Function at 0x1404d7dde
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
movzx eax, cx
push rbp
push rsi
push rdi
push r12
shrd bp, r14w, 0x72
sar ax, 0x49
push r13
test dil, al
bsr r12, rsi
push r14
push r15
setp bpl
ror bx, 0xc9
cmc
lea rbp, [rsp - 0x230]
btc bx, 0x45
add r12, 0x6a1824d5
sub rsp, 0x330
rcl r12d, 0x8c
mov rax, qword [0x1400b7288]
btr r12, 0x77
xor rax, rsp
sal bh, cl
mov qword [rbp + 0x220], rax
sal r12, 0xc7
cmc
mov r12, r8
bts ebx, edi
mov rsi, rcx
sub bx, 0x6842
movabs rbx, 0x200000000801
cmp r13b, r11b
clc
cmp r12b, 0x39
cmp rdx, rcx
jmp 0x1404d7e6f
je 0x1404d7ebd
mov al, byte [rdx]
test spl, sil
cmc
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404d7e84
ja 0x1404d7e9d
movsx rax, al
bt rbx, rax
jmp 0x1404d7e97
jb 0x1404d7ebd
mov rcx, rsi
jmp 0x1404d7ea5
call fcn.1401c19f3
mov rdx, rax
stc
cmc
cmp rax, rsi
jmp 0x1404d7eb7
jne 0x1404d7e75
mov r8b, byte [rdx]
cmp r8b, 0x3a
jmp 0x1404d7ec9
jne 0x1404d7f11
lea rax, [rsi + 1]
cmp rdx, rax
jmp 0x1404d7edb
je 0x1404d7f11
mov r9, r12
jmp 0x1404d7eec
sub r8d, r8d
rcl ch, 0xed
test bpl, 0x3c
sub edx, edx
cmovnp ecx, r14d
movsxd rcx, r8d
movzx cx, spl
mov rcx, rsi
call fcn.1404d7a91
jmp 0x1404d83c1
sub r8b, 0x2f
jmp 0x1404d7f1e
xor edi, edi
cmp sp, 0x2d20
test r11w, 0x4417
cmp r8b, 0x2d
jmp 0x1404d7f34
ja 0x1404d7f54
movsx rax, r8b
bt rbx, rax
jmp 0x1404d7f47
mov al, 1
jmp 0x1404d7f4e
jb 0x1404d7f59
mov al, dil
dec cl
sub rdx, rsi
cmovbe cx, dx
mov qword [rbp - 0x60], rdi
bswap cx
movsxd rcx, r10d
inc rdx
mov qword [rbp - 0x58], rdi
neg al
setae ch
movzx rcx, r12w
mov rcx, 0x73bd0e75
mov qword [rbp - 0x50], rdi
dec ecx
mov ecx, 0x5da130f4
movsxd rcx, esp
lea rcx, [rsp + 0x30]
jmp 0x1404d7f99
mov qword [rbp - 0x48], rdi
jmp 0x1404d7fa2
sbb r13, r13
mov qword [rbp - 0x40], rdi
clc
and r13, rdx
test r13b, dl
mov byte [rbp - 0x38], dil
cmc
xor edx, edx
jmp 0x1404d7fbc
call fcn.1404a41ae
mov rax, qword [rsp + 0x38]
neg r15w
cmovge r15w, r13w
jmp 0x1404d7fd4
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d7fe3
jne 0x1404d801a
cmp byte [rsp + 0x48], dil
jmp 0x1404d7ff3
je 0x1404d800d
mov rax, qword [rsp + 0x30]
bsr r8, r11
cmovne r8d, eax
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x1404d8015
jmp 0x1404d808c
call fcn.1404ca139
test eax, eax
jne 0x1404d805b
cmp byte [rsp + 0x48], dil
je 0x1404d804b
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8w, 0x615b
bswap r8w
movzx r8d, r15w
mov r8d, 1
jmp 0x1404d8056
jmp 0x1404d808c
cmp byte [rsp + 0x48], dil
je 0x1404d8082
mov rax, qword [rsp + 0x30]
mov dx, dx
cmp r12b, 0x85
and dword [rax + 0x3a8], 0xfffffffd
bswap cx
movsx ecx, r15w
cqo
mov r8d, edi
movsx rcx, bp
mov dl, r11b
lea rdx, [rbp - 0x60]
mov ch, 0x12
mov rcx, rsi
jmp 0x1404d809b
call fcn.1404a4bd2
mov rcx, qword [rbp - 0x50]
btr r8d, r13d
jmp 0x1404d80b1
lea r8, [rbp - 0x30]
cmc
cmp r14w, 0x669
test eax, eax
jmp 0x1404d80c3
mov dword [rsp + 0x28], edi
jmp 0x1404d80cc
mov qword [rsp + 0x20], rdi
jmp 0x1404d80d6
cmovne rcx, rdi
sub r9d, r9d
cmp bpl, bl
sub edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1404d8120
mov r9, r12
bsf cx, r9w
test al, 6
bt cx, di
sub r8d, r8d
sub edx, edx
movsx ecx, r8w
mov rcx, rsi
jmp 0x1404d8114
call fcn.1404d7a91
mov edi, eax
jmp 0x1404d83a2
mov r14, qword [r12 + 8]
movsx cx, al
or cl, r8b
sub r14, qword [r12]
sar r14, 3
mov ch, cl
cmp dil, r8b
sub edx, edx
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
jmp 0x1404d8157
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
jmp 0x1404d8164
call fcn.1404a41ae
mov rax, qword [rsp + 0x58]
cmp r8b, 0xd9
cmp dword [rax + 0xc], r15d
jmp 0x1404d817b
jne 0x1404d81b3
cmp byte [rsp + 0x68], dil
jmp 0x1404d818b
je 0x1404d81ab
mov rax, qword [rsp + 0x50]
ror r8b, cl
sar r8d, cl
and dword [rax + 0x3a8], 0xfffffffd
xchg r8, r8
movsx r8w, r15b
mov r8d, r15d
jmp 0x1404d822c
call fcn.1404ca139
test eax, eax
jmp 0x1404d81bf
jne 0x1404d8203
cmp byte [rsp + 0x68], dil
jmp 0x1404d81cf
je 0x1404d81f3
mov rax, qword [rsp + 0x50]
test bx, 0x10ba
movsx r8w, sil
or r8b, bpl
and dword [rax + 0x3a8], 0xfffffffd
movzx r8w, r9b
mov r8d, 1
jmp 0x1404d81fe
jmp 0x1404d822c
cmp byte [rsp + 0x68], dil
jmp 0x1404d820d
je 0x1404d821f
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
mov dl, r8b
setle dl
movsx rdx, r13w
lea rdx, [rsp + 0x70]
movsx cx, r13b
lea rcx, [rbp - 4]
jmp 0x1404d823f
call fcn.1404d72f8
mov r15, qword [rbp - 0x80]
clc
sbb cl, r13b
rol cx, cl
test eax, eax
movzx rcx, r15w
movsx rcx, r15w
mov rcx, r15
jmp 0x1404d8261
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jmp 0x1404d826d
jne 0x1404d829b
mov al, byte [rcx + 1]
cmc
test al, al
jmp 0x1404d827e
je 0x1404d82d5
cmp al, 0x2e
jmp 0x1404d828b
jne 0x1404d829b
cmp byte [rcx + 2], dil
je 0x1404d82d5
mov r9, r12
movsx dx, r12b
bswap r8
mov r8, r13
mov rdx, rsi
jmp 0x1404d82b1
call fcn.1404d7a91
mov edi, eax
cmp ax, 0x2f51
test bl, r10b
cmp si, r9w
test eax, eax
jne 0x1404d837d
sub edi, edi
cmp r10, 0x7667113d
cmc
cmp byte [rbp - 0x68], dil
jmp 0x1404d82de
je 0x1404d82ec
mov rcx, r15
call fcn.1404c8fed
lea rdx, [rbp - 0x30]
mov cx, r15w
cmovno ecx, edi
mov cl, 0x99
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmc
cmp r12b, r14b
cmp r15, 0x6b184f28
test eax, eax
jmp 0x1404d831a
jne 0x1404d8139
mov rax, qword [r12]
sal dx, 0x69
btr dx, ax
mov rdx, qword [r12 + 8]
sub rdx, rax
jmp 0x1404d833c
sar rdx, 3
test dl, bl
test bp, 0x571e
cmp r14, rdx
je 0x1404d8394
sub rdx, r14
lea rcx, [rax + r14*8]
movsx r9, r9w
xchg r9d, r8d
lea r9, [0x1400acc8c]
not r8b
mov r8d, 8
jmp 0x1404d8373
call fcn.1404e41b0
jmp 0x1404d8394
cmp byte [rbp - 0x68], 0
jmp 0x1404d8386
je 0x1404d8394
mov rcx, r15
call fcn.1404c8fed
mov rcx, rbx
jmp 0x1404d839c
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d83ab
je 0x1404d83bf
mov rcx, qword [rbp - 0x50]
jmp 0x1404d83ba
call fcn.1404c8fed
mov eax, edi
mov rcx, qword [rbp + 0x220]
clc
stc
xor rcx, rsp
jmp 0x1404d83d2
call fcn.14049f5cb
mov rbx, qword [rsp + 0x388]
sar bpl, cl
rcr r12d, cl
add rsp, 0x330
mov sil, dl
not r13w
movsx r14w, r11b
pop r15
pop r14
movsx r13, r9w
movsx r13d, bx
pop r13
pop r12
pop rdi
bswap ebp
pop rsi
movsx bp, dl
pop rbp
jmp 0x1404d8416
ret