Function at 0x1404d9a6c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
ror rax, cl
movzx rbx, sp
bsf ax, r13w
push rbp
bsr ax, sp
push rsi
add ebx, 0x10a84ca0
movzx rax, cx
push rdi
mov sil, 0x28
ror ah, cl
push r12
rcr eax, cl
adc r12, r11
push r13
cmp bpl, r13b
push r14
push r15
shl r12w, 0xe2
lea rbp, [rsp - 0x230]
sbb r12b, bl
movsxd rsi, r11d
sub rsp, 0x330
bt rsi, rbp
test r8b, 0xac
mov rax, qword [0x1400b7288]
ror bl, 0xc2
cmp r13w, di
sal sil, 0x74
xor rax, rsp
and ebx, 0x2b500add
sub r12b, 0xad
shl si, cl
mov qword [rbp + 0x220], rax
not r12w
mov r12, r8
rcr bh, 0x1f
mov rsi, rcx
sub bl, ch
shl bh, cl
sbb bx, 0x6de0
movabs rbx, 0x200000000801
test rcx, 0x795623bf
cmp rdx, rcx
jmp 0x1404d9b1d
je 0x1404d9b68
mov al, byte [rdx]
cmc
cmp dh, ah
sub al, 0x2f
cmp al, 0x2d
ja 0x1404d9b45
movsx rax, al
bt rbx, rax
jmp 0x1404d9b3f
jb 0x1404d9b68
mov rcx, rsi
jmp 0x1404d9b4d
call fcn.14021e99f
mov rdx, rax
test r11b, 0x15
stc
cmp rax, rsi
jmp 0x1404d9b62
jne 0x1404d9b23
mov r8b, byte [rdx]
cmp r8b, 0x3a
jmp 0x1404d9b74
jne 0x1404d9bbe
lea rax, [rsi + 1]
test edx, 0x13ce3fe8
cmp sp, 0x788b
cmp rdx, rax
jmp 0x1404d9b91
je 0x1404d9bbe
mov r9, r12
sub ch, 0x15
xor r8d, r8d
sbb cl, r14b
bsf rcx, r12
xor edx, edx
bswap cx
mov rcx, rsi
jmp 0x1404d9bb4
call fcn.1404d9703
jmp 0x1404da05e
sub r8b, 0x2f
sub edi, edi
cmp r8b, 0x2d
jmp 0x1404d9bcd
ja 0x1404d9bec
movsx rax, r8b
bt rbx, rax
not al
mov al, 0xd1
mov al, 1
jmp 0x1404d9be6
jb 0x1404d9bf3
mov al, dil
bts rcx, r14
sub rdx, rsi
movsx cx, bpl
mov qword [rbp - 0x60], rdi
inc rdx
test r8d, 0x1c2840c6
bts cx, dx
mov qword [rbp - 0x58], rdi
bsf rcx, r13
cmc
neg al
not ch
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404d9c28
mov qword [rbp - 0x48], rdi
sbb r13, r13
cmc
mov qword [rbp - 0x40], rdi
cmc
and r13, rdx
test r10b, r8b
clc
mov byte [rbp - 0x38], dil
jmp 0x1404d9c49
sub edx, edx
jmp 0x1404d9c50
call fcn.1404a5fcd
mov rax, qword [rsp + 0x38]
jmp 0x1404d9c63
mov r15d, 0xfde9
stc
jmp 0x1404d9c6f
cmp dword [rax + 0xc], r15d
jmp 0x1404d9c78
jne 0x1404d9cb4
cmp byte [rsp + 0x48], dil
jmp 0x1404d9c88
je 0x1404d9ca7
mov rax, qword [rsp + 0x30]
rcr r8b, 0x9a
movsx r8w, r11b
inc r8w
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d9caf
jmp 0x1404d9d25
call fcn.1404cbbe4
test eax, eax
jne 0x1404d9cfd
cmp byte [rsp + 0x48], dil
jmp 0x1404d9ccb
je 0x1404d9ced
mov rax, qword [rsp + 0x30]
xchg r8w, r8w
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, r11b
movsxd r8, ebx
movzx r8, bx
mov r8d, 1
jmp 0x1404d9cf8
jmp 0x1404d9d25
cmp byte [rsp + 0x48], dil
jmp 0x1404d9d07
je 0x1404d9d22
mov rax, qword [rsp + 0x30]
cmp ch, 0xe7
and dword [rax + 0x3a8], 0xfffffffd
not r8
setne dh
mov r8d, edi
lea rdx, [rbp - 0x60]
mov rcx, rsi
jmp 0x1404d9d31
call fcn.1404a69e2
mov rcx, qword [rbp - 0x50]
neg r8w
movsx r8d, r9w
sar r8d, cl
lea r8, [rbp - 0x30]
test sil, al
cmc
test eax, eax
jmp 0x1404d9d54
mov dword [rsp + 0x28], edi
jmp 0x1404d9d5d
mov qword [rsp + 0x20], rdi
jmp 0x1404d9d67
cmovne rcx, rdi
sub r9d, r9d
jmp 0x1404d9d76
sub edx, edx
jmp 0x1404d9d7d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1404d9db7
mov r9, r12
movzx rcx, dx
cmp r15, 0x416f6706
sub r8d, r8d
sub edx, edx
mov rcx, rsi
jmp 0x1404d9dab
call fcn.1404d9703
mov edi, eax
jmp 0x1404da03f
mov r14, qword [r12 + 8]
btc ecx, r11d
add ch, ch
sub r14, qword [r12]
bt rcx, rbx
sub cx, 0x769a
sar r14, 3
shl ecx, 0x4a
sub edx, edx
mov qword [rsp + 0x70], rdi
bswap cx
lea rcx, [rsp + 0x50]
jmp 0x1404d9dea
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
jmp 0x1404d9df8
mov qword [rbp - 0x78], rdi
jmp 0x1404d9e01
mov qword [rbp - 0x70], rdi
jmp 0x1404d9e0a
mov byte [rbp - 0x68], dil
jmp 0x1404d9e13
call fcn.1404a5fcd
mov rax, qword [rsp + 0x58]
jmp 0x1404d9e22
cmp dword [rax + 0xc], r15d
jmp 0x1404d9e2b
jne 0x1404d9e5d
cmp byte [rsp + 0x68], dil
jmp 0x1404d9e3b
je 0x1404d9e50
mov rax, qword [rsp + 0x50]
and r8b, r9b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d9e58
jmp 0x1404d9ed1
call fcn.1404cbbe4
test eax, eax
jne 0x1404d9e9c
cmp byte [rsp + 0x68], dil
jmp 0x1404d9e74
je 0x1404d9e91
mov rax, qword [rsp + 0x50]
neg r8w
movzx r8d, r8w
and dword [rax + 0x3a8], 0xfffffffd
mov r8b, 2
mov r8d, 1
jmp 0x1404d9ed1
cmp byte [rsp + 0x68], dil
je 0x1404d9ec3
mov rax, qword [rsp + 0x50]
movsx cx, cl
and r8b, r11b
mov cx, 0x4944
and dword [rax + 0x3a8], 0xfffffffd
movsx dx, r8b
mov r8d, edi
movzx rdx, r11w
movzx cx, r13b
cqo
lea rdx, [rsp + 0x70]
xchg ecx, ecx
movsx cx, dh
lea rcx, [rbp - 4]
call fcn.1404d8fd3
mov r15, qword [rbp - 0x80]
btc rcx, 0x7f
shl ecx, cl
shld cx, dx, 0x3c
test eax, eax
not rcx
movsx rcx, r15w
mov cl, r15b
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d9f10
jne 0x1404d9f43
mov al, byte [rcx + 1]
cmp r10b, r9b
test r9b, dl
test al, al
jmp 0x1404d9f26
je 0x1404d9f82
cmp al, 0x2e
jmp 0x1404d9f33
jne 0x1404d9f43
cmp byte [rcx + 2], dil
je 0x1404d9f82
mov r9, r12
cwd
movsx rdx, bp
movzx r8, ax
mov r8, r13
cwd
mov rdx, rsi
jmp 0x1404d9f5d
call fcn.1404d9703
mov edi, eax
jmp 0x1404d9f6c
test eax, eax
jmp 0x1404d9f73
jne 0x1404da01a
sub edi, edi
cmp r9d, 0x3f131a2d
cmp byte [rbp - 0x68], dil
jmp 0x1404d9f8b
je 0x1404d9f9e
mov rcx, r15
jmp 0x1404d9f99
call fcn.1404caa97
lea rdx, [rbp - 0x30]
mov cl, bpl
mov rcx, rbx
jmp 0x1404d9fad
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmc
test eax, eax
jmp 0x1404d9fc1
jne 0x1404d9dd6
mov rax, qword [r12]
cdq
setg dh
mov rdx, qword [r12 + 8]
sub rdx, rax
test ebx, 0x1c7169f
clc
sar rdx, 3
cmp r14, rdx
jmp 0x1404d9fea
je 0x1404da036
sub rdx, r14
lea rcx, [rax + r14*8]
lea r9, [0x1400acc8c]
movsx r8, sp
bswap r8d
mov r8d, 8
jmp 0x1404da010
call fcn.1404e5e97
jmp 0x1404da036
cmp byte [rbp - 0x68], 0
jmp 0x1404da023
je 0x1404da036
mov rcx, r15
jmp 0x1404da031
call fcn.1404caa97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404da048
je 0x1404da05c
mov rcx, qword [rbp - 0x50]
jmp 0x1404da057
call fcn.1404caa97
mov eax, edi
mov rcx, qword [rbp + 0x220]
test r10b, 0x96
cmp sp, 0x6500
xor rcx, rsp
jmp 0x1404da076
call fcn.1404a1418
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
movzx rbp, si
pop r15
mov sil, r14b
mov sil, 0xae
pop r14
pop r13
movzx ebp, r12w
xchg si, di
cmovno r12, r14
pop r12
pop rdi
pop rsi
movsx rbp, sp
pop rbp
jmp 0x1404da0b3
ret