Function at 0x1404d4cd3
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
cmp r15b, 0x4a
bts rbx, rcx
inc rax
push rbp
dec al
push rsi
clc
sar esi, cl
push rdi
and bp, sp
rcr ax, cl
push r12
push r13
movsx esi, di
sbb r12b, r14b
movzx rbx, r12w
push r14
push r15
rcr ah, 0x58
xor bl, r14b
rcl bh, cl
lea rbp, [rsp - 0x230]
cdqe
sub rsp, 0x330
bts r12, r10
mov rax, qword [0x1400b7288]
sbb esi, r10d
xor rax, rsp
dec r12b
xchg bx, r12w
mov qword [rbp + 0x220], rax
movsx esi, r11w
mov r12, r8
sub si, r13w
mov rsi, rcx
movzx bx, bl
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d4d5f
je 0x1404d4db7
mov al, byte [rdx]
cmp r14b, r12b
sub al, 0x2f
cmp r10w, r10w
jmp 0x1404d4d75
cmp al, 0x2d
jmp 0x1404d4d7c
ja 0x1404d4d96
movsx rax, al
cmc
bt rbx, rax
jmp 0x1404d4d90
jb 0x1404d4db7
mov rcx, rsi
jmp 0x1404d4d9e
call fcn.14027c1bf
mov rdx, rax
cmp r11, rsp
cmp rax, rsi
jmp 0x1404d4db1
jne 0x1404d4d65
mov r8b, byte [rdx]
stc
clc
cmp r8b, 0x3a
jmp 0x1404d4dc5
jne 0x1404d4e04
lea rax, [rsi + 1]
test r15w, 0x69fa
cmp rdx, rax
jmp 0x1404d4ddd
je 0x1404d4e04
mov r9, r12
ror ecx, 0x90
ror ch, cl
rol ecx, cl
xor r8d, r8d
sub edx, edx
mov rcx, rsi
jmp 0x1404d4dfa
call fcn.1404d4977
jmp 0x1404d52cf
sub r8b, 0x2f
xor edi, edi
jmp 0x1404d4e0f
cmp r8b, 0x2d
jmp 0x1404d4e18
ja 0x1404d4e35
movsx rax, r8b
bt rbx, rax
not al
mov al, 1
jmp 0x1404d4e2f
jb 0x1404d4e40
mov al, dil
shld cx, r8w, 0x52
rol cl, cl
sub rdx, rsi
movsx ecx, di
setge cl
mov qword [rbp - 0x60], rdi
movsxd rcx, r11d
mov cl, bpl
xchg cl, ch
inc rdx
rol cl, 0xec
bts cx, dx
mov qword [rbp - 0x58], rdi
neg al
mov qword [rbp - 0x50], rdi
setp cl
movsx rcx, r13w
movzx cx, r13b
lea rcx, [rsp + 0x30]
jmp 0x1404d4e7f
mov qword [rbp - 0x48], rdi
jmp 0x1404d4e88
sbb r13, r13
test r12b, r9b
test al, 0xe
mov qword [rbp - 0x40], rdi
stc
test r12b, dl
and r13, rdx
test r9b, r12b
mov byte [rbp - 0x38], dil
cmc
jmp 0x1404d4eab
sub edx, edx
jmp 0x1404d4eb2
call fcn.1404a0f6c
mov rax, qword [rsp + 0x38]
movzx r15, dx
test r10b, 0x99
rcl r15w, cl
mov r15d, 0xfde9
stc
clc
cmp esp, esp
cmp dword [rax + 0xc], r15d
jmp 0x1404d4edb
jne 0x1404d4f0e
cmp byte [rsp + 0x48], dil
jmp 0x1404d4eeb
je 0x1404d4f01
mov rax, qword [rsp + 0x30]
or r8b, 0xc2
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d4f09
jmp 0x1404d4f7c
call fcn.1404c7050
test eax, eax
jmp 0x1404d4f1a
jne 0x1404d4f58
cmp byte [rsp + 0x48], dil
jmp 0x1404d4f2a
je 0x1404d4f48
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, r12b
not r8b
movsx r8, sp
mov r8d, 1
jmp 0x1404d4f53
jmp 0x1404d4f7c
cmp byte [rsp + 0x48], dil
je 0x1404d4f79
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movsx edx, r12w
xchg ch, dl
movsx r8, ax
mov r8d, edi
lea rdx, [rbp - 0x60]
movsx ecx, bp
bswap cx
mov cx, bp
mov rcx, rsi
jmp 0x1404d4f91
call fcn.1404a1a1b
mov rcx, qword [rbp - 0x50]
shl r8b, cl
lea r8, [rbp - 0x30]
test r13w, 0x1b83
test eax, eax
mov dword [rsp + 0x28], edi
jmp 0x1404d4fb2
mov qword [rsp + 0x20], rdi
jmp 0x1404d4fbc
cmovne rcx, rdi
xor r9d, r9d
jmp 0x1404d4fc8
xor edx, edx
jmp 0x1404d4fcf
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
stc
cmp r11b, dl
cmp rax, 0xffffffffffffffff
jmp 0x1404d4fe5
jne 0x1404d501a
mov r9, r12
sub r8d, r8d
sub ch, 0x10
sbb cx, dx
adc ch, 0xfe
sub edx, edx
movzx cx, r12b
mov rcx, rsi
jmp 0x1404d5009
call fcn.1404d4977
mov edi, eax
jmp 0x1404d5015
jmp 0x1404d52a9
mov r14, qword [r12 + 8]
sub cl, 0xeb
bswap ecx
sub r14, qword [r12]
xor cx, bp
bsf ecx, r9d
shr ch, 0x1e
sar r14, 3
stc
cmc
xor edx, edx
movsx cx, r15b
setl cl
mov qword [rsp + 0x70], rdi
movsx cx, ch
movsx rcx, r12w
lea rcx, [rsp + 0x50]
jmp 0x1404d5059
mov qword [rsp + 0x78], rdi
jmp 0x1404d5063
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404d5074
mov byte [rbp - 0x68], dil
jmp 0x1404d507d
call fcn.1404a0f6c
mov rax, qword [rsp + 0x58]
cmp ax, 0x2009
jmp 0x1404d5090
cmp dword [rax + 0xc], r15d
jne 0x1404d50cf
cmp byte [rsp + 0x68], dil
jmp 0x1404d50a4
je 0x1404d50c2
mov rax, qword [rsp + 0x50]
jmp 0x1404d50bb
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d50ca
jmp 0x1404d513f
call fcn.1404c7050
test eax, eax
jmp 0x1404d50db
jne 0x1404d5116
cmp byte [rsp + 0x68], dil
jmp 0x1404d50eb
je 0x1404d5106
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d5106
mov r8d, 1
jmp 0x1404d5111
jmp 0x1404d513f
cmp byte [rsp + 0x68], dil
jmp 0x1404d5120
je 0x1404d5136
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
not dh
cqo
mov r8d, edi
movsx rdx, r8w
xchg dl, dh
lea rdx, [rsp + 0x70]
movsx rcx, di
cmovge cx, r15w
lea rcx, [rbp - 4]
jmp 0x1404d5156
call fcn.1404d41ad
mov r15, qword [rbp - 0x80]
xor cl, r12b
bts rcx, rsi
test eax, eax
mov rcx, r15
jmp 0x1404d5170
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jne 0x1404d51a0
mov al, byte [rcx + 1]
clc
test al, al
jmp 0x1404d5188
je 0x1404d51e3
cmp al, 0x2e
jne 0x1404d51a0
cmp byte [rcx + 2], dil
je 0x1404d51e3
mov r9, r12
xchg edx, edx
movsxd rdx, r12d
setg dh
mov r8, r13
cmovg edx, r11d
movzx rdx, sp
not rdx
mov rdx, rsi
jmp 0x1404d51c1
call fcn.1404d4977
mov edi, eax
test bl, bpl
test r9b, 0xd8
test eax, eax
jmp 0x1404d51d6
jne 0x1404d527f
xor edi, edi
cmc
test r8w, r14w
cmp byte [rbp - 0x68], dil
jmp 0x1404d51ec
je 0x1404d51ff
mov rcx, r15
jmp 0x1404d51fa
call fcn.1404c5f1c
lea rdx, [rbp - 0x30]
jmp 0x1404d5211
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jmp 0x1404d5227
jne 0x1404d5038
mov rax, qword [r12]
mov rdx, qword [r12 + 8]
sub rdx, rax
sar rdx, 3
cmp r14, rdx
jmp 0x1404d5245
je 0x1404d529b
sub rdx, r14
lea rcx, [rax + r14*8]
cmovs r9w, dx
jmp 0x1404d525f
lea r9, [0x1400acc8c]
movzx r8, r9w
movzx r8w, spl
mov r8d, 8
call fcn.1404e1011
jmp 0x1404d529b
cmp byte [rbp - 0x68], 0
jmp 0x1404d5288
je 0x1404d529b
mov rcx, r15
jmp 0x1404d5296
call fcn.1404c5f1c
mov rcx, rbx
jmp 0x1404d52a3
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d52b2
je 0x1404d52c6
mov rcx, qword [rbp - 0x50]
jmp 0x1404d52c1
call fcn.1404c5f1c
mov eax, edi
movzx ecx, bp
btr ecx, r12d
mov rcx, qword [rbp + 0x220]
clc
xor rcx, rsp
jmp 0x1404d52df
call fcn.14049c411
mov rbx, qword [rsp + 0x388]
bts ebp, r12d
btc r14w, 0xae
sal r13d, 0xc2
add rsp, 0x330
pop r15
xchg esi, ebp
movsxd r12, r14d
movzx esi, sp
pop r14
pop r13
movsx edi, sp
pop r12
pop rdi
setle sil
pop rsi
movzx rbp, r12w
not bpl
movsx bp, r8b
pop rbp
jmp 0x1404d532c
ret