Function at 0x41a400
Capabilities:
Enumerate files on windows
Enumerate files recursively
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
lea rax, [rsp + 0x70]
mov r14, rcx
mov r12, r8
mov qword [rsp + 0x578], rdx
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x92]
mov word [rsp + 0x92], r8w
mov r8, rdx
mov qword [rsp + 0x80], rax
lea rdx, str._s.
lea rax, [0x00840bc0]
mov byte [rsp + 0x90], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x88], pe_nt_image_headers64
mov qword [rsp + 0x70], rax
call fcn.00403810
lea rbx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [r14 + 0x28]
mov rdi, rax
call sub.msvcrt.dll_wcslen
mov rsi, qword [rsp + 0x578]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r13, qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea rax, [rsi + rax*2 + 2]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
nop
mov rdx, rbx
mov rcx, rdi
call rbp
test eax, eax
je 0x41a760
test byte [rsp + 0x2d0], 0x10
je 0x41a550
lea rcx, [rbx + 0x2c]
lea rdx, [0x007f85f4]
call r13
test eax, eax
je 0x41a4e0
mov r8, qword [rsp + 0x578]
lea r9, [rbx + 0x2c]
mov rcx, qword [rsp + 0x38]
lea rdx, str._s_ws
call fcn.00403810
mov edx, dword [0x008b90b0]
test edx, edx
jne 0x41a4e0
mov rdx, qword [rsp + 0x80]
mov r8, r12
mov rcx, r14
call fcn.0041a400
jmp 0x41a4e0
lea r15, [rbx + 0x2c]
mov rcx, r15
call sub.msvcrt.dll_wcslen
cmp rax, 2
jbe 0x41a4e0
lea rsi, [rax + rax]
lea rcx, [r15 + rsi - 6]
lea rdx, [0x007f8644]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x41a663
mov rsi, qword [rsp + 0x40]
mov r9, r14
mov r8, r15
mov rdx, qword [rsp + 0x578]
mov rcx, rsi
call fcn.004137c0
mov rcx, qword [r14 + 0x18]
cmp rcx, qword [r14 + 0x20]
je 0x41a7f0
test rcx, rcx
je 0x41a5be
mov rdx, rsi
call fcn.00698910
mov rcx, qword [r14 + 0x18]
add rcx, 0x130
mov qword [r14 + 0x18], rcx
mov rcx, qword [rsp + 0x40]
call fcn.00698fd0
mov rax, qword [r14 + 0x18]
mov byte [rsp + 0x68], 0
mov rcx, qword [rsp + 0x48]
sub rax, 0x130
mov qword [rsp + 0x1a0], rax
lea rax, [r12 + 0x50]
mov qword [rsp + 0x60], rax
call fcn.006b7110
mov rsi, qword [r12 + 0x40]
mov rax, qword [r12 + 0x30]
lea rdx, [rsi - 8]
cmp rax, rdx
je 0x41a7de
test rax, rax
je 0x41a625
mov rdx, qword [rsp + 0x1a0]
mov qword [rax], rdx
add rax, 8
mov qword [r12 + 0x30], rax
add dword [r12 + 0x68], 1
mov rcx, qword [rsp + 0x48]
call fcn.006b72f0
mov rcx, qword [r12 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [rsp + 0x68], 0
je 0x41a4e0
mov rcx, qword [rsp + 0x60]
call fcn.006f33e0
jmp 0x41a4e0
lea rsi, [rbx + rsi + 0x24]
lea rdx, str..inf
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x41a740
mov eax, dword [0x008b90b0]
test eax, eax
jne 0x41a4e0
mov r8, qword [rsp + 0x578]
lea r9, [rbx + 0x2c]
mov rcx, qword [rsp + 0x38]
lea rdx, [0x007f8326]
call fcn.00403810
lea rdx, [0x007f8332]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r8d, 2
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.0067f720
mov rcx, rsi
call fcn.0067f4d0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov r15, rax
call fcn.0067f720
mov rcx, r15
call fcn.007da080
mov r9, rsi
mov rdx, r15
mov rcx, rax
mov qword [rsp + 0x50], rax
mov r8d, 1
call sub.msvcrt.dll_fread
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov r8, qword [rsp + 0x58]
lea rdx, [0x007f8952]
mov rcx, qword [rsp + 0x38]
call fcn.00403810
test r15, r15
jne 0x41a799
mov rcx, qword [rsp + 0x50]
call fcn.007da030
jmp 0x41a4e0
lea rdx, str..cat
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x41a680
jmp 0x41a4e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x78]
lea rax, [0x008407e0]
mov qword [rsp + 0x70], rax
test rcx, rcx
je 0x41a785
call fcn.007da030
nop
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rbx + 0x2c]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
lea rdx, str..inf
lea rcx, [rsi + rax*2 - 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x50]
jne 0x41a803
mov rdx, qword [rsp + 0x80]
mov r8, rsi
call fcn.0041a350
jmp 0x41a72f
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call fcn.0077ca10
jmp 0x41a62e
mov rdx, qword [rsp + 0x40]
lea rcx, [r14 + 0x10]
call fcn.007840a0
jmp 0x41a5c9
mov rdx, qword [rsp + 0x80]
lea r8, [rbx + 0x2c]
call fcn.00416600
jmp 0x41a72f