Function at 0x14018ef10
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1740]
mov eax, Ordinal_6211
call fcn.140289b90
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1878], rbx
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rbp + 0x1730], rax
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x31], r8b
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
lea rdx, [rbp + 0x1100]
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14018ef70
mov rcx, rsi
call fcn.1401904b0
cmp al, 1
jne 0x14018f112
mov rcx, rbx
call fcn.140190420
cmp al, 1
jne 0x14018f0ae
lea rcx, [rbp + 0x1a0]
call fcn.14018e5a0
nop
lea rdx, [rbp + 0x1a0]
mov rcx, rsi
call fcn.14018fa70
lea rdx, [rbp + 0x1310]
test al, al
mov rcx, rsi
je 0x14018efd1
lea rcx, [rbp + 0x1a0]
call fcn.14018fc20
test al, al
jne 0x14018f016
mov rcx, rbx
call fcn.14018ebc0
mov rbx, rax
mov rcx, rsi
call fcn.14018ebc0
mov r8, rax
mov r9, rbx
mov edx, 0x467a
lea rcx, str._bm3_
call fcn.1401ad480
nop
lea rcx, [rbp + 0x1a0]
call fcn.14018e600
jmp 0x14018f611
lea rax, [rbp + 0x1100]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14018f021
test rdi, rdi
je 0x14018f062
movzx eax, word [rbp + rdi*2 + 0x10fe]
cmp ax, 0x5c
je 0x14018f062
cmp ax, 0x2f
je 0x14018f062
lea rcx, [rbp + 0x1100]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f050
mov eax, dword [0x1402dfd40]
mov dword [rcx], eax
lea rcx, [rbp + 0x1100]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f070
lea r8, [rbp + 0x1310]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14018f090
lea rcx, [rbp + 0x1a0]
call fcn.14018e600
xor r8d, r8d
cmp byte [rsp + 0x31], 1
setne r8b
lea rdx, [rbp + 0x1100]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14018f10b
mov rcx, rbx
call fcn.14018ebc0
mov rdi, rax
mov rcx, rsi
call fcn.14018ebc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8d, 0x467a
lea rcx, str._bm3_
call fcn.1401ad4c0
jmp 0x14018f611
mov al, 1
jmp 0x14018f613
mov rcx, rsi
call fcn.140190420
cmp al, 1
jne 0x14018f600
lea rcx, [rbp + 0x1a0]
call fcn.14018e5a0
nop
lea rdx, [rbp + 0x1a0]
mov rcx, rsi
call fcn.14018fa70
lea rdx, [rbp + 0x1310]
test al, al
mov rcx, rsi
je 0x14018f153
lea rcx, [rbp + 0x1a0]
call fcn.14018fc20
test al, al
jne 0x14018f18b
mov rcx, rbx
call fcn.14018ebc0
mov rbx, rax
mov rcx, rsi
call fcn.14018ebc0
mov r8, rax
mov r9, rbx
mov edx, 0x467a
lea rcx, str._bm3_
call fcn.1401ad480
jmp 0x14018f5e9
lea rax, [rbp + 0x1100]
or rdi, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14018f1a0
mov eax, dword [0x1402dfd40]
test rcx, rcx
je 0x14018f1e0
movzx edx, word [rbp + rcx*2 + 0x10fe]
cmp dx, 0x5c
je 0x14018f1e0
cmp dx, 0x2f
je 0x14018f1e0
lea rcx, [rbp + 0x1100]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f1d4
mov dword [rcx], eax
lea rdx, [rbp + 0x1100]
sub rdx, 2
nop dword [rax + rax]
lea rdx, [rdx + 2]
cmp word [rdx], 0
jne 0x14018f1f0
lea r9, [rbp + 0x1310]
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r9 + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x14018f210
lea rcx, [rbp + 0x1100]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f230
mov dword [rcx], eax
xor edx, edx
lea rcx, [rbp + 0x1100]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14018f296
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
cmp eax, 0xb7
je 0x14018f296
mov rcx, rbx
call fcn.14018ebc0
mov rbx, rax
mov rcx, rsi
call fcn.14018ebc0
mov r9, rax
mov qword [rsp + 0x20], rbx
mov r8d, 0x467a
mov edx, dword [rsp + 0x38]
lea rcx, str._bm3_
call fcn.1401ad4c0
jmp 0x14018f5e9
cmp byte [rsp + 0x30], 1
jne 0x14018f5ed
mov byte [rsp + 0x30], 1
mov rcx, rsi
lea rdx, [rbp + 0x1520]
sub rdx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14018f2c0
lea rcx, [rbp + 0x1520]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14018f2e0
test rax, rax
je 0x14018f322
movzx ecx, word [rbp + rax*2 + 0x151e]
cmp cx, 0x5c
je 0x14018f322
cmp cx, 0x2f
je 0x14018f322
lea rcx, [rbp + 0x1520]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f310
mov eax, dword [0x1402dfd40]
mov dword [rcx], eax
lea rax, [rbp + 0x1520]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x14018f330
movsd xmm0, qword [0x1402e3500]
movsd qword [rax], xmm0
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x50]
call sub.MSVCR120.dll_memset
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x14018f3a2
mov rcx, rsi
call fcn.14018ebc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov r9, rbx
mov r8d, 0x467b
lea rcx, str._bm3_
call fcn.1401ad4c0
jmp 0x14018f5e9
movzx ecx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
cmp cx, word [0x1402dc530]
jne 0x14018f3c2
cmp ax, word [0x1402dc532]
je 0x14018f52d
cmp cx, word [0x140330ee0]
jne 0x14018f3e5
cmp ax, word [0x140330ee2]
jne 0x14018f3e5
movzx eax, word [rbp - 0x80]
cmp ax, word [0x140330ee4]
je 0x14018f52d
mov rcx, rsi
lea rdx, [rbp + 0x1310]
sub rdx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14018f400
lea rcx, [rbp + 0x1310]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14018f420
test rax, rax
je 0x14018f462
cmp word [rbp + rax*2 + 0x130e], 0x5c
je 0x14018f462
cmp word [rbp + rax*2 + 0x1310], 0x2f
je 0x14018f462
lea rcx, [rbp + 0x1310]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f450
mov eax, dword [0x1402dfd40]
mov dword [rcx], eax
lea rcx, [rbp + 0x1310]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14018f470
lea r8, [rsp + 0x7c]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14018f490
lea rdx, [rbp + 0x1100]
lea rcx, [rbp + 0x6c0]
call fcn.14018e4e0
mov rbx, rax
lea rdx, [rbp + 0x1310]
lea rcx, [rbp + 0xbe0]
call fcn.14018e4e0
nop
movzx ecx, byte [rbp + 0x1780]
mov byte [rsp + 0x20], cl
movzx r9d, byte [rsp + 0x31]
mov r8b, 1
mov rdx, rbx
mov rcx, rax
call fcn.14018ef10
test al, al
sete bl
lea rcx, [rbp + 0xbe0]
call fcn.14018e600
nop
lea rcx, [rbp + 0x6c0]
call fcn.14018e600
test bl, bl
je 0x14018f51b
mov byte [rsp + 0x30], 0
cmp byte [rbp + 0x1780], 0
je 0x14018f547
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x50]
call sub.MSVCR120.dll_memset
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
jne 0x14018f54f
jmp 0x14018f3a2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
je 0x14018f583
test eax, eax
je 0x14018f583
mov rcx, rsi
call fcn.14018ebc0
mov r9, rax
mov r8d, 0x467b
mov edx, ebx
lea rcx, str._bm3_
call fcn.1401ad4c0
xor bl, bl
jmp 0x14018f585
mov bl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x14018f5be
mov rcx, rsi
call fcn.14018ebc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov r9, rbx
mov r8d, 0x467b
lea rcx, str._bm3_
call fcn.1401ad4c0
xor bl, bl
movzx eax, byte [rsp + 0x30]
test al, al
jne 0x14018f5e5
mov rcx, rsi
call fcn.14018ebc0
mov r8, rax
mov edx, 0x467b
lea rcx, str._bm3_
call fcn.1401ad510
jmp 0x14018f5e9
test bl, bl
jne 0x14018f5ed
xor bl, bl
jmp 0x14018f5ef
mov bl, 1
lea rcx, [rbp + 0x1a0]
call fcn.14018e600
movzx eax, bl
jmp 0x14018f613
mov edx, 0x466e
lea rcx, str._bm3_
call fcn.1401ad480
xor al, al
mov rcx, qword [rbp + 0x1730]
xor rcx, rsp
call fcn.140289bf0
mov rbx, qword [rsp + 0x1878]
add rsp, 0x1840
pop rdi
pop rsi
pop rbp
ret