Function at 0x1404d7158
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
cwde
movsx ax, bl
btr ebx, edi
push rbp
cmp sil, 0xe7
btc rax, rsp
push rsi
sbb sil, cl
sar si, 0xd2
push rdi
push r12
rcl ebx, 4
ror r12b, 0x28
bts bx, r9w
push r13
bts eax, ecx
and bl, r11b
movsx eax, r15w
push r14
sbb al, 0x68
mov ax, 0x2f3c
push r15
cmp dx, 0x54bf
lea rbp, [rsp - 0x230]
rcl esi, cl
movsx r12d, cx
xor rsi, rsi
sub rsp, 0x330
adc si, 0x618
mov rax, qword [0x1400b7288]
shl sil, 0x5c
rcr r12b, cl
shr bx, 0x79
xor rax, rsp
sub sil, 0xa
btc r12, 0xa4
bts si, dx
mov qword [rbp + 0x220], rax
setnp sil
mov r12, r8
mov rsi, rcx
cmp ch, 0xeb
movabs rbx, 0x200000000801
test dil, r8b
cmp r10w, r12w
cmp rdx, rcx
jmp 0x1404d720c
je 0x1404d7253
mov al, byte [rdx]
jmp 0x1404d721a
sub al, 0x2f
cmp al, 0x2d
ja 0x1404d7233
movsx rax, al
cmc
bt rbx, rax
jb 0x1404d7253
mov rcx, rsi
jmp 0x1404d723b
call fcn.1401ce8f3
mov rdx, rax
stc
cmc
cmp rax, rsi
jmp 0x1404d724d
jne 0x1404d7212
mov r8b, byte [rdx]
stc
cmc
cmp r8b, 0x3a
jmp 0x1404d7261
jne 0x1404d729a
lea rax, [rsi + 1]
clc
cmp rdx, rax
je 0x1404d729a
mov r9, r12
rol ch, 6
rcr cx, 0xff
movsx rcx, r14w
xor r8d, r8d
xor edx, edx
mov rcx, rsi
jmp 0x1404d7290
call fcn.1404d6e0e
jmp 0x1404d7760
sub r8b, 0x2f
clc
xor edi, edi
test rdx, 0x258c0344
cmp r9b, 0xcd
cmp r8b, 0x2d
jmp 0x1404d72b5
ja 0x1404d72d2
movsx rax, r8b
bt rbx, rax
xchg al, al
mov al, 1
jmp 0x1404d72cc
jb 0x1404d72de
mov al, dil
dec cl
bt cx, r11w
inc ch
sub rdx, rsi
mov qword [rbp - 0x60], rdi
setns cl
inc rdx
ror cx, cl
mov qword [rbp - 0x58], rdi
neg al
mov qword [rbp - 0x50], rdi
cmovne cx, bp
jmp 0x1404d7304
lea rcx, [rsp + 0x30]
jmp 0x1404d730e
mov qword [rbp - 0x48], rdi
jmp 0x1404d7317
sbb r13, r13
test r8b, r14b
mov qword [rbp - 0x40], rdi
cmp r10w, 0x5d06
jmp 0x1404d732c
and r13, rdx
clc
cmc
jmp 0x1404d7336
mov byte [rbp - 0x38], dil
clc
sub edx, edx
jmp 0x1404d7342
call fcn.1404a3569
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d735b
jne 0x1404d7391
cmp byte [rsp + 0x48], dil
jmp 0x1404d736b
je 0x1404d7389
mov rax, qword [rsp + 0x30]
add r8w, r8w
test ebp, esp
and dword [rax + 0x3a8], 0xfffffffd
mov r8b, al
xchg r8d, r8d
mov r8d, r15d
jmp 0x1404d7413
call fcn.1404c9326
test eax, eax
jmp 0x1404d739d
jne 0x1404d73e1
cmp byte [rsp + 0x48], dil
jmp 0x1404d73ad
je 0x1404d73d6
mov rax, qword [rsp + 0x30]
movsx r8, si
bts r8w, r12w
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, dil
mov r8w, 0x48ea
setno r8b
mov r8d, 1
jmp 0x1404d7413
cmp byte [rsp + 0x48], dil
jmp 0x1404d73eb
je 0x1404d7408
mov rax, qword [rsp + 0x30]
cmp dh, 0x6e
and dword [rax + 0x3a8], 0xfffffffd
movsxd rcx, r9d
jmp 0x1404d7408
mov r8d, edi
mov dl, 0x2d
cmovns rcx, rdi
mov dh, ch
lea rdx, [rbp - 0x60]
mov cl, 0x67
mov rcx, rsi
jmp 0x1404d7421
call fcn.1404a3f92
mov rcx, qword [rbp - 0x50]
movsx r8, di
lea r8, [rbp - 0x30]
test eax, eax
jmp 0x1404d7439
mov dword [rsp + 0x28], edi
jmp 0x1404d7442
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
cmp r13, 0x336a0783
clc
sub r9d, r9d
sub edx, edx
jmp 0x1404d745d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
stc
clc
cmp rax, 0xffffffffffffffff
jmp 0x1404d7471
jne 0x1404d74a5
mov r9, r12
test r15b, dl
sub r8d, r8d
rcr ch, 0xd1
sbb rcx, 0x661f773c
sub edx, edx
mov rcx, rsi
jmp 0x1404d7494
call fcn.1404d6e0e
mov edi, eax
jmp 0x1404d74a0
jmp 0x1404d7741
mov r14, qword [r12 + 8]
movsxd rcx, r9d
rcr ch, cl
dec cx
sub r14, qword [r12]
sar r14, 3
shl rcx, cl
jmp 0x1404d74c6
sub edx, edx
mov qword [rsp + 0x70], rdi
xchg ecx, ecx
movzx cx, spl
not cx
lea rcx, [rsp + 0x50]
jmp 0x1404d74e1
mov qword [rsp + 0x78], rdi
jmp 0x1404d74eb
mov qword [rbp - 0x80], rdi
jmp 0x1404d74f4
mov qword [rbp - 0x78], rdi
jmp 0x1404d74fd
mov qword [rbp - 0x70], rdi
jmp 0x1404d7506
mov byte [rbp - 0x68], dil
jmp 0x1404d750f
call fcn.1404a3569
mov rax, qword [rsp + 0x58]
clc
test spl, r14b
cmp dword [rax + 0xc], r15d
jmp 0x1404d7526
jne 0x1404d7561
cmp byte [rsp + 0x68], dil
jmp 0x1404d7536
je 0x1404d7554
mov rax, qword [rsp + 0x50]
bsf r8, r14
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, r12b
mov r8b, 1
mov r8d, r15d
jmp 0x1404d755c
jmp 0x1404d75d7
call fcn.1404c9326
test eax, eax
jne 0x1404d75a9
cmp byte [rsp + 0x68], dil
jmp 0x1404d7578
je 0x1404d7599
mov rax, qword [rsp + 0x50]
neg r8
movsx r8, cx
rcr r8b, cl
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, dil
mov r8d, 1
jmp 0x1404d75a4
jmp 0x1404d75d7
cmp byte [rsp + 0x68], dil
je 0x1404d75c8
mov rax, qword [rsp + 0x50]
movzx rdx, di
cmc
and dword [rax + 0x3a8], 0xfffffffd
movsx ecx, sp
mov r8d, edi
movsx edx, bp
movzx rdx, r15w
movsx dx, r13b
lea rdx, [rsp + 0x70]
movzx cx, r12b
lea rcx, [rbp - 4]
jmp 0x1404d75ea
call fcn.1404d668b
mov r15, qword [rbp - 0x80]
adc ch, 0x6c
rol ecx, 0x82
movzx rcx, r10w
test eax, eax
movsx rcx, r10w
movzx ecx, r10w
mov rcx, r15
jmp 0x1404d760f
cmovne rcx, rdi
clc
cmp byte [rcx], 0x2e
jmp 0x1404d761c
jne 0x1404d7655
mov al, byte [rcx + 1]
cmp r8, 0x27de0191
test al, al
jmp 0x1404d7633
je 0x1404d767d
cmp al, 0x2e
jmp 0x1404d7640
jne 0x1404d7655
cmp byte [rcx + 2], dil
jmp 0x1404d764f
je 0x1404d767d
mov r9, r12
seta dh
jmp 0x1404d7660
mov r8, r13
movsxd rdx, edx
mov rdx, rsi
call fcn.1404d6e0e
mov edi, eax
test eax, eax
jne 0x1404d7717
xor edi, edi
test ah, 0x3f
cmp byte [rbp - 0x68], dil
jmp 0x1404d7686
je 0x1404d7699
mov rcx, r15
jmp 0x1404d7694
call fcn.1404c81ee
lea rdx, [rbp - 0x30]
movsx ecx, r14w
mov rcx, rbx
jmp 0x1404d76a9
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
clc
test eax, eax
jne 0x1404d74c6
mov rax, qword [r12]
mov rdx, qword [r12 + 8]
sub rdx, rax
cmp r15b, 0xed
clc
sar rdx, 3
cmp r14, rdx
je 0x1404d7733
sub rdx, r14
mov cx, r11w
lea rcx, [rax + r14*8]
mov r9d, 0x19c95407
not r8w
mov r8, r11
lea r9, [0x1400acc8c]
bswap r8w
movsxd r8, eax
mov r8d, 8
jmp 0x1404d770d
call fcn.1404e356e
jmp 0x1404d7733
cmp byte [rbp - 0x68], 0
jmp 0x1404d7720
je 0x1404d7733
mov rcx, r15
jmp 0x1404d772e
call fcn.1404c81ee
mov rcx, rbx
jmp 0x1404d773b
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d774a
je 0x1404d775e
mov rcx, qword [rbp - 0x50]
jmp 0x1404d7759
call fcn.1404c81ee
mov eax, edi
mov rcx, qword [rbp + 0x220]
stc
cmc
xor rcx, rsp
call fcn.14049e949
mov rbx, qword [rsp + 0x388]
movsx rbp, sp
stc
sal dil, cl
add rsp, 0x330
movsx edi, r9w
pop r15
cmovnp r13d, ecx
movsxd r13, ecx
xchg r13b, r12b
pop r14
setno bpl
movsx edi, r15w
bswap r12w
pop r13
movsx rdi, r11w
not bp
mov di, di
pop r12
jmp 0x1404d77c0
pop rdi
movsx ebp, bp
mov sil, r13b
movsx rbp, si
pop rsi
movsx rbp, di
pop rbp
jmp 0x1404d77d6
ret