Function at 0x1006a150
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100991e8
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x94], ecx
xor ecx, ecx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], cx
mov dword [ebp - 4], ecx
lea edx, [eax + edx*2]
mov dword [ebp - 0x7c], ecx
mov ecx, 0x100c6860
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006a1d1
push esi
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x90], eax
cmp eax, 0xffffffff
je 0x1006a468
lea eax, [esi + 0x2c]
mov dword [ebp - 0x98], eax
jmp 0x1006a210
mov ecx, 0x100c6868
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006a23b
test dx, dx
je 0x1006a237
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006a23b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006a215
xor eax, eax
jmp 0x1006a240
sbb eax, eax
or eax, 1
test eax, eax
je 0x1006a429
mov ecx, 0x100c686c
lea eax, [esi + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006a276
test dx, dx
je 0x1006a272
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006a276
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006a250
xor eax, eax
jmp 0x1006a27b
sbb eax, eax
or eax, 1
test eax, eax
je 0x1006a429
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp - 0x80]
mov eax, dword [ebp - 0x98]
lea edx, [esi + edi*2]
sub edx, eax
jmp 0x1006a2a0
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x1006a2a0
mov edx, dword [ebp - 0x94]
mov ecx, edi
lea eax, [esi + ecx*2]
lea esi, [ebx + edx*2]
mov ecx, eax
mov edx, esi
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006a2c4
mov eax, dword [ebp - 0x8c]
test byte [eax], 0x10
je 0x1006a353
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov esi, dword [ebp - 0x88]
mov edx, edi
lea ecx, [esi + edx*2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006a2f6
sub ecx, edx
mov eax, edi
sar ecx, 1
mov edx, 0x5c
add eax, ecx
mov edi, 0x5c
mov word [esi + eax*2], dx
mov edx, dword [ebp - 0x94]
lea eax, [edx + ecx]
inc ecx
mov word [ebx + eax*2], di
mov edi, dword [ebp - 0x78]
lea eax, [edx + ecx]
push eax
mov eax, dword [ebp - 0x80]
push ebx
add eax, ecx
mov ecx, dword [ebp - 0x84]
push eax
push esi
mov esi, dword [ebp - 0x8c]
mov edx, esi
push edi
call fcn.1006a150
add esp, 0x14
add dword [ebp - 0x7c], eax
jmp 0x1006a429
mov ecx, dword [ebp - 0x78]
mov edi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp ecx, edi
jb 0x1006a44c
ja 0x1006a373
cmp eax, edx
jbe 0x1006a44c
sub eax, edx
sbb ecx, edi
mov edi, dword [ebp - 0x78]
mov dword [edi], eax
mov dword [edi + 4], ecx
test ecx, ecx
ja 0x1006a38b
test eax, eax
jbe 0x1006a45c
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
je 0x1006a423
cmp word [ebx], 0
jne 0x1006a3aa
xor ecx, ecx
jmp 0x1006a3bf
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006a3b0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x74]
call fcn.10063b40
lea ecx, [ebp - 0x5c]
sub ecx, esi
mov edi, edi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1006a3d0
mov eax, dword [ebp - 0x84]
mov esi, dword [eax]
lea eax, [ebp - 0x74]
push eax
push dword [esi + 4]
push esi
call fcn.100704d0
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov edx, dword [eax + 4]
mov eax, 0x2762761
sub eax, edx
cmp eax, 1
jb 0x1006a442
inc dword [ebp - 0x7c]
lea eax, [edx + 1]
mov edx, dword [ebp - 0x84]
mov dword [edx + 4], eax
mov dword [esi + 4], ecx
mov eax, dword [ecx + 4]
mov dword [eax], ecx
mov esi, dword [ebp - 0x8c]
push esi
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
je 0x1006a45c
lea eax, [esi + 0x2c]
jmp 0x1006a210
push str.list_T__too_long
call fcn.100907d5
mov eax, dword [ebp - 0x78]
mov dword [eax], 0
mov dword [eax + 4], 0
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp - 0x60], 8
jb 0x1006a479
push dword [ebp - 0x74]
call fcn.1007b9e6
add esp, 4
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007aa10
mov esp, ebp
pop ebp
ret