Function at 0x1404db8f5
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
shr al, 0xd7
push rbp
push rsi
sub rsi, 0x89f17cf
sar al, 0x1b
push rdi
shr bh, 0x16
push r12
lahf
push r13
cwde
push r14
cwde
movsxd rax, r15d
rol esi, cl
push r15
add bx, 0x3809
lea rbp, [rsp - 0x230]
movsxd r12, r13d
or r12b, 0xab
movsx rax, r15w
sub rsp, 0x330
mov rax, qword [0x1400b7288]
clc
sbb esi, r9d
setge bh
xor rax, rsp
rcl sil, 0x78
bswap r12
neg sil
mov qword [rbp + 0x220], rax
bts ebx, esi
mov r12, r8
or bl, 0xb3
rol bx, 0xa1
mov rsi, rcx
or ebx, r12d
and bl, 0xcf
movabs rbx, 0x200000000801
cmp r11d, edx
stc
cmp rdx, rcx
jmp 0x1404db98a
je 0x1404db9d7
mov al, byte [rdx]
clc
test rdx, 0x4f224e92
cmp ebx, 0x42d360bd
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404db9a9
ja 0x1404db9be
movsx rax, al
stc
bt rbx, rax
jb 0x1404db9d7
mov rcx, rsi
call fcn.1401b3bd0
mov rdx, rax
cmp rax, rsi
jmp 0x1404db9d1
jne 0x1404db990
mov r8b, byte [rdx]
stc
test al, 0x6f
cmp r8b, 0x3a
jne 0x1404dba20
lea rax, [rsi + 1]
test cl, al
cmp rdx, rax
jmp 0x1404db9f5
je 0x1404dba20
mov r9, r12
sub rcx, 0x5f761827
bts cx, si
xor r8d, r8d
sub edx, edx
mov rcx, rsi
jmp 0x1404dba16
call fcn.1404db56e
jmp 0x1404dbedf
sub r8b, 0x2f
test r9w, cx
sub edi, edi
cmp r8b, 0x2d
ja 0x1404dba4c
movsx rax, r8b
bt rbx, rax
mov al, bpl
mov al, 1
jmp 0x1404dba46
jb 0x1404dba53
mov al, dil
rcr rcx, 0xe9
sub rdx, rsi
xchg cl, ch
mov rcx, r15
bswap ecx
mov qword [rbp - 0x60], rdi
bswap cx
inc rdx
or ecx, 0x3f233aac
rol cl, 0xa1
and ch, 0x64
mov qword [rbp - 0x58], rdi
and ecx, edi
shl ecx, 0x42
neg al
bswap ecx
mov cl, 0x89
movsx ecx, r10w
mov qword [rbp - 0x50], rdi
xchg ecx, ecx
lea rcx, [rsp + 0x30]
jmp 0x1404dba96
mov qword [rbp - 0x48], rdi
sbb r13, r13
test r13b, 0x35
cmp ah, dl
mov qword [rbp - 0x40], rdi
stc
test si, r9w
and r13, rdx
clc
test dl, sil
mov byte [rbp - 0x38], dil
cmp r8, r11
test r14w, sp
xor edx, edx
jmp 0x1404dbac5
call fcn.1404a7a6a
mov rax, qword [rsp + 0x38]
cmp r12b, 0xc3
btr r15w, si
mov r15d, 0xfde9
cmc
clc
cmp dword [rax + 0xc], r15d
jne 0x1404dbb25
cmp byte [rsp + 0x48], dil
jmp 0x1404dbaf4
je 0x1404dbb18
mov rax, qword [rsp + 0x30]
add r8, r11
sar r8w, cl
add r8d, 0x10507045
and dword [rax + 0x3a8], 0xfffffffd
movsx r8, r11w
mov r8d, r15d
jmp 0x1404dbb20
jmp 0x1404dbba3
call fcn.1404cdb87
test eax, eax
jmp 0x1404dbb31
jne 0x1404dbb75
cmp byte [rsp + 0x48], dil
jmp 0x1404dbb41
je 0x1404dbb65
mov rax, qword [rsp + 0x30]
rcl r8b, cl
cmc
xor r8w, 0x4a64
and dword [rax + 0x3a8], 0xfffffffd
not r8d
jmp 0x1404dbb65
mov r8d, 1
jmp 0x1404dbb70
jmp 0x1404dbba3
cmp byte [rsp + 0x48], dil
je 0x1404dbb95
mov rax, qword [rsp + 0x30]
cdq
and dword [rax + 0x3a8], 0xfffffffd
movsx cx, r12b
movsxd rdx, r11d
mov r8d, edi
movsxd rcx, eax
movzx cx, spl
seta dh
lea rdx, [rbp - 0x60]
mov cl, 0xad
mov rcx, rsi
jmp 0x1404dbbb1
call fcn.1404a84a5
mov rcx, qword [rbp - 0x50]
neg r8b
lea r8, [rbp - 0x30]
stc
test eax, eax
jmp 0x1404dbbc9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1404dbbd7
cmovne rcx, rdi
cmp r8d, eax
cmp sp, 0x165d
xor r9d, r9d
test al, r8b
cmc
sub edx, edx
jmp 0x1404dbbf1
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
clc
test al, r15b
test r11b, 0xa0
cmp rax, 0xffffffffffffffff
jmp 0x1404dbc0b
jne 0x1404dbc39
mov r9, r12
xor r8d, r8d
sal ch, 0x1f
xor edx, edx
movsx rcx, di
mov rcx, rsi
jmp 0x1404dbc28
call fcn.1404db56e
mov edi, eax
jmp 0x1404dbc34
jmp 0x1404dbec1
mov r14, qword [r12 + 8]
sub r14, qword [r12]
bts cx, ax
neg cl
sal ch, cl
sar r14, 3
bsf rcx, rbp
xchg ch, ch
sub edx, edx
movsx cx, r15b
movzx ecx, sp
movsxd rcx, r12d
mov qword [rsp + 0x70], rdi
xchg cx, cx
movsxd rcx, eax
lea rcx, [rsp + 0x50]
jmp 0x1404dbc76
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
jmp 0x1404dbc88
mov qword [rbp - 0x70], rdi
jmp 0x1404dbc91
mov byte [rbp - 0x68], dil
jmp 0x1404dbc9a
call fcn.1404a7a6a
mov rax, qword [rsp + 0x58]
jmp 0x1404dbcad
cmp dword [rax + 0xc], r15d
jmp 0x1404dbcb6
jne 0x1404dbcf0
cmp byte [rsp + 0x68], dil
jmp 0x1404dbcc6
je 0x1404dbce3
mov rax, qword [rsp + 0x50]
cmp rdx, 0x348f4e33
rol r8b, 0x26
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404dbceb
jmp 0x1404dbd59
call fcn.1404cdb87
test eax, eax
jmp 0x1404dbcfc
jne 0x1404dbd37
cmp byte [rsp + 0x68], dil
jmp 0x1404dbd0c
je 0x1404dbd2c
mov rax, qword [rsp + 0x50]
rcr r8w, cl
sar r8w, cl
and dword [rax + 0x3a8], 0xfffffffd
bswap r8d
xchg r8b, r8b
mov r8d, 1
jmp 0x1404dbd59
cmp byte [rsp + 0x68], dil
jmp 0x1404dbd41
je 0x1404dbd56
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
not r8b
mov r8d, edi
lea rdx, [rsp + 0x70]
movzx rcx, r12w
lea rcx, [rbp - 4]
jmp 0x1404dbd6b
call fcn.1404dae07
mov r15, qword [rbp - 0x80]
test eax, eax
movsx rcx, r11w
movzx rcx, di
mov rcx, r15
jmp 0x1404dbd86
cmovne rcx, rdi
test r9b, cl
cmp byte [rcx], 0x2e
jmp 0x1404dbd95
jne 0x1404dbdc5
mov al, byte [rcx + 1]
stc
cmp al, 0xab
test al, al
jmp 0x1404dbda8
je 0x1404dbdf0
cmp al, 0x2e
jmp 0x1404dbdb5
jne 0x1404dbdc5
cmp byte [rcx + 2], dil
je 0x1404dbdf0
mov r9, r12
bswap edx
mov r8, r13
xchg edx, edx
movsx dx, r15b
mov rdx, rsi
call fcn.1404db56e
mov edi, eax
test eax, eax
jmp 0x1404dbde5
jne 0x1404dbe9c
xor edi, edi
test cl, 0x9a
cmp byte [rbp - 0x68], dil
jmp 0x1404dbdf9
je 0x1404dbe0c
mov rcx, r15
jmp 0x1404dbe07
call fcn.1404cca27
lea rdx, [rbp - 0x30]
xchg ecx, ecx
mov cx, 0x5d41
setns cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmp r15w, ax
test eax, eax
jmp 0x1404dbe33
jne 0x1404dbc54
mov rax, qword [r12]
and dh, 0xa6
ror rdx, cl
cqo
mov rdx, qword [r12 + 8]
sub rdx, rax
cmc
sar rdx, 3
test r8b, 0xf5
cmp r14, rdx
jmp 0x1404dbe5e
je 0x1404dbeb8
sub rdx, r14
movsxd r8, esp
cmovge r9w, r10w
lea rcx, [rax + r14*8]
movsx r8w, sil
xchg r8, r8
movzx r8w, r12b
lea r9, [0x1400acc8c]
mov r8d, 8
jmp 0x1404dbe92
call fcn.1404e7d48
jmp 0x1404dbeb8
cmp byte [rbp - 0x68], 0
jmp 0x1404dbea5
je 0x1404dbeb8
mov rcx, r15
jmp 0x1404dbeb3
call fcn.1404cca27
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404dbed4
mov rcx, qword [rbp - 0x50]
call fcn.1404cca27
mov eax, edi
btc cx, 0x12
rol rcx, 0xfc
mov rcx, qword [rbp + 0x220]
stc
test r11b, r11b
xor rcx, rsp
jmp 0x1404dbef2
call fcn.1404a2f20
mov rbx, qword [rsp + 0x388]
sbb r15d, 0x9f738eb
bts r14w, dx
add rsp, 0x330
mov r15d, 0x7a765430
pop r15
movsx rsi, r8w
pop r14
movsxd rbp, ecx
not bpl
pop r13
mov bpl, sil
pop r12
movzx esi, bx
jmp 0x1404dbf35
pop rdi
pop rsi
jmp 0x1404dbf3e
pop rbp
ret