Function at 0x1404dc80d
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
rol bl, 0xf0
and al, spl
push rbp
shld ax, r8w, 0
push rsi
bswap rbx
sub ax, r12w
shl rbp, cl
push rdi
and ah, 0x86
shr bp, cl
push r12
bts si, ax
not sil
bts si, r11w
push r13
sete r12b
push r14
test bp, 0x149b
cmc
push r15
test cl, 0x75
lea rbp, [rsp - 0x230]
btr bx, 0xaf
sub rsp, 0x330
mov rax, qword [0x1400b7288]
inc r12b
xor rax, rsp
rcl r12, 0x34
sbb r12w, sp
bsf bx, cx
mov qword [rbp + 0x220], rax
mov r12, r8
mov rsi, rcx
cmp r12w, r13w
rcl bl, cl
bts bx, r8w
movabs rbx, 0x200000000801
cmc
cmp rdx, rcx
jmp 0x1404dc8aa
je 0x1404dc8ec
mov al, byte [rdx]
sub al, 0x2f
cmp r11b, r8b
cmp al, 0x2d
ja 0x1404dc8cd
movsx rax, al
bt rbx, rax
jb 0x1404dc8ec
mov rcx, rsi
jmp 0x1404dc8d5
call fcn.14027d616
mov rdx, rax
cmc
cmp rax, rsi
jmp 0x1404dc8e6
jne 0x1404dc8b0
mov r8b, byte [rdx]
clc
cmp r8b, 0x3a
jne 0x1404dc93c
lea rax, [rsi + 1]
test cl, 0x60
clc
cmp sil, 0x71
cmp rdx, rax
jmp 0x1404dc90e
je 0x1404dc93c
mov r9, r12
btc cx, r9w
xor r8d, r8d
setno cl
not ecx
xor edx, edx
cmovne cx, r9w
mov cl, 0
not ecx
mov rcx, rsi
call fcn.1404dc49b
jmp 0x1404dcddb
sub r8b, 0x2f
cmp r9w, ax
cmp bp, 0x7a87
xor edi, edi
test r11b, r13b
cmp edi, edi
cmp r8b, 0x2d
jmp 0x1404dc959
ja 0x1404dc97b
movsx rax, r8b
bt rbx, rax
mov al, al
jmp 0x1404dc96e
mov al, 1
jmp 0x1404dc975
jb 0x1404dc987
mov al, dil
sbb cl, 0x11
sal ecx, 0x16
rcl cx, cl
sub rdx, rsi
xchg ch, cl
mov qword [rbp - 0x60], rdi
inc rdx
mov qword [rbp - 0x58], rdi
neg al
sets ch
inc rcx
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404dc9ad
mov qword [rbp - 0x48], rdi
jmp 0x1404dc9b6
sbb r13, r13
jmp 0x1404dc9c0
mov qword [rbp - 0x40], rdi
cmp r15d, ecx
and r13, rdx
mov byte [rbp - 0x38], dil
jmp 0x1404dc9d3
sub edx, edx
jmp 0x1404dc9da
call fcn.1404a8900
mov rax, qword [rsp + 0x38]
shr r15d, cl
sar r15b, cl
mov r15d, 0xfde9
cmc
test r9b, 0x9c
jmp 0x1404dc9fa
cmp dword [rax + 0xc], r15d
jne 0x1404dca36
cmp byte [rsp + 0x48], dil
je 0x1404dca29
mov rax, qword [rsp + 0x30]
mov r8w, bp
shr r8, cl
and dword [rax + 0x3a8], 0xfffffffd
movsxd r8, r9d
setbe r8b
mov r8d, r15d
jmp 0x1404dca31
jmp 0x1404dca8c
call fcn.1404ce81b
test eax, eax
jmp 0x1404dca42
jne 0x1404dca6d
cmp byte [rsp + 0x48], dil
je 0x1404dca62
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
movsxd r8, r15d
mov r8d, 1
jmp 0x1404dca8c
cmp byte [rsp + 0x48], dil
jmp 0x1404dca77
je 0x1404dca89
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rbp - 0x60]
xchg rcx, rcx
mov rcx, rsi
call fcn.1404a9310
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
cmp r14b, r11b
test eax, eax
jmp 0x1404dcaad
mov dword [rsp + 0x28], edi
jmp 0x1404dcab6
mov qword [rsp + 0x20], rdi
jmp 0x1404dcac0
cmovne rcx, rdi
xor r9d, r9d
clc
sub edx, edx
jmp 0x1404dcacf
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp al, 0x47
clc
cmp rax, 0xffffffffffffffff
jmp 0x1404dcae4
jne 0x1404dcb22
mov r9, r12
sub cx, 0x71e2
btr ecx, 0x1f
sub r8d, r8d
not cl
adc cx, r13w
shr cl, 0
xor edx, edx
not ch
movsxd rcx, r8d
mov rcx, rsi
jmp 0x1404dcb11
call fcn.1404dc49b
mov edi, eax
jmp 0x1404dcb1d
jmp 0x1404dcdbc
mov r14, qword [r12 + 8]
shr ecx, 0xca
or cl, r12b
xchg cl, cl
sub r14, qword [r12]
movsx ecx, cx
movzx rcx, sp
sar r14, 3
test r9w, r15w
rcr ch, cl
btr cx, r8w
sub edx, edx
movsx cx, spl
movzx cx, spl
mov qword [rsp + 0x70], rdi
movsx ecx, r12w
movzx rcx, r15w
movsxd rcx, edi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
jmp 0x1404dcb74
mov qword [rbp - 0x80], rdi
jmp 0x1404dcb7d
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404dcb8a
mov byte [rbp - 0x68], dil
jmp 0x1404dcb93
call fcn.1404a8900
mov rax, qword [rsp + 0x58]
cmc
jmp 0x1404dcba3
cmp dword [rax + 0xc], r15d
jne 0x1404dcbdd
cmp byte [rsp + 0x68], dil
jmp 0x1404dcbb7
je 0x1404dcbd5
mov rax, qword [rsp + 0x50]
add r8b, r9b
shrd r8w, bp, 0x86
mov r8b, bl
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404dcc5d
call fcn.1404ce81b
test eax, eax
jmp 0x1404dcbe9
jne 0x1404dcc2a
cmp byte [rsp + 0x68], dil
jmp 0x1404dcbf9
je 0x1404dcc1a
mov rax, qword [rsp + 0x50]
ror r8b, cl
movsx r8, r10w
movzx r8, ax
and dword [rax + 0x3a8], 0xfffffffd
movsx r8d, r12w
mov r8d, 1
jmp 0x1404dcc25
jmp 0x1404dcc5d
cmp byte [rsp + 0x68], dil
jmp 0x1404dcc34
je 0x1404dcc50
mov rax, qword [rsp + 0x50]
adc cx, bp
movzx r8w, r14b
and dword [rax + 0x3a8], 0xfffffffd
cqo
mov r8d, edi
movzx cx, r11b
movzx ecx, r15w
cdq
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 4]
call fcn.1404dbd0c
mov r15, qword [rbp - 0x80]
rol cl, cl
test eax, eax
movsxd rcx, r14d
mov ecx, 0x1aff7311
mov ecx, esp
mov rcx, r15
jmp 0x1404dcc85
cmovne rcx, rdi
cmp edi, esp
jmp 0x1404dcc91
cmp byte [rcx], 0x2e
jmp 0x1404dcc99
jne 0x1404dcccf
mov al, byte [rcx + 1]
test rdx, r11
cmc
test al, al
jmp 0x1404dccad
je 0x1404dcd00
cmp al, 0x2e
jmp 0x1404dccba
jne 0x1404dcccf
cmp byte [rcx + 2], dil
jmp 0x1404dccc9
je 0x1404dcd00
mov r9, r12
not dx
mov r8, r13
bswap dx
not dh
mov rdx, rsi
call fcn.1404dc49b
mov edi, eax
test r9w, 0x6c28
cmp spl, r11b
test eax, eax
jmp 0x1404dccf7
jne 0x1404dcd9c
xor edi, edi
clc
cmp byte [rbp - 0x68], dil
je 0x1404dcd17
mov rcx, r15
jmp 0x1404dcd12
call fcn.1404cd66f
lea rdx, [rbp - 0x30]
xchg ecx, ecx
movzx ecx, r10w
movsx rcx, r12w
mov rcx, rbx
jmp 0x1404dcd2d
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jne 0x1404dcb49
mov rax, qword [r12]
bswap dx
movzx edx, si
xor dh, 0x5b
mov rdx, qword [r12 + 8]
sub rdx, rax
test bp, r8w
sar rdx, 3
test rdx, rax
cmp r14, rdx
je 0x1404dcdb3
sub rdx, r14
lea rcx, [rax + r14*8]
movsx r9w, r13b
mov r8w, 0xd73
movzx r8w, r9b
lea r9, [0x1400acc8c]
jmp 0x1404dcd8c
mov r8d, 8
call fcn.1404e8c00
jmp 0x1404dcdb3
cmp byte [rbp - 0x68], 0
jmp 0x1404dcda5
je 0x1404dcdb3
mov rcx, r15
call fcn.1404cd66f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404dcdc5
je 0x1404dcdd9
mov rcx, qword [rbp - 0x50]
jmp 0x1404dcdd4
call fcn.1404cd66f
mov eax, edi
mov rcx, qword [rbp + 0x220]
cmp rsi, 0x5944a31
stc
jmp 0x1404dcdef
xor rcx, rsp
call fcn.1404a3d69
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
movzx r12d, r15w
mov bp, r14w
pop r14
pop r13
pop r12
movzx di, bl
pop rdi
pop rsi
movzx rbp, bx
mov bp, 0x24a4
movsxd rbp, eax
pop rbp
jmp 0x1404dce2d
ret