Function at 0x1404d8d73
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
lahf
push rbp
sar ax, cl
push rsi
bts si, di
push rdi
push r12
rol sil, cl
shld ebx, ecx, 0x4f
push r13
btr r12, 0xad
shrd bx, ax, 0x46
movsx rax, r15w
push r14
adc al, 0x3b
shl rax, 0x54
push r15
adc bpl, r12b
cwde
neg bh
lea rbp, [rsp - 0x230]
bsr rbx, rdx
sub rsp, 0x330
and sil, 0x2d
rol ax, 0x1e
test r10d, 0x47551790
mov rax, qword [0x1400b7288]
sar si, cl
xor bx, r15w
xor rax, rsp
ror r12, 2
mov qword [rbp + 0x220], rax
bts r12w, r9w
mov r12, r8
mov sil, 0x1f
cmovg si, r10w
mov rsi, rcx
sbb rbx, rsp
cmovp rbx, rbx
shr ebx, cl
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d8e18
je 0x1404d8e79
mov al, byte [rdx]
cmp r8b, 2
stc
jmp 0x1404d8e2a
sub al, 0x2f
cmp r13, 0x434b1aba
cmp al, 0x2d
jmp 0x1404d8e3a
ja 0x1404d8e59
movsx rax, al
jmp 0x1404d8e4a
bt rbx, rax
jmp 0x1404d8e53
jb 0x1404d8e79
mov rcx, rsi
jmp 0x1404d8e61
call fcn.1400e5568
mov rdx, rax
test bpl, r13b
cmp r15b, 0
cmp rax, rsi
jne 0x1404d8e1e
mov r8b, byte [rdx]
cmp r9b, al
cmp r8b, 0x3a
jmp 0x1404d8e88
jne 0x1404d8ec7
lea rax, [rsi + 1]
cmc
stc
cmp sp, 0x35ed
cmp rdx, rax
je 0x1404d8ec7
mov r9, r12
sal ch, 0xdb
rol cl, 0x16
xor r8d, r8d
shld rcx, r10, 0x27
xor edx, edx
mov rcx, rsi
jmp 0x1404d8ebd
call fcn.1404d8a13
jmp 0x1404d93b4
sub r8b, 0x2f
test bl, spl
jmp 0x1404d8ed3
xor edi, edi
cmp r8b, 0x2d
ja 0x1404d8eef
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x1404d8ef2
mov al, dil
sub rdx, rsi
movsx ecx, r8w
cmovo cx, r12w
movsx rcx, r10w
mov qword [rbp - 0x60], rdi
movzx rcx, r10w
inc rdx
mov qword [rbp - 0x58], rdi
inc cx
setae cl
neg al
mov qword [rbp - 0x50], rdi
movsx ecx, r11w
mov cl, r11b
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x48], rdi
jmp 0x1404d8f32
sbb r13, r13
test r9b, 0x69
mov qword [rbp - 0x40], rdi
and r13, rdx
mov byte [rbp - 0x38], dil
cmp r12b, r11b
cmp bp, 0x67a9
sub edx, edx
jmp 0x1404d8f53
call fcn.1404a5306
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d8f6c
jne 0x1404d8faa
cmp byte [rsp + 0x48], dil
jmp 0x1404d8f7c
je 0x1404d8f9d
mov rax, qword [rsp + 0x30]
inc r8w
shl r8w, cl
neg r8d
and dword [rax + 0x3a8], 0xfffffffd
movzx r8d, r13w
mov r8d, r15d
jmp 0x1404d8fa5
jmp 0x1404d901f
call fcn.1404caff8
test eax, eax
jne 0x1404d8ff1
cmp byte [rsp + 0x48], dil
je 0x1404d8fe1
mov rax, qword [rsp + 0x30]
jmp 0x1404d8fd6
and dword [rax + 0x3a8], 0xfffffffd
movsx r8, sp
mov r8d, 1
jmp 0x1404d8fec
jmp 0x1404d901f
cmp byte [rsp + 0x48], dil
jmp 0x1404d8ffb
je 0x1404d9019
mov rax, qword [rsp + 0x30]
movsx cx, r12b
and dword [rax + 0x3a8], 0xfffffffd
cwd
cmovl dx, r12w
mov r8d, edi
mov dl, spl
lea rdx, [rbp - 0x60]
movsx cx, r12b
movzx cx, r8b
mov rcx, rsi
jmp 0x1404d9035
call fcn.1404a5d07
mov rcx, qword [rbp - 0x50]
sbb r8b, r14b
movzx r8, sp
lea r8, [rbp - 0x30]
jmp 0x1404d9054
test eax, eax
mov dword [rsp + 0x28], edi
jmp 0x1404d905f
mov qword [rsp + 0x20], rdi
jmp 0x1404d9069
cmovne rcx, rdi
test r15b, 0x40
clc
sub r9d, r9d
cmc
stc
xor edx, edx
jmp 0x1404d907e
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x1404d9090
jne 0x1404d90d1
mov r9, r12
btc cx, dx
adc cx, 0x1172
btr cx, dx
xor r8d, r8d
test r9b, 0x7c
sbb cx, 0x2a28
bsf cx, cx
sub edx, edx
jmp 0x1404d90bd
mov rcx, rsi
jmp 0x1404d90c5
call fcn.1404d8a13
mov edi, eax
jmp 0x1404d9392
mov r14, qword [r12 + 8]
and cx, r11w
bts rcx, r12
rcl cl, cl
sub r14, qword [r12]
btr cx, 0x30
shr ecx, 0x28
sar r14, 3
cmp r10b, 0xcd
xor edx, edx
jmp 0x1404d9104
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404d9118
mov qword [rbp - 0x80], rdi
jmp 0x1404d9121
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404d912e
mov byte [rbp - 0x68], dil
jmp 0x1404d9137
call fcn.1404a5306
mov rax, qword [rsp + 0x58]
cmp r15b, 0xab
test r10w, 0x2e1f
cmp dword [rax + 0xc], r15d
jne 0x1404d9184
cmp byte [rsp + 0x68], dil
jmp 0x1404d915f
je 0x1404d9177
mov rax, qword [rsp + 0x50]
bt r8w, r14w
cmc
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d917f
jmp 0x1404d91f4
call fcn.1404caff8
test eax, eax
jmp 0x1404d9190
jne 0x1404d91c3
cmp byte [rsp + 0x68], dil
je 0x1404d91b8
mov rax, qword [rsp + 0x50]
rcl r8b, cl
and dword [rax + 0x3a8], 0xfffffffd
movzx r8d, r13w
movsx r8, r15w
mov r8d, 1
jmp 0x1404d91f4
cmp byte [rsp + 0x68], dil
jmp 0x1404d91cd
je 0x1404d91ea
mov rax, qword [rsp + 0x50]
shld dx, r14w, 6
and dword [rax + 0x3a8], 0xfffffffd
movsx r8, r11w
cdq
mov r8d, edi
mov ch, 0x41
cmovle rcx, rdx
lea rdx, [rsp + 0x70]
mov cl, ch
jmp 0x1404d9200
lea rcx, [rbp - 4]
jmp 0x1404d9209
call fcn.1404d8273
mov r15, qword [rbp - 0x80]
rcr ch, 0xd6
movsx ecx, sp
test eax, eax
movzx rcx, r14w
xchg cx, cx
mov ecx, ebx
mov rcx, r15
jmp 0x1404d922b
cmovne rcx, rdi
cmp r8w, 0x5d03
cmp byte [rcx], 0x2e
jmp 0x1404d923d
jne 0x1404d9270
mov al, byte [rcx + 1]
cmc
test al, al
jmp 0x1404d924e
je 0x1404d92af
cmp al, 0x2e
jmp 0x1404d925b
jne 0x1404d9270
cmp byte [rcx + 2], dil
jmp 0x1404d926a
je 0x1404d92af
mov r9, r12
jmp 0x1404d927a
mov r8, r13
mov rdx, 0x54a0d3e
jmp 0x1404d9289
mov rdx, rsi
jmp 0x1404d9291
call fcn.1404d8a13
mov edi, eax
test eax, eax
jmp 0x1404d929f
jne 0x1404d9368
xor edi, edi
test r15b, 0x81
cmp r13b, 0x12
cmp byte [rbp - 0x68], dil
jmp 0x1404d92b8
je 0x1404d92cb
mov rcx, r15
jmp 0x1404d92c6
call fcn.1404c9e81
lea rdx, [rbp - 0x30]
movzx ecx, r9w
movzx cx, r14b
mov rcx, rbx
jmp 0x1404d92e0
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jmp 0x1404d92f3
jne 0x1404d90f4
mov rax, qword [r12]
sub dx, r8w
cdq
and dx, 0x2bc8
mov rdx, qword [r12 + 8]
jmp 0x1404d9312
sub rdx, rax
test sp, r12w
sar rdx, 3
cmp r12b, 0xe1
cmp al, ah
cmp r14, rdx
jmp 0x1404d932b
je 0x1404d9384
sub rdx, r14
lea rcx, [rax + r14*8]
mov r9d, 0x6c5e2f3b
movsx r8, r10w
lea r9, [0x1400acc8c]
cmovae r8w, bx
jmp 0x1404d9353
mov r8d, 8
jmp 0x1404d935e
call fcn.1404e528d
jmp 0x1404d9384
cmp byte [rbp - 0x68], 0
jmp 0x1404d9371
je 0x1404d9384
mov rcx, r15
jmp 0x1404d937f
call fcn.1404c9e81
mov rcx, rbx
jmp 0x1404d938c
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d939b
je 0x1404d93af
mov rcx, qword [rbp - 0x50]
jmp 0x1404d93aa
call fcn.1404c9e81
mov eax, edi
shr cl, 0xf4
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
jmp 0x1404d93c3
call fcn.1404a0622
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
cmovl r15d, edi
xchg di, bp
pop r15
xchg r12b, r14b
cmovbe r13, r9
pop r14
bswap r12d
mov bpl, spl
pop r13
bswap rbp
movsx di, r9b
pop r12
cmovs rbp, rax
pop rdi
mov esi, esp
bswap bp
pop rsi
movsx rbp, di
mov bpl, 0x9c
movzx rbp, si
pop rbp
ret