Function at 0x1404cf638
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
test ch, 0xd5
push rsi
bswap bx
push rdi
push r12
push r13
sal bp, cl
push r14
xor al, r12b
bts rbx, r11
push r15
test r10b, cl
lea rbp, [rsp - 0x230]
sub rsp, 0x330
rol esi, cl
mov rax, qword [0x1400b7288]
xor rax, rsp
rol bl, cl
mov qword [rbp + 0x220], rax
movsx r12w, bl
xadd sil, r12b
mov r12, r8
rol rsi, cl
clc
adc ebx, 0x7532e21
mov rsi, rcx
rcl bl, cl
xor ebx, 0xf004cf9
movabs rbx, 0x200000000801
cmc
cmp rdx, rcx
jmp 0x1404cf6b3
je 0x1404cf6fa
mov al, byte [rdx]
sub al, 0x2f
cmp sil, r10b
cmp al, 0x2d
ja 0x1404cf6dc
movsx rax, al
clc
bt rbx, rax
jmp 0x1404cf6d6
jb 0x1404cf6fa
mov rcx, rsi
jmp 0x1404cf6e4
call fcn.1400ef4be
mov rdx, rax
cmp rax, rsi
jmp 0x1404cf6f4
jne 0x1404cf6b9
mov r8b, byte [rdx]
stc
test r12w, 0x51cd
cmp r8b, 0x3a
jne 0x1404cf745
lea rax, [rsi + 1]
stc
test r9b, r12b
cmp dh, 0x57
cmp rdx, rax
je 0x1404cf745
mov r9, r12
mov cx, 0x374a
xor r8d, r8d
shl ch, cl
xor edx, edx
setne ch
mov rcx, rsi
jmp 0x1404cf73b
call fcn.1404cf334
jmp 0x1404cfbd5
sub r8b, 0x2f
test r8b, bpl
sub edi, edi
cmp r8b, 0x2d
jmp 0x1404cf757
ja 0x1404cf772
movsx rax, r8b
bt rbx, rax
mov al, 1
jmp 0x1404cf76c
jb 0x1404cf783
mov al, dil
btr rcx, rdx
or rcx, 0x28b10fed
shr cx, cl
sub rdx, rsi
mov qword [rbp - 0x60], rdi
movsx cx, r15b
setb cl
bswap cx
inc rdx
bsr ecx, r14d
mov qword [rbp - 0x58], rdi
cmp eax, r15d
cmc
neg al
mov qword [rbp - 0x50], rdi
bswap rcx
lea rcx, [rsp + 0x30]
jmp 0x1404cf7b7
mov qword [rbp - 0x48], rdi
jmp 0x1404cf7c0
sbb r13, r13
mov qword [rbp - 0x40], rdi
cmc
and r13, rdx
clc
test r8b, 0xcd
mov byte [rbp - 0x38], dil
test bpl, 0x48
sub edx, edx
call fcn.14049b98c
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmc
cmp r12d, r10d
cmp dword [rax + 0xc], r15d
jmp 0x1404cf7f7
jne 0x1404cf82d
cmp byte [rsp + 0x48], dil
jmp 0x1404cf807
je 0x1404cf825
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, r15b
xchg r8b, r8b
setne r8b
mov r8d, r15d
jmp 0x1404cf89b
call fcn.1404c17ad
test eax, eax
jmp 0x1404cf839
jne 0x1404cf869
cmp byte [rsp + 0x48], dil
je 0x1404cf859
mov rax, qword [rsp + 0x30]
neg r8b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404cf864
jmp 0x1404cf89b
cmp byte [rsp + 0x48], dil
jmp 0x1404cf873
je 0x1404cf892
mov rax, qword [rsp + 0x30]
sar dh, cl
sal cx, 0xdf
and dword [rax + 0x3a8], 0xfffffffd
setbe cl
movsx edx, r8w
mov r8d, edi
setno ch
mov ch, 0x2d
lea rdx, [rbp - 0x60]
movsxd rcx, ecx
mov rcx, rsi
jmp 0x1404cf8aa
call fcn.14049c3b2
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
test eax, eax
jmp 0x1404cf8be
mov dword [rsp + 0x28], edi
jmp 0x1404cf8c7
mov qword [rsp + 0x20], rdi
jmp 0x1404cf8d1
cmovne rcx, rdi
stc
test cx, 0x653a
clc
sub r9d, r9d
cmc
cmp bpl, bl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmc
cmp rax, 0xffffffffffffffff
jmp 0x1404cf8f8
jne 0x1404cf934
mov r9, r12
and cx, 0x685a
mov ch, 0x44
sub r8d, r8d
btc rcx, 0xf8
movsxd rcx, r15d
sub edx, edx
movzx rcx, r13w
setnp ch
movsx ecx, sp
mov rcx, rsi
jmp 0x1404cf928
call fcn.1404cf334
mov edi, eax
jmp 0x1404cfbb6
mov r14, qword [r12 + 8]
ror ecx, cl
shrd rcx, r15, 0x83
bts rcx, r10
sub r14, qword [r12]
sbb ecx, r13d
sar r14, 3
movsxd rcx, eax
xor edx, edx
bswap rcx
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
jmp 0x1404cf966
mov qword [rsp + 0x78], rdi
jmp 0x1404cf970
mov qword [rbp - 0x80], rdi
jmp 0x1404cf979
mov qword [rbp - 0x78], rdi
jmp 0x1404cf982
mov qword [rbp - 0x70], rdi
jmp 0x1404cf98b
mov byte [rbp - 0x68], dil
jmp 0x1404cf994
call fcn.14049b98c
mov rax, qword [rsp + 0x58]
cmp bp, di
cmp dword [rax + 0xc], r15d
jmp 0x1404cf9aa
jne 0x1404cf9d4
cmp byte [rsp + 0x68], dil
jmp 0x1404cf9ba
je 0x1404cf9cc
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404cfa36
call fcn.1404c17ad
test eax, eax
jmp 0x1404cf9e0
jne 0x1404cfa1a
cmp byte [rsp + 0x68], dil
jmp 0x1404cf9f0
je 0x1404cfa0a
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, r15b
not r8b
mov r8d, 1
jmp 0x1404cfa15
jmp 0x1404cfa36
cmp byte [rsp + 0x68], dil
je 0x1404cfa33
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov ecx, edx
mov r8d, edi
lea rdx, [rsp + 0x70]
movzx rcx, ax
lea rcx, [rbp - 4]
jmp 0x1404cfa48
call fcn.1404cebf9
mov r15, qword [rbp - 0x80]
test eax, eax
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404cfa62
jne 0x1404cfa8b
mov al, byte [rcx + 1]
stc
test al, al
jmp 0x1404cfa73
je 0x1404cfac8
cmp al, 0x2e
jne 0x1404cfa8b
cmp byte [rcx + 2], dil
je 0x1404cfac8
mov r9, r12
mov dl, 3
xchg dh, dh
movsx rdx, dx
mov r8, r13
cwd
bswap dx
cqo
mov rdx, rsi
jmp 0x1404cfaa8
call fcn.1404cf334
mov edi, eax
test bl, 0x8e
cmp r13d, esp
test eax, eax
jmp 0x1404cfabc
jne 0x1404cfb8c
sub edi, edi
test bpl, 0x8e
cmp byte [rbp - 0x68], dil
jmp 0x1404cfad1
je 0x1404cfae4
mov rcx, r15
jmp 0x1404cfadf
call fcn.1404c061b
lea rdx, [rbp - 0x30]
setns cl
bswap ecx
mov ch, 0x22
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
jmp 0x1404cfb06
test eax, eax
jmp 0x1404cfb0d
jne 0x1404cf952
mov rax, qword [r12]
xchg dx, dx
rol dx, cl
bt dx, sp
mov rdx, qword [r12 + 8]
cmc
clc
sub rdx, rax
sar rdx, 3
cmp di, 0x468e
jmp 0x1404cfb39
cmp r14, rdx
jmp 0x1404cfb41
je 0x1404cfba8
sub rdx, r14
jmp 0x1404cfb56
lea rcx, [rax + r14*8]
movzx r8d, r12w
setp r8b
xchg r9, r9
lea r9, [0x1400acc8c]
not r8
jmp 0x1404cfb77
mov r8d, 8
jmp 0x1404cfb82
call fcn.1404db889
jmp 0x1404cfba8
cmp byte [rbp - 0x68], 0
jmp 0x1404cfb95
je 0x1404cfba8
mov rcx, r15
jmp 0x1404cfba3
call fcn.1404c061b
mov rcx, rbx
jmp 0x1404cfbb0
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404cfbbf
je 0x1404cfbd3
mov rcx, qword [rbp - 0x50]
jmp 0x1404cfbce
call fcn.1404c061b
mov eax, edi
mov rcx, qword [rbp + 0x220]
cmp dl, 0x12
xor rcx, rsp
jmp 0x1404cfbe7
call fcn.140496cc6
mov rbx, qword [rsp + 0x388]
dec di
add rsp, 0x330
pop r15
mov r13b, 0x4d
movsxd r13, ebp
movzx r13, dx
pop r14
bswap edi
mov si, r8w
not r13d
pop r13
sete sil
movzx r12, r10w
movsx si, r10b
pop r12
movzx esi, cx
pop rdi
movzx ebp, r13w
pop rsi
xchg bp, bp
movzx bp, cl
not bpl
pop rbp
jmp 0x1404cfc3f
ret