Function at 0x1404d5b75
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
cwde
movsx rbx, r13w
xchg bh, bh
push rbp
and eax, ecx
rcl eax, 0xbe
adc bpl, 0xa
push rsi
btc rsi, rcx
push rdi
push r12
ror ax, cl
rcl r12w, 0x15
shl bpl, 0x82
push r13
shr bp, 0x80
push r14
lahf
rol sil, cl
push r15
lea rbp, [rsp - 0x230]
lahf
cmovno rsi, rax
sub rsp, 0x330
shl r12w, cl
rol bx, cl
movsx esi, r15w
mov rax, qword [0x1400b7288]
and r12w, r10w
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r12, r8
mov rsi, rcx
ror bx, cl
stc
btr bx, 0xa2
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d5c02
je 0x1404d5c5f
mov al, byte [rdx]
jmp 0x1404d5c0f
sub al, 0x2f
cmc
cmp r9, r9
cmp al, 0x2d
jmp 0x1404d5c1c
ja 0x1404d5c3b
movsx rax, al
jmp 0x1404d5c2c
bt rbx, rax
jmp 0x1404d5c35
jb 0x1404d5c5f
mov rcx, rsi
jmp 0x1404d5c43
call fcn.14020fb14
mov rdx, rax
stc
jmp 0x1404d5c51
cmp rax, rsi
jmp 0x1404d5c59
jne 0x1404d5c08
mov r8b, byte [rdx]
cmp ch, 0xfe
test r11b, cl
stc
cmp r8b, 0x3a
jmp 0x1404d5c72
jne 0x1404d5cb4
lea rax, [rsi + 1]
cmp rdx, rax
jmp 0x1404d5c84
je 0x1404d5cb4
mov r9, r12
ror ch, cl
mov ch, 0xea
btc cx, r15w
xor r8d, r8d
xor edx, edx
jmp 0x1404d5ca7
mov rcx, rsi
call fcn.1404d583b
jmp 0x1404d6170
sub r8b, 0x2f
test r8b, r13b
xor edi, edi
cmp r10w, 0x5f0c
cmp r8b, 0x2d
jmp 0x1404d5ccc
ja 0x1404d5ce9
movsx rax, r8b
clc
cmc
bt rbx, rax
mov al, 1
jmp 0x1404d5ce3
jb 0x1404d5cec
mov al, dil
sub rdx, rsi
mov qword [rbp - 0x60], rdi
movsxd rcx, ebx
cmovb cx, r10w
movsx rcx, ax
inc rdx
setne ch
rcr cx, cl
mov qword [rbp - 0x58], rdi
neg al
dec cl
not cx
movsx ecx, cx
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404d5d24
mov qword [rbp - 0x48], rdi
jmp 0x1404d5d2d
sbb r13, r13
clc
mov qword [rbp - 0x40], rdi
test r11w, si
and r13, rdx
test r8b, spl
mov byte [rbp - 0x38], dil
jmp 0x1404d5d4b
sub edx, edx
jmp 0x1404d5d52
call fcn.1404a1f46
mov rax, qword [rsp + 0x38]
xor r15, r14
adc r15b, 0x78
and r15d, ebx
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jne 0x1404d5dac
cmp byte [rsp + 0x48], dil
jmp 0x1404d5d80
je 0x1404d5d9f
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d5d9f
mov r8d, r15d
jmp 0x1404d5da7
jmp 0x1404d5e1c
call fcn.1404c7d03
test eax, eax
jmp 0x1404d5db8
jne 0x1404d5dea
cmp byte [rsp + 0x48], dil
jmp 0x1404d5dc8
je 0x1404d5dda
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404d5de5
jmp 0x1404d5e1c
cmp byte [rsp + 0x48], dil
jmp 0x1404d5df4
je 0x1404d5e0d
mov rax, qword [rsp + 0x30]
cdq
rcr dl, cl
ror r8w, cl
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
movzx dx, r9b
movsx rdx, si
bswap cx
lea rdx, [rbp - 0x60]
not cl
mov rcx, rsi
jmp 0x1404d5e2a
call fcn.1404a29b5
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
test r11, rsi
test eax, eax
jmp 0x1404d5e41
mov dword [rsp + 0x28], edi
jmp 0x1404d5e4a
mov qword [rsp + 0x20], rdi
jmp 0x1404d5e54
cmovne rcx, rdi
sub r9d, r9d
test bl, r9b
xor edx, edx
jmp 0x1404d5e65
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
test rax, 0x395f6e14
cmp rax, 0xffffffffffffffff
jmp 0x1404d5e7d
jne 0x1404d5eac
mov r9, r12
rcl ch, cl
xor r8d, r8d
sub edx, edx
movsx ecx, r9w
movzx cx, r13b
not cl
mov rcx, rsi
call fcn.1404d583b
mov edi, eax
jmp 0x1404d5ea7
jmp 0x1404d6156
mov r14, qword [r12 + 8]
bt cx, 0xc4
btc rcx, 0
and rcx, 0x7b4b41a5
sub r14, qword [r12]
sar r14, 3
clc
sub edx, edx
cmovle cx, r12w
mov ch, 2
mov qword [rsp + 0x70], rdi
mov ch, 0xf6
lea rcx, [rsp + 0x50]
jmp 0x1404d5ee7
mov qword [rsp + 0x78], rdi
jmp 0x1404d5ef1
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
jmp 0x1404d5efe
mov qword [rbp - 0x70], rdi
jmp 0x1404d5f07
mov byte [rbp - 0x68], dil
jmp 0x1404d5f10
call fcn.1404a1f46
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0xc], r15d
jmp 0x1404d5f23
jne 0x1404d5f5f
cmp byte [rsp + 0x68], dil
jmp 0x1404d5f33
je 0x1404d5f52
mov rax, qword [rsp + 0x50]
or r8b, r11b
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d5f52
mov r8d, r15d
jmp 0x1404d5f5a
jmp 0x1404d5fd8
call fcn.1404c7d03
test eax, eax
jne 0x1404d5fa0
cmp byte [rsp + 0x68], dil
jmp 0x1404d5f76
je 0x1404d5f90
mov rax, qword [rsp + 0x50]
bsf r8, r12
and dword [rax + 0x3a8], 0xfffffffd
setg r8b
mov r8d, 1
jmp 0x1404d5f9b
jmp 0x1404d5fd8
cmp byte [rsp + 0x68], dil
jmp 0x1404d5faa
je 0x1404d5fc8
mov rax, qword [rsp + 0x50]
jmp 0x1404d5fba
and dword [rax + 0x3a8], 0xfffffffd
cqo
cwd
bswap rcx
mov r8d, edi
movsx cx, r13b
mov dh, 0xfb
jmp 0x1404d5fd8
lea rdx, [rsp + 0x70]
mov cx, 0x2f01
mov ecx, r10d
lea rcx, [rbp - 4]
jmp 0x1404d5fed
call fcn.1404d50f7
mov r15, qword [rbp - 0x80]
movsx ecx, r8w
test eax, eax
mov rcx, r15
jmp 0x1404d6004
cmovne rcx, rdi
test dl, 0x70
stc
cmp byte [rcx], 0x2e
jmp 0x1404d6014
jne 0x1404d6046
mov al, byte [rcx + 1]
test al, al
jmp 0x1404d6024
je 0x1404d6085
cmp al, 0x2e
jmp 0x1404d6031
jne 0x1404d6046
cmp byte [rcx + 2], dil
jmp 0x1404d6040
je 0x1404d6085
mov r9, r12
movzx edx, bx
movsx edx, r11w
mov r8, r13
movzx dx, dil
mov dl, ah
setp dh
mov rdx, rsi
jmp 0x1404d6065
call fcn.1404d583b
mov edi, eax
jmp 0x1404d6072
test eax, eax
jmp 0x1404d6079
jne 0x1404d6136
xor edi, edi
test r13w, cx
cmp byte [rbp - 0x68], dil
jmp 0x1404d608e
je 0x1404d60a1
mov rcx, r15
jmp 0x1404d609c
call fcn.1404c6c19
lea rdx, [rbp - 0x30]
movsx ecx, bp
movzx cx, dil
movzx ecx, bp
mov rcx, rbx
jmp 0x1404d60b8
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jmp 0x1404d60cb
jne 0x1404d5ecb
mov rax, qword [r12]
cmc
mov rdx, qword [r12 + 8]
jmp 0x1404d60e3
sub rdx, rax
cmc
sar rdx, 3
stc
cmp r14, rdx
jmp 0x1404d60f4
je 0x1404d614d
sub rdx, r14
movsxd rcx, r12d
cmovns cx, r11w
lea rcx, [rax + r14*8]
jmp 0x1404d610e
lea r9, [0x1400acc8c]
movsx r8d, r11w
cmovbe r8d, ecx
movzx r8d, cx
mov r8d, 8
jmp 0x1404d612c
call fcn.1404e1e88
jmp 0x1404d614d
cmp byte [rbp - 0x68], 0
je 0x1404d614d
mov rcx, r15
jmp 0x1404d6148
call fcn.1404c6c19
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404d616e
mov rcx, qword [rbp - 0x50]
jmp 0x1404d6169
call fcn.1404c6c19
mov eax, edi
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14049d217
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
cmovo r13w, cx
movsx r12w, r10b
movsx r14d, r8w
pop r14
pop r13
not sil
pop r12
pop rdi
movsxd rsi, r9d
setl bpl
movsx rsi, r15w
pop rsi
movsx rbp, sp
bswap rbp
pop rbp
jmp 0x1404d61c1
ret