Function at 0x1404d88c7
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
neg bh
bswap bx
add bpl, dil
push rsi
ror si, 0xdd
push rdi
rcr esi, cl
adc rax, 0x794905ea
bswap ax
push r12
shrd esi, ebp, 0x20
push r13
push r14
clc
push r15
sar bp, cl
lea rbp, [rsp - 0x230]
bsr r12, r12
shld ax, r11w, 0xbe
movzx r12w, sil
sub rsp, 0x330
sub al, r9b
rol ax, cl
and rbx, 0x250f157f
mov rax, qword [0x1400b7288]
btr si, dx
or r12w, bx
xor rax, rsp
test dl, 0x45
neg r12d
mov r12d, ebx
mov qword [rbp + 0x220], rax
shl sil, 0x63
mov r12, r8
and sil, 0x88
mov rsi, rcx
movabs rbx, 0x200000000801
test sil, dl
cmp dil, r8b
cmp rdx, rcx
jmp 0x1404d896a
je 0x1404d89bd
mov al, byte [rdx]
test al, 0x25
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404d897d
ja 0x1404d8999
movsx rax, al
cmc
clc
stc
bt rbx, rax
jmp 0x1404d8993
jb 0x1404d89bd
mov rcx, rsi
jmp 0x1404d89a1
call fcn.1400e9be0
mov rdx, rax
clc
jmp 0x1404d89af
cmp rax, rsi
jmp 0x1404d89b7
jne 0x1404d8970
mov r8b, byte [rdx]
cmc
cmp r8b, 0x3a
jne 0x1404d8a05
lea rax, [rsi + 1]
cmp rdx, rax
je 0x1404d8a05
mov r9, r12
neg cx
sub r8d, r8d
xor cl, dil
movsx rcx, ax
shl cl, 0xe0
xor edx, edx
mov ecx, r13d
cmovne rcx, r13
movsx rcx, r8w
mov rcx, rsi
call fcn.1404d857a
jmp 0x1404d8e7f
sub r8b, 0x2f
sub edi, edi
cmp r8b, 0x2d
jmp 0x1404d8a14
ja 0x1404d8a30
movsx rax, r8b
stc
bt rbx, rax
mov al, 1
jmp 0x1404d8a2a
jb 0x1404d8a35
mov al, dil
not ch
sub rdx, rsi
movsx ecx, bx
movzx ecx, r12w
mov qword [rbp - 0x60], rdi
mov ch, 0xb2
inc rdx
mov qword [rbp - 0x58], rdi
adc cx, 0x2be1
bswap ecx
neg al
mov qword [rbp - 0x50], rdi
movzx cx, r10b
lea rcx, [rsp + 0x30]
jmp 0x1404d8a69
mov qword [rbp - 0x48], rdi
sbb r13, r13
clc
cmp rcx, 0x2e8365b6
mov qword [rbp - 0x40], rdi
cmp r13w, r8w
and r13, rdx
mov byte [rbp - 0x38], dil
xor edx, edx
jmp 0x1404d8a8e
call fcn.1404a50d9
mov rax, qword [rsp + 0x38]
bt r15w, r9w
clc
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d8aad
jne 0x1404d8ae0
cmp byte [rsp + 0x48], dil
je 0x1404d8ad3
mov rax, qword [rsp + 0x30]
and r8w, 0x4663
add r8b, r9b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d8adb
jmp 0x1404d8b4c
call fcn.1404cabcf
test eax, eax
jmp 0x1404d8aec
jne 0x1404d8b22
cmp byte [rsp + 0x48], dil
jmp 0x1404d8afc
je 0x1404d8b12
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movzx r8, bx
mov r8d, 1
jmp 0x1404d8b1d
jmp 0x1404d8b4c
cmp byte [rsp + 0x48], dil
jmp 0x1404d8b2c
je 0x1404d8b46
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d8b46
mov r8d, edi
not rcx
lea rdx, [rbp - 0x60]
cmovle rcx, r8
mov rcx, rsi
call fcn.1404a5b3f
mov rcx, qword [rbp - 0x50]
sar r8d, 0x3e
dec r8b
movzx r8, r9w
lea r8, [rbp - 0x30]
stc
test eax, eax
jmp 0x1404d8b77
mov dword [rsp + 0x28], edi
jmp 0x1404d8b80
mov qword [rsp + 0x20], rdi
jmp 0x1404d8b8a
cmovne rcx, rdi
cmp r10, rbp
test spl, 0x8b
xor r9d, r9d
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmc
cmp rax, 0xffffffffffffffff
jmp 0x1404d8bad
jne 0x1404d8bd6
mov r9, r12
sar ecx, 0xe7
sub r8d, r8d
btr cx, dx
xor edx, edx
mov rcx, rsi
call fcn.1404d857a
mov edi, eax
jmp 0x1404d8bd1
jmp 0x1404d8e61
mov r14, qword [r12 + 8]
mov cl, r13b
sub r14, qword [r12]
btc rcx, r8
adc cl, dh
sar r14, 3
xor cl, spl
shld cx, bx, 0xdc
shr rcx, cl
sub edx, edx
movsxd rcx, eax
mov qword [rsp + 0x70], rdi
not cx
bswap cx
lea rcx, [rsp + 0x50]
jmp 0x1404d8c11
mov qword [rsp + 0x78], rdi
jmp 0x1404d8c1b
mov qword [rbp - 0x80], rdi
jmp 0x1404d8c24
mov qword [rbp - 0x78], rdi
jmp 0x1404d8c2d
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
jmp 0x1404d8c3a
call fcn.1404a50d9
mov rax, qword [rsp + 0x58]
cmp ecx, 0x49216cf3
clc
test r10b, spl
cmp dword [rax + 0xc], r15d
jne 0x1404d8c91
cmp byte [rsp + 0x68], dil
jmp 0x1404d8c62
je 0x1404d8c84
mov rax, qword [rsp + 0x50]
bt r8, rdx
dec r8d
movsx r8, r15w
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, r13b
mov r8d, r15d
jmp 0x1404d8c8c
jmp 0x1404d8d00
call fcn.1404cabcf
test eax, eax
jmp 0x1404d8c9d
jne 0x1404d8cca
cmp byte [rsp + 0x68], dil
jmp 0x1404d8cad
je 0x1404d8cbf
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404d8d00
cmp byte [rsp + 0x68], dil
jmp 0x1404d8cd4
je 0x1404d8cf2
mov rax, qword [rsp + 0x50]
cmc
sub cl, 0x40
rol dh, cl
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, r8b
cdq
mov r8d, edi
movsxd rcx, eax
movsx ecx, bx
jmp 0x1404d8d00
lea rdx, [rsp + 0x70]
mov cx, 0x6d1d
lea rcx, [rbp - 4]
jmp 0x1404d8d12
call fcn.1404d7dee
mov r15, qword [rbp - 0x80]
test spl, r10b
bsf rcx, r13
sbb cx, 0x41ee
test eax, eax
mov rcx, r15
jmp 0x1404d8d31
cmovne rcx, rdi
cmc
cmp r9b, sil
cmp byte [rcx], 0x2e
jne 0x1404d8d69
mov al, byte [rcx + 1]
test al, al
jmp 0x1404d8d4c
je 0x1404d8d9e
cmp al, 0x2e
jmp 0x1404d8d59
jne 0x1404d8d69
cmp byte [rcx + 2], dil
je 0x1404d8d9e
mov r9, r12
setp dh
mov r8w, 0x789c
cwd
mov r8, r13
movsx rdx, r9w
mov rdx, rsi
call fcn.1404d857a
mov edi, eax
clc
test spl, 0x36
test eax, eax
jmp 0x1404d8d93
jne 0x1404d8e41
xor edi, edi
test r8b, cl
cmp byte [rbp - 0x68], dil
jmp 0x1404d8da7
je 0x1404d8dba
mov rcx, r15
jmp 0x1404d8db5
call fcn.1404c9a89
lea rdx, [rbp - 0x30]
xchg ch, cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp bx, 0x6d56
test eax, eax
jmp 0x1404d8ddb
jne 0x1404d8bf7
mov rax, qword [r12]
adc edx, 0xa43d0f
bts dx, bp
mov rdx, qword [r12 + 8]
sub rdx, rax
sar rdx, 3
cmp bp, 0x6bfd
test r13b, r9b
cmp r14, rdx
jmp 0x1404d8e0b
je 0x1404d8e53
sub rdx, r14
movzx r8, bp
lea rcx, [rax + r14*8]
lea r9, [0x1400acc8c]
movzx r8w, r13b
movsx r8d, r15w
mov r8d, 8
jmp 0x1404d8e37
call fcn.1404e4bc3
jmp 0x1404d8e53
cmp byte [rbp - 0x68], 0
je 0x1404d8e53
mov rcx, r15
call fcn.1404c9a89
mov rcx, rbx
jmp 0x1404d8e5b
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404d8e79
mov rcx, qword [rbp - 0x50]
jmp 0x1404d8e74
call fcn.1404c9a89
mov eax, edi
cmp r9b, 6
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
jmp 0x1404d8e8e
call fcn.1404a04c2
mov rbx, qword [rsp + 0x388]
rcr si, 0xe4
add rsp, 0x330
bswap r13d
pop r15
cmovnp rbp, r9
pop r14
not r12b
pop r13
movsx esi, si
cmovs si, r12w
mov r12w, 0x17b8
pop r12
pop rdi
mov sil, 0xbf
pop rsi
movsx bp, al
pop rbp
jmp 0x1404d8ed4
ret