Function at 0x1404dd0b7
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
sar eax, 0x7d
rol bl, cl
btc ax, 0xaf
push rdi
cmovl bx, si
sal si, 0xbd
rcr sil, cl
push r12
push r13
bt rsi, 0x3a
push r14
sal esi, cl
movsx bx, r14b
push r15
lea rbp, [rsp - 0x230]
cwde
sub rsp, 0x330
shr bh, 0x44
inc bl
shr ax, cl
mov rax, qword [0x1400b7288]
rcl r12w, 0x56
xor rax, rsp
sbb r12w, 0x237
movzx bx, sil
mov qword [rbp + 0x220], rax
mov r12, r8
mov rsi, rcx
bt rbx, r13
stc
not bh
movabs rbx, 0x200000000801
cmp rdx, rcx
je 0x1404dd192
mov al, byte [rdx]
sub al, 0x2f
test r13w, r15w
test sp, 0x2767
cmp al, 0x2d
jmp 0x1404dd155
ja 0x1404dd16e
movsx rax, al
bt rbx, rax
jmp 0x1404dd168
jb 0x1404dd192
mov rcx, rsi
call fcn.1401d047e
mov rdx, rax
cmp bx, r8w
test r9, 0x28841ad7
cmp rax, rsi
jmp 0x1404dd18c
jne 0x1404dd141
mov r8b, byte [rdx]
test rsp, r11
test r9w, 0x26c0
cmp r8b, 0x3a
jmp 0x1404dd1a7
jne 0x1404dd1e5
lea rax, [rsi + 1]
cmp rdx, rax
jmp 0x1404dd1b9
je 0x1404dd1e5
mov r9, r12
bt cx, cx
sar cx, 0x13
sub r8d, r8d
sub ecx, 0x63cc531e
rcr cx, cl
xor edx, edx
mov rcx, rsi
call fcn.1404dcd59
jmp 0x1404dd6af
sub r8b, 0x2f
cmc
xor edi, edi
cmp bpl, 0x4d
test r9b, 0xd0
clc
cmp r8b, 0x2d
jmp 0x1404dd1fe
ja 0x1404dd21a
movsx rax, r8b
clc
bt rbx, rax
mov al, 1
jmp 0x1404dd214
jb 0x1404dd228
mov al, dil
btc rcx, 0x7c
shrd cx, r12w, 0x67
sub rdx, rsi
movsxd rcx, ebx
mov qword [rbp - 0x60], rdi
mov ch, 0x86
movzx rcx, bx
inc rdx
xor cx, 0x11f5
mov qword [rbp - 0x58], rdi
xor rcx, 0x5651717e
movzx ecx, r12w
shl cx, 0xa4
neg al
movzx ecx, r15w
movsx ecx, ax
mov qword [rbp - 0x50], rdi
dec cl
mov cl, 0x43
movsx cx, ah
lea rcx, [rsp + 0x30]
jmp 0x1404dd273
mov qword [rbp - 0x48], rdi
sbb r13, r13
clc
mov qword [rbp - 0x40], rdi
clc
stc
test bpl, r14b
and r13, rdx
stc
mov byte [rbp - 0x38], dil
jmp 0x1404dd296
xor edx, edx
jmp 0x1404dd29d
call fcn.1404a91a2
mov rax, qword [rsp + 0x38]
or r15, r13
mov r15d, 0xfde9
jmp 0x1404dd2b9
cmp dword [rax + 0xc], r15d
jmp 0x1404dd2c2
jne 0x1404dd2f4
cmp byte [rsp + 0x48], dil
jmp 0x1404dd2d2
je 0x1404dd2e7
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
xchg r8b, r8b
mov r8d, r15d
jmp 0x1404dd2ef
jmp 0x1404dd35f
call fcn.1404cf145
test eax, eax
jne 0x1404dd33c
cmp byte [rsp + 0x48], dil
jmp 0x1404dd30b
je 0x1404dd32c
mov rax, qword [rsp + 0x30]
or r8b, 0xac
and dword [rax + 0x3a8], 0xfffffffd
cmovne r8d, ebp
bswap r8
seta r8b
mov r8d, 1
jmp 0x1404dd337
jmp 0x1404dd35f
cmp byte [rsp + 0x48], dil
jmp 0x1404dd346
je 0x1404dd35c
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movzx r8d, r9w
mov r8d, edi
lea rdx, [rbp - 0x60]
movsx cx, r8b
movsxd rcx, esp
jmp 0x1404dd370
mov rcx, rsi
jmp 0x1404dd378
call fcn.1404a9be7
mov rcx, qword [rbp - 0x50]
adc r8b, r15b
lea r8, [rbp - 0x30]
cmp r9b, bpl
test r13b, bl
test eax, eax
mov dword [rsp + 0x28], edi
jmp 0x1404dd399
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
test rdi, 0x2a130c5
sub r9d, r9d
jmp 0x1404dd3b2
sub edx, edx
jmp 0x1404dd3b9
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp sil, al
cmp rax, 0xffffffffffffffff
jmp 0x1404dd3ce
jne 0x1404dd3f3
mov r9, r12
movsx ecx, sp
sub r8d, r8d
sub edx, edx
mov rcx, rsi
jmp 0x1404dd3e7
call fcn.1404dcd59
mov edi, eax
jmp 0x1404dd68f
mov r14, qword [r12 + 8]
sub r14, qword [r12]
movsx ecx, dx
sar r14, 3
dec cx
bt ecx, ecx
xor edx, edx
movzx ecx, di
movsx rcx, r10w
mov ch, 0x9f
mov qword [rsp + 0x70], rdi
xchg rcx, rcx
movzx rcx, bx
movzx cx, bpl
lea rcx, [rsp + 0x50]
jmp 0x1404dd430
mov qword [rsp + 0x78], rdi
jmp 0x1404dd43a
mov qword [rbp - 0x80], rdi
jmp 0x1404dd443
mov qword [rbp - 0x78], rdi
jmp 0x1404dd44c
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
jmp 0x1404dd459
call fcn.1404a91a2
mov rax, qword [rsp + 0x58]
test r8d, 0x72b569ed
stc
test cx, r11w
cmp dword [rax + 0xc], r15d
jmp 0x1404dd478
jne 0x1404dd4b2
cmp byte [rsp + 0x68], dil
jmp 0x1404dd488
je 0x1404dd4a5
mov rax, qword [rsp + 0x50]
shr r8b, cl
movsx r8, ax
and dword [rax + 0x3a8], 0xfffffffd
movzx r8, r14w
mov r8d, r15d
jmp 0x1404dd4ad
jmp 0x1404dd536
call fcn.1404cf145
test eax, eax
jmp 0x1404dd4be
jne 0x1404dd503
cmp byte [rsp + 0x68], dil
jmp 0x1404dd4ce
je 0x1404dd4f3
mov rax, qword [rsp + 0x50]
test r8w, r11w
xor r8b, bpl
shr r8b, 0x66
and dword [rax + 0x3a8], 0xfffffffd
xchg r8w, r8w
movzx r8, ax
mov r8d, 1
jmp 0x1404dd4fe
jmp 0x1404dd536
cmp byte [rsp + 0x68], dil
jmp 0x1404dd50d
je 0x1404dd52f
mov rax, qword [rsp + 0x50]
and cx, bx
sal r8b, 0x7e
and dword [rax + 0x3a8], 0xfffffffd
xchg r8d, ecx
mov edx, eax
mov dx, 0x3299
mov r8d, edi
movsx rdx, r9w
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 4]
jmp 0x1404dd544
call fcn.1404dc57c
mov r15, qword [rbp - 0x80]
rcr cx, 0xe2
rol cx, 0xe2
test eax, eax
mov cl, r14b
mov ch, 0xf
movzx ecx, dx
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404dd56f
jne 0x1404dd5a0
mov al, byte [rcx + 1]
cmp r13, rsi
stc
test al, al
jmp 0x1404dd583
je 0x1404dd5cc
cmp al, 0x2e
jne 0x1404dd5a0
cmp byte [rcx + 2], dil
jmp 0x1404dd59a
je 0x1404dd5cc
mov r9, r12
mov r8, r13
cmovs rdx, rsi
bswap dx
not dh
mov rdx, rsi
call fcn.1404dcd59
mov edi, eax
stc
test r8b, r12b
test eax, eax
jmp 0x1404dd5c4
jne 0x1404dd66a
xor edi, edi
cmp byte [rbp - 0x68], dil
je 0x1404dd5e3
mov rcx, r15
jmp 0x1404dd5de
call fcn.1404ce047
lea rdx, [rbp - 0x30]
movsx ecx, cx
bswap cx
mov rcx, rbx
jmp 0x1404dd5f5
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmc
test r9b, 0xd0
test eax, eax
jmp 0x1404dd60d
jne 0x1404dd409
mov rax, qword [r12]
movsx edx, dx
cmp r10b, spl
mov rdx, qword [r12 + 8]
sub rdx, rax
sar rdx, 3
stc
cmp r14, rdx
jmp 0x1404dd632
je 0x1404dd681
sub rdx, r14
movzx r8d, bp
lea rcx, [rax + r14*8]
movzx r8w, spl
movsxd r9, esi
not r8
lea r9, [0x1400acc8c]
mov r8d, 8
jmp 0x1404dd660
call fcn.1404e94ef
jmp 0x1404dd681
cmp byte [rbp - 0x68], 0
je 0x1404dd681
mov rcx, r15
jmp 0x1404dd67c
call fcn.1404ce047
mov rcx, rbx
jmp 0x1404dd689
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404dd698
je 0x1404dd6ac
mov rcx, qword [rbp - 0x50]
jmp 0x1404dd6a7
call fcn.1404ce047
mov eax, edi
stc
mov rcx, qword [rbp + 0x220]
clc
test rcx, 0x5f4e2fe2
xor rcx, rsp
call fcn.1404a4670
mov rbx, qword [rsp + 0x388]
xchg r13w, si
neg r12w
xor di, di
add rsp, 0x330
xchg r14b, r15b
pop r15
seto dil
jmp 0x1404dd6f1
pop r14
xchg r12b, r12b
mov edi, 0x17d00201
movsx r12w, r8b
pop r13
pop r12
pop rdi
movzx esi, r15w
movsx rsi, di
pop rsi
movzx rbp, r11w
xchg bp, bp
cmove bp, di
pop rbp
jmp 0x1404dd71f
ret