Function at 0x1404d4703
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
sub ebx, r13d
push rbp
push rsi
test dh, 0x1a
and bp, ax
push rdi
jmp 0x1404d4733
push r12
movzx r12w, sil
push r13
push r14
shld bx, r13w, 0x27
add al, 0xef
push r15
lea rbp, [rsp - 0x230]
dec bx
stc
sub rsp, 0x330
mov rax, qword [0x1400b7288]
mov sil, r9b
movsx r12d, sp
xor rax, rsp
xchg bl, sil
adc bx, r8w
mov sil, 0x22
mov qword [rbp + 0x220], rax
mov r12, r8
bts esi, esp
mov rsi, rcx
sal ebx, cl
ror bh, cl
xchg bx, bx
movabs rbx, 0x200000000801
cmp rdx, rcx
jmp 0x1404d479f
je 0x1404d47eb
mov al, byte [rdx]
test edx, ebp
jmp 0x1404d47af
sub al, 0x2f
cmp al, 0x2d
jmp 0x1404d47b8
ja 0x1404d47d2
movsx rax, al
stc
bt rbx, rax
jmp 0x1404d47cc
jb 0x1404d47eb
mov rcx, rsi
jmp 0x1404d47da
call fcn.1401bfe8c
mov rdx, rax
cmp rax, rsi
jne 0x1404d47a5
mov r8b, byte [rdx]
cmp rsp, rbx
cmp r8b, 0x3a
jne 0x1404d4839
lea rax, [rsi + 1]
cmp rdx, rax
jmp 0x1404d4807
je 0x1404d4839
mov r9, r12
mov ch, 0x19
btc rcx, r10
sub cx, 0x718f
xor r8d, r8d
xor cl, dil
not cx
sub edx, edx
mov rcx, rsi
jmp 0x1404d482f
call fcn.1404d43ea
jmp 0x1404d4d0b
sub r8b, 0x2f
test r13b, bl
sub edi, edi
cmp r8b, 0x2d
jmp 0x1404d484b
ja 0x1404d486c
movsx rax, r8b
clc
jmp 0x1404d485b
bt rbx, rax
mov al, 1
jmp 0x1404d4866
jb 0x1404d486f
mov al, dil
sub rdx, rsi
movzx ecx, r14w
bswap ecx
mov ch, 0xed
mov qword [rbp - 0x60], rdi
dec ch
jmp 0x1404d4886
inc rdx
sbb cx, 0x2331
xor ch, 0x3c
mov qword [rbp - 0x58], rdi
rcr ch, cl
ror cx, 0xb5
neg al
mov qword [rbp - 0x50], rdi
not ch
movzx cx, r10b
bswap ecx
lea rcx, [rsp + 0x30]
jmp 0x1404d48b4
mov qword [rbp - 0x48], rdi
jmp 0x1404d48bd
sbb r13, r13
cmc
mov qword [rbp - 0x40], rdi
cmp bx, 0x55e5
cmp bx, r13w
and r13, rdx
mov byte [rbp - 0x38], dil
cmc
stc
cmp r13w, 0x488c
sub edx, edx
jmp 0x1404d48e4
call fcn.1404a0a5e
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
jmp 0x1404d48f9
cmp dword [rax + 0xc], r15d
jne 0x1404d4936
cmp byte [rsp + 0x48], dil
jmp 0x1404d490d
je 0x1404d492e
mov rax, qword [rsp + 0x30]
shld r8w, bx, 0xbd
movzx r8w, r11b
and dword [rax + 0x3a8], 0xfffffffd
setl r8b
mov r8d, r15d
jmp 0x1404d49ae
call fcn.1404c6a99
test eax, eax
jmp 0x1404d4942
jne 0x1404d4983
cmp byte [rsp + 0x48], dil
jmp 0x1404d4952
je 0x1404d4973
mov rax, qword [rsp + 0x30]
rcr r8b, cl
and dword [rax + 0x3a8], 0xfffffffd
mov r8b, 0xd1
jmp 0x1404d4973
mov r8d, 1
jmp 0x1404d497e
jmp 0x1404d49ae
cmp byte [rsp + 0x48], dil
je 0x1404d49a3
mov rax, qword [rsp + 0x30]
cqo
and dl, dil
and dword [rax + 0x3a8], 0xfffffffd
movzx cx, al
mov r8d, edi
movzx rcx, si
xchg dh, dl
cqo
lea rdx, [rbp - 0x60]
xchg ecx, ecx
mov rcx, rsi
jmp 0x1404d49bc
call fcn.1404a1522
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
jmp 0x1404d49d3
test eax, eax
jmp 0x1404d49da
mov dword [rsp + 0x28], edi
jmp 0x1404d49e3
mov qword [rsp + 0x20], rdi
jmp 0x1404d49ed
cmovne rcx, rdi
clc
xor r9d, r9d
test ax, si
xor edx, edx
jmp 0x1404d49ff
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp r10w, 0x65b2
cmp rax, 0xffffffffffffffff
jmp 0x1404d4a17
jne 0x1404d4a56
mov r9, r12
ror ch, 0x23
not rcx
sar cx, cl
xor r8d, r8d
test r11w, r10w
sub cl, r11b
mov cx, r10w
xor edx, edx
movzx cx, r11b
movsx ecx, r8w
mov rcx, rsi
call fcn.1404d43ea
mov edi, eax
jmp 0x1404d4a51
jmp 0x1404d4cec
mov r14, qword [r12 + 8]
shr cl, cl
sub r14, qword [r12]
shl cl, cl
sal cl, 0xd8
bt ecx, r9d
sar r14, 3
sal cx, 0xc7
sbb ecx, 0x42074844
btc ecx, eax
sub edx, edx
jmp 0x1404d4a86
mov qword [rsp + 0x70], rdi
setns ch
xchg cl, ch
lea rcx, [rsp + 0x50]
jmp 0x1404d4a9a
mov qword [rsp + 0x78], rdi
jmp 0x1404d4aa4
mov qword [rbp - 0x80], rdi
jmp 0x1404d4aad
mov qword [rbp - 0x78], rdi
jmp 0x1404d4ab6
mov qword [rbp - 0x70], rdi
jmp 0x1404d4abf
mov byte [rbp - 0x68], dil
call fcn.1404a0a5e
mov rax, qword [rsp + 0x58]
test r10w, si
cmp dword [rax + 0xc], r15d
jmp 0x1404d4ada
jne 0x1404d4b11
cmp byte [rsp + 0x68], dil
jmp 0x1404d4aea
je 0x1404d4b04
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8w, dx
movzx r8d, r12w
mov r8d, r15d
jmp 0x1404d4b0c
jmp 0x1404d4b8c
call fcn.1404c6a99
test eax, eax
jmp 0x1404d4b1d
jne 0x1404d4b5f
cmp byte [rsp + 0x68], dil
jmp 0x1404d4b2d
je 0x1404d4b4f
mov rax, qword [rsp + 0x50]
shl r8b, cl
not r8d
and dword [rax + 0x3a8], 0xfffffffd
bswap r8
movsxd r8, r10d
movzx r8d, sp
mov r8d, 1
jmp 0x1404d4b5a
jmp 0x1404d4b8c
cmp byte [rsp + 0x68], dil
jmp 0x1404d4b69
je 0x1404d4b84
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
bswap r8w
cwd
cmovg edx, ebx
mov r8d, edi
not dl
movsx edx, sp
lea rdx, [rsp + 0x70]
bswap rcx
lea rcx, [rbp - 4]
jmp 0x1404d4b9d
call fcn.1404d3c5a
mov r15, qword [rbp - 0x80]
movzx ecx, ax
test eax, eax
setp cl
movzx ecx, si
xchg cl, cl
mov rcx, r15
cmovne rcx, rdi
test r14b, dl
cmp byte [rcx], 0x2e
jmp 0x1404d4bc5
jne 0x1404d4bf7
mov al, byte [rcx + 1]
jmp 0x1404d4bd3
test al, al
je 0x1404d4c25
cmp al, 0x2e
jmp 0x1404d4be2
jne 0x1404d4bf7
cmp byte [rcx + 2], dil
jmp 0x1404d4bf1
je 0x1404d4c25
mov r9, r12
mov r8, r13
bswap rdx
movsx edx, r11w
setle dl
mov rdx, rsi
jmp 0x1404d4c0f
call fcn.1404d43ea
mov edi, eax
cmc
test r8b, 0xb5
test eax, eax
jne 0x1404d4cc7
sub edi, edi
cmp byte [rbp - 0x68], dil
je 0x1404d4c3c
mov rcx, r15
jmp 0x1404d4c37
call fcn.1404c598b
lea rdx, [rbp - 0x30]
movsx rcx, r13w
mov rcx, rbx
jmp 0x1404d4c4c
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test r11b, r14b
cmc
test eax, eax
jmp 0x1404d4c63
jne 0x1404d4a7b
mov rax, qword [r12]
movzx edx, r13w
sal dl, 0xd
mov rdx, qword [r12 + 8]
test dl, 0xeb
cmp dx, 0x277e
sub rdx, rax
stc
test r10b, 0xc3
sar rdx, 3
cmc
cmp r14, rdx
jmp 0x1404d4c96
je 0x1404d4cde
sub rdx, r14
movzx r8w, r10b
movsxd r9, esp
lea rcx, [rax + r14*8]
movsx r8w, al
lea r9, [0x1400acc8c]
mov r8d, 8
call fcn.1404e0ada
jmp 0x1404d4cde
cmp byte [rbp - 0x68], 0
jmp 0x1404d4cd0
je 0x1404d4cde
mov rcx, r15
call fcn.1404c598b
mov rcx, rbx
jmp 0x1404d4ce6
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d4cf5
je 0x1404d4d09
mov rcx, qword [rbp - 0x50]
jmp 0x1404d4d04
call fcn.1404c598b
mov eax, edi
mov rcx, qword [rbp + 0x220]
cmp bx, 0x7843
cmc
xor rcx, rsp
call fcn.14049bea6
mov rbx, qword [rsp + 0x388]
shl r13b, 0xc5
xor dil, bl
mov r12b, 0xcb
add rsp, 0x330
movzx r13w, r12b
jmp 0x1404d4d47
pop r15
xchg r14d, esi
pop r14
movsx r12, bx
cmovl si, r9w
movsxd rdi, r15d
pop r13
pop r12
mov dil, cl
pop rdi
pop rsi
not bpl
setns bpl
pop rbp
jmp 0x1404d4d70
ret