Function at 0x1404ddc7c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
sub al, r8b
sal ah, 0x3d
push rbp
cmovo ebp, esp
add bpl, al
push rsi
push rdi
sub ax, 0x43fb
shrd esi, edi, 0xd7
xchg bl, bpl
push r12
sal ebp, 0x77
push r13
movsx si, dil
push r14
shr ebx, 0x58
push r15
test r12b, bl
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov si, r13w
rcr ax, cl
btc ax, r15w
mov rax, qword [0x1400b7288]
xor rax, rsp
sub r12, r8
mov qword [rbp + 0x220], rax
mov r12, r8
mov rsi, rcx
cmovbe rbx, r9
movabs rbx, 0x200000000801
jmp 0x1404ddcf9
cmp rdx, rcx
je 0x1404ddd3a
mov al, byte [rdx]
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404ddd0d
ja 0x1404ddd26
movsx rax, al
jmp 0x1404ddd1c
bt rbx, rax
jb 0x1404ddd3a
mov rcx, rsi
call fcn.1400f8d70
mov rdx, rax
cmp rax, rsi
jne 0x1404ddd02
mov r8b, byte [rdx]
jmp 0x1404ddd47
cmp r8b, 0x3a
jmp 0x1404ddd50
jne 0x1404ddda4
lea rax, [rsi + 1]
cmp r9b, 0x80
test r12b, 0x40
cmp rdx, rax
jmp 0x1404ddd6a
je 0x1404ddda4
mov r9, r12
bsf ecx, r9d
rcr cl, 0x20
clc
xor r8d, r8d
shr cl, 4
jmp 0x1404ddd86
sub edx, edx
xchg cx, cx
movsx rcx, bp
cmova ecx, esp
mov rcx, rsi
jmp 0x1404ddd9a
call fcn.1404dd968
jmp 0x1404de24f
sub r8b, 0x2f
cmp sp, bp
cmp r14b, 6
xor edi, edi
test r12b, r10b
test r9, 0x77b01a9e
cmp r8b, 0x2d
ja 0x1404ddddc
movsx rax, r8b
cmc
clc
bt rbx, rax
mov al, 1
jmp 0x1404dddd6
jb 0x1404ddde2
mov al, dil
adc rcx, rbx
sub rdx, rsi
mov qword [rbp - 0x60], rdi
movzx ecx, r14w
not rcx
xchg rcx, rcx
inc rdx
mov qword [rbp - 0x58], rdi
stc
movzx rcx, r9w
adc rcx, rax
neg al
xchg cl, ch
movzx cx, r15b
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
jmp 0x1404dde19
mov qword [rbp - 0x48], rdi
sbb r13, r13
jmp 0x1404dde25
mov qword [rbp - 0x40], rdi
cmc
jmp 0x1404dde2f
and r13, rdx
stc
test r14w, r10w
mov byte [rbp - 0x38], dil
xor edx, edx
jmp 0x1404dde42
call fcn.1404a9e72
mov rax, qword [rsp + 0x38]
stc
shl r15w, cl
mov r15d, 0xfde9
jmp 0x1404dde5d
cmp dword [rax + 0xc], r15d
jmp 0x1404dde66
jne 0x1404ddea4
cmp byte [rsp + 0x48], dil
jmp 0x1404dde76
je 0x1404dde9c
mov rax, qword [rsp + 0x30]
movsx r8, si
sar r8d, 0x95
and dword [rax + 0x3a8], 0xfffffffd
mov r8w, r14w
movzx r8d, r8w
setg r8b
mov r8d, r15d
jmp 0x1404ddf17
call fcn.1404cfe37
test eax, eax
jmp 0x1404ddeb0
jne 0x1404ddee5
cmp byte [rsp + 0x48], dil
jmp 0x1404ddec0
je 0x1404ddeda
mov rax, qword [rsp + 0x30]
sar r8w, 0xb8
shl r8d, cl
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404ddf17
cmp byte [rsp + 0x48], dil
jmp 0x1404ddeef
je 0x1404ddf0e
mov rax, qword [rsp + 0x30]
bsr r8, rdi
shrd rcx, r13, 0x6d
and dword [rax + 0x3a8], 0xfffffffd
movzx rdx, bp
mov r8d, edi
mov dx, si
bswap cx
lea rdx, [rbp - 0x60]
jmp 0x1404ddf20
mov rcx, rsi
call fcn.1404aa8b5
mov rcx, qword [rbp - 0x50]
inc r8
lea r8, [rbp - 0x30]
test rdi, r8
test eax, eax
jmp 0x1404ddf3d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1404ddf4b
cmovne rcx, rdi
sub r9d, r9d
test al, r10b
cmc
xor edx, edx
jmp 0x1404ddf5d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jmp 0x1404ddf6f
jne 0x1404ddfa3
mov r9, r12
xor r8d, r8d
shrd rcx, rax, 0x3c
sub edx, edx
movsxd rcx, edi
mov cl, 0x24
bswap cx
mov rcx, rsi
jmp 0x1404ddf92
call fcn.1404dd968
mov edi, eax
jmp 0x1404ddf9e
jmp 0x1404de235
mov r14, qword [r12 + 8]
sub r14, qword [r12]
sar r14, 3
sub edx, edx
mov qword [rsp + 0x70], rdi
movsxd rcx, edi
lea rcx, [rsp + 0x50]
jmp 0x1404ddfc4
mov qword [rsp + 0x78], rdi
jmp 0x1404ddfce
mov qword [rbp - 0x80], rdi
jmp 0x1404ddfd7
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
jmp 0x1404ddfe4
mov byte [rbp - 0x68], dil
jmp 0x1404ddfed
call fcn.1404a9e72
mov rax, qword [rsp + 0x58]
test r14, 0x4a793941
cmp dl, r11b
cmp dword [rax + 0xc], r15d
jmp 0x1404de00a
jne 0x1404de049
cmp byte [rsp + 0x68], dil
je 0x1404de041
mov rax, qword [rsp + 0x50]
rcl r8b, cl
bts r8w, sp
bt r8w, 0xc9
and dword [rax + 0x3a8], 0xfffffffd
movsx r8w, r14b
movsx r8, si
movsxd r8, esi
mov r8d, r15d
jmp 0x1404de0b1
call fcn.1404cfe37
test eax, eax
jmp 0x1404de055
jne 0x1404de088
cmp byte [rsp + 0x68], dil
je 0x1404de078
mov rax, qword [rsp + 0x50]
stc
and dword [rax + 0x3a8], 0xfffffffd
mov r8w, 0x258a
mov r8d, 1
jmp 0x1404de083
jmp 0x1404de0b1
cmp byte [rsp + 0x68], dil
jmp 0x1404de092
je 0x1404de0ae
mov rax, qword [rsp + 0x50]
bts rdx, r14
not rcx
xchg dl, r8b
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rsp + 0x70]
jmp 0x1404de0c2
lea rcx, [rbp - 4]
jmp 0x1404de0cb
call fcn.1404dd148
mov r15, qword [rbp - 0x80]
test eax, eax
mov rcx, r15
jmp 0x1404de0de
cmovne rcx, rdi
test r14b, r8b
cmp byte [rcx], 0x2e
jne 0x1404de121
mov al, byte [rcx + 1]
test sp, sp
test spl, 0x32
test al, al
jmp 0x1404de0ff
je 0x1404de15d
cmp al, 0x2e
jmp 0x1404de10c
jne 0x1404de121
cmp byte [rcx + 2], dil
jmp 0x1404de11b
je 0x1404de15d
mov r9, r12
movzx r8w, r9b
movsxd r8, r9d
not rdx
mov r8, r13
jmp 0x1404de138
mov rdx, rsi
jmp 0x1404de140
call fcn.1404dd968
mov edi, eax
test r13w, 0x51ec
test eax, eax
jne 0x1404de20b
xor edi, edi
stc
jmp 0x1404de15d
cmp byte [rbp - 0x68], dil
jmp 0x1404de166
je 0x1404de179
mov rcx, r15
jmp 0x1404de174
call fcn.1404cecb1
lea rdx, [rbp - 0x30]
movzx ecx, ax
movsxd rcx, ebp
mov rcx, rbx
jmp 0x1404de18b
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
cmc
cmp rsp, 0x77633577
stc
test eax, eax
jmp 0x1404de1a7
jne 0x1404ddfb0
mov rax, qword [r12]
mov rdx, qword [r12 + 8]
jmp 0x1404de1c0
sub rdx, rax
cmc
cmp r9b, 0xbe
sar rdx, 3
cmp r14, rdx
jmp 0x1404de1d4
je 0x1404de227
sub rdx, r14
lea rcx, [rax + r14*8]
bswap r8w
movsx r8w, r15b
jmp 0x1404de1ef
lea r9, [0x1400acc8c]
mov r8d, 8
jmp 0x1404de201
call fcn.1404ea166
jmp 0x1404de227
cmp byte [rbp - 0x68], 0
jmp 0x1404de214
je 0x1404de227
mov rcx, r15
jmp 0x1404de222
call fcn.1404cecb1
mov rcx, rbx
jmp 0x1404de22f
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x1404de24d
mov rcx, qword [rbp - 0x50]
jmp 0x1404de248
call fcn.1404cecb1
mov eax, edi
mov rcx, qword [rbp + 0x220]
clc
stc
xor rcx, rsp
jmp 0x1404de260
call fcn.1404a5381
mov rbx, qword [rsp + 0x388]
cmp bx, 0x6478
add rsp, 0x330
mov r12b, bpl
bswap r15w
pop r15
movzx r14d, r15w
pop r14
movsxd rbp, r13d
cmovb si, r9w
pop r13
not sil
movsx rsi, si
movzx rdi, bx
pop r12
not si
pop rdi
movsx bp, al
movsx ebp, r10w
not bpl
pop rsi
movzx ebp, r14w
movsx rbp, r10w
movzx rbp, r15w
pop rbp
jmp 0x1404de2c1
ret