Function at 0x1404d12f2
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
btc rbx, rsp
mov bh, 7
clc
push rbp
push rsi
sub sil, al
and si, 0x156a
bt ax, 0xdc
push rdi
bt rax, 0x76
push r12
bt si, sp
btr r12w, 0xd2
bsr bp, cx
push r13
cdqe
adc bp, 0xec9
or ebp, ecx
push r14
add bh, 0xc8
sub bp, r13w
push r15
lea rbp, [rsp - 0x230]
cmc
sub rsp, 0x330
movzx rbx, r9w
mov rax, qword [0x1400b7288]
xor rax, rsp
ror esi, cl
cmovg r12w, cx
mov qword [rbp + 0x220], rax
movsx bx, r15b
mov r12, r8
mov rsi, rcx
shl bx, 0xe1
sal bh, cl
movabs rbx, 0x200000000801
jmp 0x1404d138a
cmp rdx, rcx
je 0x1404d13e6
mov al, byte [rdx]
test r14d, 0x17892d85
sub al, 0x2f
cmc
cmp dx, r10w
jmp 0x1404d13a8
cmp al, 0x2d
jmp 0x1404d13af
ja 0x1404d13ca
movsx rax, al
stc
clc
bt rbx, rax
jmp 0x1404d13c4
jb 0x1404d13e6
mov rcx, rsi
call fcn.1401cad81
mov rdx, rax
test r12b, r10b
cmp rax, rsi
jmp 0x1404d13e0
jne 0x1404d1393
mov r8b, byte [rdx]
jmp 0x1404d13f1
cmp r8b, 0x3a
jmp 0x1404d13fa
jne 0x1404d1448
lea rax, [rsi + 1]
clc
jmp 0x1404d140d
cmp rdx, rax
je 0x1404d1448
mov r9, r12
sub r8d, r8d
clc
movsx cx, r9b
sub ecx, 0x24fa1f37
sub edx, edx
jmp 0x1404d1436
mov rcx, rsi
jmp 0x1404d143e
call fcn.1404d0fa1
jmp 0x1404d1927
sub r8b, 0x2f
cmp bpl, 0xeb
sub edi, edi
stc
cmp r8b, 0x2d
ja 0x1404d1477
movsx rax, r8b
jmp 0x1404d1466
bt rbx, rax
mov al, 1
jmp 0x1404d1471
jb 0x1404d147f
mov al, dil
jmp 0x1404d147f
sub rdx, rsi
jmp 0x1404d1487
mov qword [rbp - 0x60], rdi
movzx ecx, bx
cmovg cx, r8w
jmp 0x1404d1498
inc rdx
mov qword [rbp - 0x58], rdi
bt cx, r9w
rcr cx, cl
neg ch
neg al
mov ecx, ecx
xchg rcx, rcx
mov qword [rbp - 0x50], rdi
movsx rcx, r9w
lea rcx, [rsp + 0x30]
jmp 0x1404d14c2
mov qword [rbp - 0x48], rdi
jmp 0x1404d14cb
sbb r13, r13
jmp 0x1404d14db
mov qword [rbp - 0x40], rdi
cmp spl, 0xea
and r13, rdx
mov byte [rbp - 0x38], dil
test r11b, sil
sub edx, edx
jmp 0x1404d14f4
call fcn.14049d3ba
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
jmp 0x1404d150a
cmp dword [rax + 0xc], r15d
jmp 0x1404d1513
jne 0x1404d1557
cmp byte [rsp + 0x48], dil
jmp 0x1404d1523
je 0x1404d154a
mov rax, qword [rsp + 0x30]
bts r8, r8
rcr r8b, 0x9f
sar r8b, cl
and dword [rax + 0x3a8], 0xfffffffd
movsxd r8, r11d
movzx r8, r15w
not r8d
mov r8d, r15d
jmp 0x1404d1552
jmp 0x1404d15d6
call fcn.1404c344d
test eax, eax
jmp 0x1404d1563
jne 0x1404d159c
cmp byte [rsp + 0x48], dil
jmp 0x1404d1573
je 0x1404d158c
mov rax, qword [rsp + 0x30]
sar r8d, cl
and dword [rax + 0x3a8], 0xfffffffd
bswap r8w
mov r8d, 1
jmp 0x1404d1597
jmp 0x1404d15d6
cmp byte [rsp + 0x48], dil
jmp 0x1404d15a6
je 0x1404d15ca
mov rax, qword [rsp + 0x30]
sal r8w, 0xbe
and dl, 0x37
and dword [rax + 0x3a8], 0xfffffffd
bswap edx
seto ch
movsx cx, r9b
mov r8d, edi
jmp 0x1404d15d6
lea rdx, [rbp - 0x60]
movsx rcx, r14w
movsx ecx, sp
mov rcx, rsi
jmp 0x1404d15e9
call fcn.14049de19
mov rcx, qword [rbp - 0x50]
cmp bl, r10b
lea r8, [rbp - 0x30]
test dl, r14b
stc
test eax, eax
jmp 0x1404d1604
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
test ax, 0x237a
cmp spl, sil
sub r9d, r9d
clc
test dil, 0xad
cmp bl, bpl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x1404d1637
jne 0x1404d166d
mov r9, r12
add cl, 0xcf
shl cl, cl
sub r8d, r8d
test r15b, 0xbd
cmp rdi, 0x2ea95b7f
xor edx, edx
movzx cx, ah
mov rcx, rsi
jmp 0x1404d1661
call fcn.1404d0fa1
mov edi, eax
jmp 0x1404d1905
mov r14, qword [r12 + 8]
sub cx, 0x6e1f
bsr rcx, rsi
sub r14, qword [r12]
shld rcx, r14, 0x1c
jmp 0x1404d168c
sar r14, 3
or cx, 0x6c5a
xor edx, edx
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
jmp 0x1404d16a6
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
jmp 0x1404d16b4
mov qword [rbp - 0x78], rdi
jmp 0x1404d16bd
mov qword [rbp - 0x70], rdi
jmp 0x1404d16c6
mov byte [rbp - 0x68], dil
jmp 0x1404d16cf
call fcn.14049d3ba
mov rax, qword [rsp + 0x58]
test sil, r14b
cmp dword [rax + 0xc], r15d
jmp 0x1404d16e5
jne 0x1404d1724
cmp byte [rsp + 0x68], dil
jmp 0x1404d16f5
je 0x1404d1717
mov rax, qword [rsp + 0x50]
cmp bpl, 0x9f
ror r8, cl
shl r8b, 0x2b
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, dil
mov r8d, r15d
jmp 0x1404d171f
jmp 0x1404d1794
call fcn.1404c344d
test eax, eax
jmp 0x1404d1730
jne 0x1404d176a
cmp byte [rsp + 0x68], dil
jmp 0x1404d1740
je 0x1404d175a
mov rax, qword [rsp + 0x50]
ror r8b, cl
ror r8w, 0x3d
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404d1765
jmp 0x1404d1794
cmp byte [rsp + 0x68], dil
jmp 0x1404d1774
je 0x1404d1789
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
not r8b
mov r8d, edi
xchg dh, cl
cmovs rcx, rax
cwd
lea rdx, [rsp + 0x70]
movzx ecx, r11w
setnp cl
lea rcx, [rbp - 4]
jmp 0x1404d17a9
call fcn.1404d07fc
mov r15, qword [rbp - 0x80]
test eax, eax
mov rcx, r15
jmp 0x1404d17bc
cmovne rcx, rdi
test ah, 0xfc
cmp byte [rcx], 0x2e
jne 0x1404d17f9
mov al, byte [rcx + 1]
test r13b, r9b
jmp 0x1404d17da
test al, al
je 0x1404d182a
cmp al, 0x2e
jne 0x1404d17f9
cmp byte [rcx + 2], dil
jmp 0x1404d17f3
je 0x1404d182a
mov r9, r12
movzx r8w, bpl
movsx dx, r10b
mov r8w, 0x4f04
mov r8, r13
movsxd rdx, ebp
mov rdx, rsi
call fcn.1404d0fa1
mov edi, eax
test eax, eax
jmp 0x1404d1822
jne 0x1404d18e0
sub edi, edi
cmp byte [rbp - 0x68], dil
jmp 0x1404d1833
je 0x1404d1846
mov rcx, r15
jmp 0x1404d1841
call fcn.1404c2337
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp rax, rax
test r11w, 0x1e8e
test eax, eax
jmp 0x1404d1869
jne 0x1404d1695
mov rax, qword [r12]
and dl, r8b
mov rdx, qword [r12 + 8]
cmc
test r10w, 0x7f8e
jmp 0x1404d1887
sub rdx, rax
cmp sp, 0x4212
stc
sar rdx, 3
cmp bp, si
cmp r14, rdx
jmp 0x1404d189f
je 0x1404d18f7
sub rdx, r14
movsxd r8, r15d
jmp 0x1404d18b0
lea rcx, [rax + r14*8]
movzx r9d, si
bswap r9w
movzx r9, ax
lea r9, [0x1400acc8c]
not r8w
mov r8d, 8
jmp 0x1404d18d6
call fcn.1404dd6f2
jmp 0x1404d18f7
cmp byte [rbp - 0x68], 0
jmp 0x1404d18e9
je 0x1404d18f7
mov rcx, r15
call fcn.1404c2337
mov rcx, rbx
jmp 0x1404d18ff
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d190e
je 0x1404d1922
mov rcx, qword [rbp - 0x50]
jmp 0x1404d191d
call fcn.1404c2337
mov eax, edi
movsxd rcx, r8d
mov rcx, qword [rbp + 0x220]
stc
xor rcx, rsp
jmp 0x1404d1937
call fcn.1404988af
mov rbx, qword [rsp + 0x388]
movsxd r12, eax
add rsp, 0x330
movzx r14d, r9w
bswap bp
pop r15
movsx r13d, r9w
pop r14
movzx r13d, di
pop r13
movsx di, r11b
mov bp, bp
pop r12
movsx di, al
movzx rsi, cx
pop rdi
movsxd rbp, r9d
xchg si, bp
movzx si, r13b
pop rsi
mov bp, bx
pop rbp
jmp 0x1404d198b
ret