Function at 0x140028f10
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x340
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rdi, rcx
mov eax, 0x5c
mov word [rsp + 0x30], ax
lea r9d, [rax - 0x5b]
or rsi, 0xffffffffffffffff
mov r8, rsi
lea rdx, [rsp + 0x30]
call fcn.14002b680
mov rbx, rax
cmp rax, rsi
je 0x14002937b
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call fcn.1400220d0
nop
lea r8, [rbx + 1]
mov r9, rsi
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.1400220d0
nop
lea r8, [0x1401a3fd4]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call fcn.140013df0
nop
lea rcx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
xor r13d, r13d
cmp rax, rsi
je 0x1400292ff
mov bl, 1
nop word [rax + rax]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r13
mov word [rsp + 0x48], r13w
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x10c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x10c]
lea rcx, [rsp + 0x40]
call fcn.140001520
nop
lea rcx, [rsp + 0x48]
mov r11, qword [rsp + 0x48]
mov r10, qword [rsp + 0x60]
cmp r10, 8
cmovae rcx, r11
mov edi, 1
mov r8, qword [rsp + 0x58]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1401a3fdc]
test rdi, rdi
je 0x140029097
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14002908a
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x140029072
jmp 0x140029097
mov edi, 1
cmp word [rcx], ax
cmovb edi, esi
jmp 0x14002909a
mov edi, r13d
movsxd rax, edi
test edi, edi
jne 0x1400290b1
cmp r8, 1
jb 0x1400290b9
mov eax, r13d
cmp r8, 1
setne al
test eax, eax
je 0x1400291a1
lea rcx, [rsp + 0x48]
cmp r10, 8
cmovae rcx, r11
mov edi, 2
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x1401a3fe0]
test rdi, rdi
je 0x140029105
nop
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400290f8
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x1400290e0
jmp 0x140029105
mov edi, 1
cmp word [rcx], ax
cmovb edi, esi
jmp 0x140029108
mov edi, r13d
movsxd rax, edi
test edi, edi
jne 0x14002911f
cmp r8, 2
jb 0x140029123
mov eax, r13d
cmp r8, 2
setne al
test eax, eax
je 0x1400291a1
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
cmp r10, 8
cmovae rcx, r11
mov r9, qword [rsp + 0x80]
mov rdi, r9
cmp r8, r9
cmovb rdi, r8
test rdi, rdi
je 0x140029185
nop dword [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140029178
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x140029160
jmp 0x140029185
mov edi, 1
cmp word [rcx], ax
cmovb edi, esi
jmp 0x140029188
mov edi, r13d
movsxd rax, edi
test edi, edi
jne 0x14002919d
cmp r8, r9
jb 0x1400291cd
mov eax, r13d
cmp r8, r9
setne al
test eax, eax
jne 0x1400291cd
cmp r10, 8
jb 0x1400291af
mov rcx, r11
call fcn.1400ddb14
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400292e4
jmp 0x140029000
lea rcx, str.swifdiag.log
call fcn.140001910
mov rbx, rax
test rax, rax
je 0x1400292d0
mov rax, qword [rax]
lea r12, str.removeParentDirectoryNowOrOnReboot
mov qword [rsp + 0x20], r12
lea rsi, str....._src_swic_srcSwiUpdateShadow.cpp
mov r9, rsi
lea r8, str.default
mov edx, 3
mov rcx, rbx
call qword [rax + 8]
test al, al
je 0x1400292d0
mov byte [rbx + 0xf8], 0x76
mov eax, r13d
mov dil, 0x2e
mov rcx, rsi
mov edx, 1
nop dword [rax]
cmp dil, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx edi, byte [rcx]
test dil, dil
jne 0x140029230
add rax, rsi
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], 0xb9
mov qword [rbx + 0x110], r12
mov rcx, rbx
call fcn.1400027f0
mov rbx, rax
mov rdi, r13
lea r12, str.Parent_directory_is_not_empty__so_not_deleting
inc rdi
cmp byte [rdi + r12], 0
jne 0x140029274
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r13d
cmp edi, ecx
jge 0x1400292b9
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x1400292a0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
xor bl, bl
cmp qword [rsp + 0x60], 8
jb 0x1400292e4
mov rcx, qword [rsp + 0x48]
call fcn.1400ddb14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
test bl, bl
je 0x1400292ff
lea rcx, [rsp + 0xb8]
call fcn.140028cc0
nop
cmp qword [rsp + 0xb0], 8
jb 0x140029317
mov rcx, qword [rsp + 0x98]
call fcn.1400ddb14
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r13
mov word [rsp + 0x98], r13w
cmp qword [rsp + 0x88], 8
jb 0x140029349
mov rcx, qword [rsp + 0x70]
call fcn.1400ddb14
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r13
mov word [rsp + 0x70], r13w
cmp qword [rsp + 0xd8], 8
jb 0x14002937b
mov rcx, qword [rsp + 0xc0]
call fcn.1400ddb14
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1400dd780
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret