Function at 0x1404d45de
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
movzx eax, r13w
sub bl, 0xee
push rbp
cwde
btr rbp, r8
push rsi
push rdi
push r12
rol ebp, cl
bts ebx, r11d
push r13
setnp al
bswap rbp
push r14
bt ebp, 0x9e
movzx eax, bp
push r15
btr si, 0x9e
movsx bx, sil
not r12d
lea rbp, [rsp - 0x230]
cbw
cmovns r12w, dx
movzx rsi, r9w
sub rsp, 0x330
rcl eax, 0x1f
sal al, 0xd2
mov rax, qword [0x1400b7288]
shld r12d, r9d, 0x2b
sar bl, 0x42
xor rax, rsp
sbb bl, r10b
mov qword [rbp + 0x220], rax
mov r12, r8
mov sil, 0xa5
mov rsi, rcx
cmovge bx, r8w
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d4676
je 0x1404d46c5
mov al, byte [rdx]
test r12b, 0x40
sub al, 0x2f
clc
cmp al, 0x2d
ja 0x1404d46a0
movsx rax, al
bt rbx, rax
jmp 0x1404d469a
jb 0x1404d46c5
mov rcx, rsi
jmp 0x1404d46a8
call fcn.14027dc04
mov rdx, rax
test r9d, 0x2d96140
cmp rax, rsi
jmp 0x1404d46bf
jne 0x1404d467c
mov r8b, byte [rdx]
jmp 0x1404d46cd
cmp r8b, 0x3a
jmp 0x1404d46d6
jne 0x1404d470f
lea rax, [rsi + 1]
cmp r14b, dil
cmp rdx, rax
jmp 0x1404d46eb
je 0x1404d470f
mov r9, r12
sub r8d, r8d
btc cx, bp
bswap ecx
xor edx, edx
mov rcx, rdi
mov rcx, rsi
call fcn.1404d42d5
jmp 0x1404d4b90
sub r8b, 0x2f
sub edi, edi
cmc
test rcx, 0x7a4455a3
cmp r8b, 0x2d
ja 0x1404d4742
movsx rax, r8b
stc
jmp 0x1404d4731
bt rbx, rax
mov al, 1
jmp 0x1404d473c
jb 0x1404d474c
mov al, dil
adc cl, r14b
bsr cx, si
sub rdx, rsi
mov qword [rbp - 0x60], rdi
inc rdx
rcr cx, cl
btc cx, 0x97
ror cl, cl
mov qword [rbp - 0x58], rdi
xadd ch, cl
neg al
mov qword [rbp - 0x50], rdi
movzx cx, ah
mov ch, 0xe8
movsx ecx, r13w
lea rcx, [rsp + 0x30]
jmp 0x1404d4782
mov qword [rbp - 0x48], rdi
jmp 0x1404d478b
sbb r13, r13
cmc
stc
mov qword [rbp - 0x40], rdi
and r13, rdx
clc
cmc
stc
mov byte [rbp - 0x38], dil
test dh, 0x4e
cmc
jmp 0x1404d47a7
sub edx, edx
jmp 0x1404d47ae
call fcn.1404a0828
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d47c7
jne 0x1404d47f6
cmp byte [rsp + 0x48], dil
jmp 0x1404d47d7
je 0x1404d47e9
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d47f1
jmp 0x1404d4862
call fcn.1404c6810
test eax, eax
jmp 0x1404d4802
jne 0x1404d482f
cmp byte [rsp + 0x48], dil
je 0x1404d481f
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404d482a
jmp 0x1404d4862
cmp byte [rsp + 0x48], dil
jmp 0x1404d4839
je 0x1404d4851
mov rax, qword [rsp + 0x30]
ror dx, cl
or r8d, r11d
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
movsx dx, r8b
movsx rcx, r12w
jmp 0x1404d4862
lea rdx, [rbp - 0x60]
movzx ecx, r9w
mov ecx, esi
mov ch, 0xd8
mov rcx, rsi
call fcn.1404a1228
mov rcx, qword [rbp - 0x50]
xadd r8w, r8w
mov r8b, dl
or r8d, 0x1fd3399c
lea r8, [rbp - 0x30]
test eax, eax
mov dword [rsp + 0x28], edi
jmp 0x1404d4899
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
clc
cmp ax, si
cmp al, 0xb9
xor r9d, r9d
stc
sub edx, edx
jmp 0x1404d48b3
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
jmp 0x1404d48c5
cmp rax, 0xffffffffffffffff
jmp 0x1404d48ce
jne 0x1404d4905
mov r9, r12
movzx cx, dh
sub r8d, r8d
stc
sub edx, edx
movzx cx, r8b
mov cx, 0x1a72
xchg ch, ch
mov rcx, rsi
jmp 0x1404d48f4
call fcn.1404d42d5
mov edi, eax
jmp 0x1404d4900
jmp 0x1404d4b6e
mov r14, qword [r12 + 8]
mov cx, ax
add cx, 0x633
sub r14, qword [r12]
sal cx, cl
sar r14, 3
rcr cx, cl
btc rcx, rsp
sub edx, edx
mov qword [rsp + 0x70], rdi
sete ch
movsx ecx, cx
movzx cx, r12b
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404d4945
mov qword [rbp - 0x80], rdi
jmp 0x1404d494e
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404d495b
mov byte [rbp - 0x68], dil
jmp 0x1404d4964
call fcn.1404a0828
mov rax, qword [rsp + 0x58]
cmc
test bx, di
cmp dword [rax + 0xc], r15d
jmp 0x1404d497b
jne 0x1404d49a3
cmp byte [rsp + 0x68], dil
je 0x1404d499b
mov rax, qword [rsp + 0x50]
xchg r8b, r8b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d4a04
call fcn.1404c6810
test eax, eax
jne 0x1404d49df
cmp byte [rsp + 0x68], dil
jmp 0x1404d49ba
je 0x1404d49d4
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, r12b
movsxd r8, ecx
mov r8d, 1
jmp 0x1404d4a04
cmp byte [rsp + 0x68], dil
jmp 0x1404d49e9
je 0x1404d49fb
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
movsx rcx, r14w
cwd
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 4]
jmp 0x1404d4a12
call fcn.1404d3b92
mov r15, qword [rbp - 0x80]
test eax, eax
not ecx
movsx rcx, dx
setae ch
mov rcx, r15
cmovne rcx, rdi
cmp al, sil
cmp byte [rcx], 0x2e
jne 0x1404d4a6e
mov al, byte [rcx + 1]
cmp r14w, 0x66a7
cmp r13b, al
test al, al
jmp 0x1404d4a4c
je 0x1404d4a94
cmp al, 0x2e
jmp 0x1404d4a59
jne 0x1404d4a6e
cmp byte [rcx + 2], dil
jmp 0x1404d4a68
je 0x1404d4a94
mov r9, r12
mov r8, r13
movzx dx, r9b
cwd
mov rdx, rsi
call fcn.1404d42d5
mov edi, eax
test eax, eax
jne 0x1404d4b44
sub edi, edi
jmp 0x1404d4a94
cmp byte [rbp - 0x68], dil
je 0x1404d4aab
mov rcx, r15
jmp 0x1404d4aa6
call fcn.1404c5689
lea rdx, [rbp - 0x30]
movsxd rcx, r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp edx, 0x180a6e94
stc
test eax, eax
jne 0x1404d4924
mov rax, qword [r12]
adc dx, cx
movzx rdx, r11w
mov rdx, qword [r12 + 8]
test r12b, 0xe3
clc
sub rdx, rax
test di, ax
sar rdx, 3
test r10, 0x30ed491a
test r15b, dl
cmp r14, rdx
jmp 0x1404d4b01
je 0x1404d4b60
sub rdx, r14
movzx r8, r13w
xchg r8b, r8b
setbe r9b
lea rcx, [rax + r14*8]
cmovs r9w, r15w
movzx r9d, bp
lea r9, [0x1400acc8c]
mov r8b, spl
not r8
mov r8d, 8
jmp 0x1404d4b3a
call fcn.1404e0925
jmp 0x1404d4b60
cmp byte [rbp - 0x68], 0
jmp 0x1404d4b4d
je 0x1404d4b60
mov rcx, r15
jmp 0x1404d4b5b
call fcn.1404c5689
mov rcx, rbx
jmp 0x1404d4b68
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d4b77
je 0x1404d4b8b
mov rcx, qword [rbp - 0x50]
jmp 0x1404d4b86
call fcn.1404c5689
mov eax, edi
not cx
mov rcx, qword [rbp + 0x220]
test spl, 0xbd
stc
clc
xor rcx, rsp
jmp 0x1404d4ba5
call fcn.14049bbae
mov rbx, qword [rsp + 0x388]
xchg di, r13w
add r13d, 0x75bd6022
bt r15, rbx
add rsp, 0x330
mov r13w, bp
pop r15
cmovnp r12w, si
setne sil
mov r13, r9
pop r14
not sil
jmp 0x1404d4be4
pop r13
pop r12
movzx rbp, r13w
bswap si
mov bpl, r14b
pop rdi
pop rsi
xchg bp, bp
movzx bp, cl
not bp
pop rbp
jmp 0x1404d4c04
ret