
mov rsi, rcx
movsx bx, r11b
bts rbx, rdi
xor bl, 0xd6
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d661c
je 0x1404d666a
mov al, byte [rdx]
cmp r11b, bl
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404d6630
ja 0x1404d664e
movsx rax, al
jmp 0x1404d663f
bt rbx, rax
jmp 0x1404d6648
jb 0x1404d666a
mov rcx, rsi
call fcn.1401b6586
mov rdx, rax
test dl, 0x3f
cmp rax, rsi
jmp 0x1404d6664
jne 0x1404d6622
mov r8b, byte [rdx]
cmp r8b, 0x3a
jmp 0x1404d6676
jne 0x1404d66bc
lea rax, [rsi + 1]
cmp rdx, rax
jmp 0x1404d6688
je 0x1404d66bc
mov r9, r12
xor r8d, r8d
and ch, 0x5d
cmovne cx, cx
rcl cl, 8
sub edx, edx
mov cl, r11b
setb cl
cmovbe ecx, r8d
mov rcx, rsi
jmp 0x1404d66b2
call fcn.1404d6247
jmp 0x1404d6b53
sub r8b, 0x2f
cmc
sub edi, edi
cmp r8b, 0x2d
jmp 0x1404d66cc
ja 0x1404d66e7
movsx rax, r8b
bt rbx, rax
mov al, 1
jmp 0x1404d66e1
jb 0x1404d66ea
mov al, dil
sub rdx, rsi
xchg cl, cl
mov qword [rbp - 0x60], rdi
xchg cl, cl
movsx rcx, r8w
movsx cx, bpl
inc rdx
shld ecx, r14d, 0xdf
neg cl
movzx ecx, sp
mov qword [rbp - 0x58], rdi
sub cx, 0x3813
neg al
inc cl
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404d6726
mov qword [rbp - 0x48], rdi
sbb r13, r13
mov qword [rbp - 0x40], rdi
cmp r13d, r9d
and r13, rdx
cmp r14w, 0x2c94
test r13b, 0xd6
mov byte [rbp - 0x38], dil
sub edx, edx
call fcn.1404a2b89
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp r12w, 0x29aa
cmp dword [rax + 0xc], r15d
jmp 0x1404d6766
jne 0x1404d67a6
cmp byte [rsp + 0x48], dil
jmp 0x1404d6776
je 0x1404d6799
mov rax, qword [rsp + 0x30]
sub r8b, 0x1f
stc
inc r8
and dword [rax + 0x3a8], 0xfffffffd
movsx r8d, bx
movsx r8w, r13b
mov r8d, r15d
jmp 0x1404d67a1
jmp 0x1404d680c
call fcn.1404c880e
test eax, eax
jmp 0x1404d67b2
jne 0x1404d67e6
cmp byte [rsp + 0x48], dil
je 0x1404d67d6
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movzx r8d, r10w
movsxd r8, eax
mov r8d, 1
jmp 0x1404d67e1
jmp 0x1404d680c
cmp byte [rsp + 0x48], dil
je 0x1404d6809
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movzx rcx, r14w
not dx
jmp 0x1404d6809
mov r8d, edi
lea rdx, [rbp - 0x60]
mov rcx, rsi
jmp 0x1404d6818
call fcn.1404a35e0
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
clc
test eax, eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1404d6836
cmovne rcx, rdi
sub r9d, r9d
stc
sub edx, edx
jmp 0x1404d6845
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rsp, rax
cmp rax, 0xffffffffffffffff
jne 0x1404d688c
mov r9, r12
btr cx, 0xda
xor r8d, r8d
xor edx, edx
movsx cx, cl
movsxd rcx, ebx
movsx rcx, r10w
mov rcx, rsi
jmp 0x1404d687b
call fcn.1404d6247
mov edi, eax
jmp 0x1404d6887
jmp 0x1404d6b31
mov r14, qword [r12 + 8]
sbb cl, r15b
rcl ch, cl
sal ch, 0xe1
sub r14, qword [r12]
movsx cx, dh
sar r14, 3
test bh, ah
or rcx, 0x7bb06b9d
btr ecx, 0x3c
xor edx, edx
jmp 0x1404d68bd
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
jmp 0x1404d68cc
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
jmp 0x1404d68da
mov qword [rbp - 0x78], rdi
jmp 0x1404d68e3
mov qword [rbp - 0x70], rdi
jmp 0x1404d68ec
mov byte [rbp - 0x68], dil
jmp 0x1404d68f5
call fcn.1404a2b89
mov rax, qword [rsp + 0x58]
cmp r12b, 0xcc
cmp dword [rax + 0xc], r15d
jmp 0x1404d690c
jne 0x1404d6948
cmp byte [rsp + 0x68], dil
jmp 0x1404d691c
je 0x1404d693b
mov rax, qword [rsp + 0x50]
neg r8d
ror r8b, cl
sar r8w, cl
and dword [rax + 0x3a8], 0xfffffffd
movsxd r8, eax
mov r8d, r15d
jmp 0x1404d6943
jmp 0x1404d69b8
call fcn.1404c880e
test eax, eax
jne 0x1404d698b
cmp byte [rsp + 0x68], dil
jmp 0x1404d695f
je 0x1404d697b
mov rax, qword [rsp + 0x50]
cmovne r8w, ax
and dword [rax + 0x3a8], 0xfffffffd
cmovg r8w, r11w
mov r8d, 1
jmp 0x1404d6986
jmp 0x1404d69b8
cmp byte [rsp + 0x68], dil
jmp 0x1404d6995
je 0x1404d69ac
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov cx, sp
cwd
mov r8d, edi
jmp 0x1404d69b8
lea rdx, [rsp + 0x70]
movzx cx, r10b
movsx rcx, r11w
lea rcx, [rbp - 4]
jmp 0x1404d69cf
call fcn.1404d5a4a
mov r15, qword [rbp - 0x80]
bsf cx, bx
shrd cx, r9w, 0x85
movsx cx, r15b
test eax, eax
movsx cx, ah
mov rcx, r15
jmp 0x1404d69f5
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d6a01
jne 0x1404d6a38
mov al, byte [rcx + 1]
test cx, cx
cmp ax, cx
cmp r15b, 0xa8
test al, al
je 0x1404d6a58
cmp al, 0x2e
jmp 0x1404d6a23
jne 0x1404d6a38
cmp byte [rcx + 2], dil
jmp 0x1404d6a32
je 0x1404d6a58
mov r9, r12
movsx r8, sp
bswap edx
mov r8, r13
mov rdx, rsi
call fcn.1404d6247
mov edi, eax
test eax, eax
jne 0x1404d6b07
xor edi, edi
cmp byte [rbp - 0x68], dil
jmp 0x1404d6a61
je 0x1404d6a74
mov rcx, r15
jmp 0x1404d6a6f
call fcn.1404c761b
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jmp 0x1404d6a8e
jne 0x1404d68b2
mov rax, qword [r12]
xor edx, 0x175163b
bsf edx, r12d
btr rdx, 0xd5
mov rdx, qword [r12 + 8]
sub rdx, rax
cmc
test dx, bp
sar rdx, 3
cmc
jmp 0x1404d6ac2
cmp r14, rdx
jmp 0x1404d6aca
je 0x1404d6b23
sub rdx, r14
lea rcx, [rax + r14*8]
movzx r9, r11w
mov r9b, cl
movsx r8, bx
lea r9, [0x1400acc8c]
movsx r8d, r9w
movzx r8w, r13b
mov r8d, 8
jmp 0x1404d6afd
call fcn.1404e28aa
jmp 0x1404d6b23
cmp byte [rbp - 0x68], 0
jmp 0x1404d6b10
je 0x1404d6b23
mov rcx, r15
jmp 0x1404d6b1e
call fcn.1404c761b
mov rcx, rbx
jmp 0x1404d6b2b
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d6b3a
je 0x1404d6b4e
mov rcx, qword [rbp - 0x50]
jmp 0x1404d6b49
call fcn.1404c761b
mov eax, edi
rcr ecx, 0x91
mov rcx, qword [rbp + 0x220]
jmp 0x1404d6b60
xor rcx, rsp
jmp 0x1404d6b68
call fcn.14049e054
mov rbx, qword [rsp + 0x388]
shr r12w, cl
add rsp, 0x330
jmp 0x1404d6b89
pop r15
pop r14
pop r13
setl r12b
movsxd rdi, r12d
pop r12
movsx bp, r8b
movsxd rbp, r12d
pop rdi
jmp 0x1404d6bac
pop rsi
mov ebp, r10d
movsx ebp, r11w
pop rbp
ret