Function at 0x1404d851f
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
btc bx, si
sub rbx, 0x366f44a0
push rsi
push rdi
bt ax, r9w
movsx rbx, r11w
push r12
bts ax, ax
bsf r12w, bx
push r13
rcr sil, cl
push r14
push r15
shl ebx, cl
lea rbp, [rsp - 0x230]
adc bx, 0xf52
sub rsp, 0x330
mov rax, qword [0x1400b7288]
mov r12w, 0x2b0a
rol rbx, 0x50
not r12w
xor rax, rsp
mov qword [rbp + 0x220], rax
xadd r12b, r12b
sbb r12w, r10w
mov r12, r8
mov rsi, rcx
rcr bx, 0xa7
movabs rbx, 0x200000000801
clc
jmp 0x1404d85a5
cmp rdx, rcx
jmp 0x1404d85ad
je 0x1404d8602
mov al, byte [rdx]
clc
sub al, 0x2f
test r11b, 0x3e
cmc
cmp al, 0x2d
jmp 0x1404d85c4
ja 0x1404d85dd
movsx rax, al
bt rbx, rax
jmp 0x1404d85d7
jb 0x1404d8602
mov rcx, rsi
jmp 0x1404d85e5
call fcn.1401da3bb
mov rdx, rax
cmp bl, r13b
test r13w, bx
cmp rax, rsi
jmp 0x1404d85fc
jne 0x1404d85b3
mov r8b, byte [rdx]
test rcx, r13
test r14b, 0x93
jmp 0x1404d8611
cmp r8b, 0x3a
jmp 0x1404d861a
jne 0x1404d8672
lea rax, [rsi + 1]
test dx, 0x7e1e
cmc
cmp rdx, rax
jmp 0x1404d8632
je 0x1404d8672
mov r9, r12
sbb cx, 0x1416
and cx, r10w
bswap cx
sub r8d, r8d
bsr cx, r13w
btc cx, 0xc2
sub edx, edx
movzx rcx, r10w
movsx rcx, r8w
not cl
mov rcx, rsi
jmp 0x1404d8668
call fcn.1404d8227
jmp 0x1404d8b02
sub r8b, 0x2f
cmp rdx, r10
jmp 0x1404d867e
sub edi, edi
cmp dx, ax
test bp, 0x3023
test r10w, bp
cmp r8b, 0x2d
ja 0x1404d86ae
movsx rax, r8b
stc
bt rbx, rax
xchg al, al
mov al, 1
jmp 0x1404d86a8
jb 0x1404d86b1
mov al, dil
sub rdx, rsi
dec cx
mov qword [rbp - 0x60], rdi
movsx ecx, bp
inc rdx
sub cx, 0x1529
xor ecx, r11d
mov qword [rbp - 0x58], rdi
cmc
neg al
setbe cl
movzx ecx, r8w
mov qword [rbp - 0x50], rdi
mov cx, r9w
lea rcx, [rsp + 0x30]
jmp 0x1404d86e9
mov qword [rbp - 0x48], rdi
sbb r13, r13
jmp 0x1404d86f5
mov qword [rbp - 0x40], rdi
cmc
and r13, rdx
cmp spl, sil
jmp 0x1404d8705
mov byte [rbp - 0x38], dil
cmp spl, 0xb6
test dh, 0x9b
xor edx, edx
jmp 0x1404d8717
call fcn.1404a484a
mov rax, qword [rsp + 0x38]
sbb r15b, r15b
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d8733
jne 0x1404d8762
cmp byte [rsp + 0x48], dil
jmp 0x1404d8743
je 0x1404d875a
mov rax, qword [rsp + 0x30]
rcl r8b, 0xb
clc
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d87df
call fcn.1404ca71a
test eax, eax
jmp 0x1404d876e
jne 0x1404d87b3
cmp byte [rsp + 0x48], dil
jmp 0x1404d877e
je 0x1404d87a8
mov rax, qword [rsp + 0x30]
rcr r8b, 0xde
btc r8w, 0x97
btc r8w, r13w
and dword [rax + 0x3a8], 0xfffffffd
cmove r8w, r14w
xchg r8w, r8w
mov r8d, 1
jmp 0x1404d87df
cmp byte [rsp + 0x48], dil
jmp 0x1404d87bd
je 0x1404d87d7
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
xchg cx, r8w
cmovl ecx, r13d
mov r8d, edi
mov dh, ch
bswap cx
lea rdx, [rbp - 0x60]
mov rcx, rax
mov rcx, rsi
jmp 0x1404d87ee
call fcn.1404a525f
mov rcx, qword [rbp - 0x50]
add r8, 0x4e060f61
lea r8, [rbp - 0x30]
cmc
test eax, eax
mov dword [rsp + 0x28], edi
jmp 0x1404d880e
mov qword [rsp + 0x20], rdi
jmp 0x1404d8818
cmovne rcx, rdi
cmc
xor r9d, r9d
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1404d8867
mov r9, r12
sub r8d, r8d
add cx, 0x7ab1
shrd cx, r11w, 0x3d
xor edx, edx
movsxd rcx, r9d
mov ch, 0x5e
mov rcx, rsi
jmp 0x1404d8856
call fcn.1404d8227
mov edi, eax
jmp 0x1404d8862
jmp 0x1404d8ae4
mov r14, qword [r12 + 8]
ror ecx, cl
add ecx, 0x2c3f296b
and cx, 0x35c2
sub r14, qword [r12]
ror cx, cl
sar r14, 3
cmp r12b, 0xdd
xor edx, edx
bswap ecx
movsxd rcx, r9d
mov qword [rsp + 0x70], rdi
setb cl
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404d88a6
mov qword [rbp - 0x80], rdi
jmp 0x1404d88af
mov qword [rbp - 0x78], rdi
jmp 0x1404d88b8
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
jmp 0x1404d88c5
call fcn.1404a484a
mov rax, qword [rsp + 0x58]
clc
test r13b, 0x1c
cmp dword [rax + 0xc], r15d
jmp 0x1404d88dd
jne 0x1404d890d
cmp byte [rsp + 0x68], dil
jmp 0x1404d88ed
je 0x1404d8905
mov rax, qword [rsp + 0x50]
movsxd r8, r9d
sub r8d, r11d
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d896e
call fcn.1404ca71a
test eax, eax
jmp 0x1404d8919
jne 0x1404d894f
cmp byte [rsp + 0x68], dil
jmp 0x1404d8929
je 0x1404d8944
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d8944
mov r8d, 1
jmp 0x1404d896e
cmp byte [rsp + 0x68], dil
jmp 0x1404d8959
je 0x1404d896b
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rsp + 0x70]
movsx ecx, r9w
lea rcx, [rbp - 4]
jmp 0x1404d8980
call fcn.1404d7a90
mov r15, qword [rbp - 0x80]
rcr ecx, cl
test eax, eax
xchg ch, cl
mov rcx, r15
jmp 0x1404d8997
cmovne rcx, rdi
test r13d, ebx
clc
cmp cl, 0x6a
cmp byte [rcx], 0x2e
jne 0x1404d89d7
mov al, byte [rcx + 1]
test al, al
jmp 0x1404d89b5
je 0x1404d8a16
cmp al, 0x2e
jmp 0x1404d89c2
jne 0x1404d89d7
cmp byte [rcx + 2], dil
jmp 0x1404d89d1
je 0x1404d8a16
mov r9, r12
mov r8, r13
movsx rdx, ax
movzx edx, ax
mov rdx, rsi
jmp 0x1404d89ec
call fcn.1404d8227
mov edi, eax
test spl, 0xd3
cmc
cmp r15b, 0xf0
test eax, eax
jmp 0x1404d8a03
jne 0x1404d8aba
xor edi, edi
test r11, 0x252459af
cmc
cmp r10b, r10b
cmp byte [rbp - 0x68], dil
jmp 0x1404d8a1f
je 0x1404d8a32
mov rcx, r15
jmp 0x1404d8a2d
call fcn.1404c963e
lea rdx, [rbp - 0x30]
movzx rcx, bp
setns cl
movzx ecx, dx
mov rcx, rbx
jmp 0x1404d8a48
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp r10b, sil
test eax, eax
jmp 0x1404d8a5e
jne 0x1404d8888
mov rax, qword [r12]
rol rdx, 0x61
mov rdx, qword [r12 + 8]
jmp 0x1404d8a77
sub rdx, rax
sar rdx, 3
cmp r14, rdx
jmp 0x1404d8a86
je 0x1404d8ad6
sub rdx, r14
lea rcx, [rax + r14*8]
not r9w
mov r8b, 0xaa
lea r9, [0x1400acc8c]
movzx r8, bp
mov r8d, 8
jmp 0x1404d8ab0
call fcn.1404e4829
jmp 0x1404d8ad6
cmp byte [rbp - 0x68], 0
jmp 0x1404d8ac3
je 0x1404d8ad6
mov rcx, r15
jmp 0x1404d8ad1
call fcn.1404c963e
mov rcx, rbx
jmp 0x1404d8ade
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404d8af7
mov rcx, qword [rbp - 0x50]
call fcn.1404c963e
mov eax, edi
btc ecx, 0x17
sal cl, cl
sub ch, 0xbb
mov rcx, qword [rbp + 0x220]
cmp r8b, 0x64
xor rcx, rsp
jmp 0x1404d8b15
call fcn.14049fbde
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
movsx r12, sp
movzx rbp, r14w
pop r14
pop r13
pop r12
movzx esi, di
pop rdi
not ebp
pop rsi
not bpl
pop rbp
jmp 0x1404d8b49
ret