Function at 0x10005fc0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057b39
mov eax, dword fs:[0]
push eax
sub esp, 0x8ac
mov eax, dword [0x1007200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x894], edx
mov esi, ecx
mov dword [ebp - 0x890], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x88c], eax
call fcn.10001e10
mov ecx, eax
test ecx, ecx
jne 0x1000601a
push 0x80004005
call fcn.10001bc0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x87c], ebx
push ecx
push esi
push ecx
mov edx, 0x104
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x628]
call fcn.100071b0
mov edx, 0x104
lea eax, [ebp - 0x628]
nop dword [eax]
cmp word [eax], 0
je 0x1000605e
add eax, 2
sub edx, 1
jne 0x10006050
xor eax, eax
mov ecx, 0x80070057
test edx, edx
cmovne ecx, eax
mov eax, 0x104
sub eax, edx
xor esi, esi
test edx, edx
cmovne esi, eax
test ecx, ecx
js 0x10006098
push ecx
push 0x10069230
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x628]
sub edx, esi
lea ecx, [ecx + esi*2]
call fcn.100071b0
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or esi, 0xffffffff
mov dword [ebp - 0x888], eax
cmp eax, esi
je 0x10006769
mov edi, eax
nop
test byte [ebp - 0x878], 0x10
je 0x1000643b
cmp word [ebp - 0x84c], 0x2e
je 0x1000674c
push ecx
push dword [ebp - 0x890]
mov edx, 0x104
push ecx
lea ecx, [ebp - 0x420]
call fcn.100071b0
mov edx, 0x104
lea eax, [ebp - 0x420]
nop
cmp word [eax], 0
je 0x1000610e
add eax, 2
sub edx, 1
jne 0x10006100
xor eax, eax
mov ecx, 0x80070057
test edx, edx
cmovne ecx, eax
mov eax, 0x104
sub eax, edx
xor edi, edi
test edx, edx
cmovne edi, eax
test ecx, ecx
js 0x1000614a
push ecx
lea eax, [ebp - 0x84c]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x420]
sub edx, edi
lea ecx, [ecx + edi*2]
call fcn.100071b0
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x87c]
push 0x10068f6c
push eax
call fcn.10001600
add esp, 0xc
lea eax, [ebp - 0x420]
mov edx, 0x104
cmp word [eax], 0
je 0x1000617e
add eax, 2
sub edx, 1
jne 0x10006170
xor eax, eax
mov ecx, 0x80070057
test edx, edx
cmovne ecx, eax
mov eax, 0x104
sub eax, edx
xor edi, edi
test edx, edx
cmovne edi, eax
test ecx, ecx
js 0x100061b8
push ecx
push 0x100692c8
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x420]
sub edx, edi
lea ecx, [ecx + edi*2]
call fcn.100071b0
push 0x10069238
lea eax, [ebp - 0x87c]
push eax
push 0x10069240
push ecx
mov ecx, esp
push eax
mov dword [ebp - 0x880], ecx
call fcn.10001780
mov edx, 1
lea ecx, [ebp - 0x8a4]
call fcn.10005750
add esp, 4
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8a0]
call fcn.10006be0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x89c]
call fcn.10006cb0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x898]
call fcn.10006be0
add esp, 4
mov byte [ebp - 4], 4
mov edx, dword [eax]
mov ebx, dword [ebp - 0x87c]
lea ecx, [edx - 0x10]
lea edi, [ebx - 0x10]
cmp ecx, edi
je 0x10006290
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x1000627b
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1000627b
call fcn.10001720
mov dword [ebp - 0x880], eax
mov ecx, esi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x10006270
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x880]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x87c], ebx
jmp 0x10006290
push dword [edx - 0xc]
lea ecx, [ebp - 0x87c]
push edx
call fcn.10001aa0
mov ebx, dword [ebp - 0x87c]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x898]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100062b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x89c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100062d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x8a0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100062f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x8a4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10006314
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebx - 4], 1
mov edi, dword [ebx - 0xc]
jle 0x1000632f
push edi
lea ecx, [ebp - 0x87c]
call fcn.10001860
mov ebx, dword [ebp - 0x87c]
push 0
lea eax, [ebp - 0x8b8]
push eax
lea eax, [edi + edi]
push eax
push ebx
push dword [ebp - 0x88c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
push dword [ebp - 0x894]
mov edx, 0x104
push ecx
lea ecx, [ebp - 0x218]
call fcn.100071b0
mov edx, 0x104
lea eax, [ebp - 0x218]
nop dword [eax]
cmp word [eax], 0
je 0x1000637e
add eax, 2
sub edx, 1
jne 0x10006370
xor eax, eax
mov ecx, 0x80070057
test edx, edx
cmovne ecx, eax
mov eax, 0x104
sub eax, edx
xor edi, edi
test edx, edx
cmovne edi, eax
test ecx, ecx
js 0x100063ba
push ecx
lea eax, [ebp - 0x84c]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x218]
sub edx, edi
lea ecx, [ecx + edi*2]
call fcn.100071b0
mov edx, 0x104
lea eax, [ebp - 0x218]
cmp word [eax], 0
je 0x100063d3
add eax, 2
sub edx, 1
jne 0x100063c5
xor eax, eax
mov ecx, 0x80070057
test edx, edx
cmovne ecx, eax
mov eax, 0x104
sub eax, edx
xor edi, edi
test edx, edx
cmovne edi, eax
test ecx, ecx
js 0x1000640d
push ecx
push 0x100692c8
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x218]
sub edx, edi
lea ecx, [ecx + edi*2]
call fcn.100071b0
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x88c]
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x420]
call fcn.10005fc0
add esp, 4
jmp 0x10006746
call fcn.10001e10
test eax, eax
je 0x10006010
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x884], eax
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 5
push eax
push dword [ebp - 0x890]
lea eax, [ebp - 0x884]
push 0x10069248
push eax
call fcn.10001600
push dword [ebp - 0x884]
lea eax, [ebp - 0x87c]
push 0x10068f6c
push eax
call fcn.10001600
add esp, 0x1c
lea eax, [ebp - 0x87c]
push 0x10068ef0
push eax
push 0x10069240
push ecx
mov ecx, esp
push eax
mov dword [ebp - 0x880], ecx
call fcn.10001780
xor edx, edx
lea ecx, [ebp - 0x8b4]
call fcn.10005750
add esp, 4
mov edx, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8b0]
call fcn.10006be0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8ac]
call fcn.10006cb0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8a8]
call fcn.10006be0
add esp, 4
mov byte [ebp - 4], 9
mov edx, dword [eax]
mov ebx, dword [ebp - 0x87c]
lea ecx, [edx - 0x10]
lea edi, [ebx - 0x10]
cmp ecx, edi
je 0x10006569
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x10006554
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x10006554
call fcn.10001720
mov dword [ebp - 0x880], eax
mov ecx, esi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x10006549
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x880]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x87c], ebx
jmp 0x10006569
push dword [edx - 0xc]
lea ecx, [ebp - 0x87c]
push edx
call fcn.10001aa0
mov ebx, dword [ebp - 0x87c]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x8a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000658a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x8ac]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100065ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, esi
mov edx, dword [ebp - 0x8b0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100065cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x8b4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100065ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebx - 4], 1
mov esi, dword [ebx - 0xc]
jle 0x10006608
push esi
lea ecx, [ebp - 0x87c]
call fcn.10001860
mov ebx, dword [ebp - 0x87c]
push 0
lea eax, [ebp - 0x8b8]
push eax
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp - 0x88c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x20c
lea eax, [ebp - 0x884]
mov edi, esp
mov ecx, 0x83
mov esi, 0x10076ee0
rep movsd dword es:[edi], dword [esi]
push ecx
mov ecx, esp
push eax
mov dword [ebp - 0x880], ecx
call fcn.10001780
call fcn.10005bc0
add esp, 0x210
test eax, eax
jne 0x10006681
mov byte [ebp - 4], al
or esi, 0xffffffff
mov edx, dword [ebp - 0x884]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10006746
mov ecx, dword [edx]
push edx
jmp 0x10006741
call fcn.10001e10
test eax, eax
je 0x10006010
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x880], eax
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 0xa
push eax
push dword [ebp - 0x894]
lea eax, [ebp - 0x880]
push str._s_s
push eax
call fcn.10001600
mov esi, dword [ebp - 0x880]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x100066e3
push dword [esi - 0xc]
lea ecx, [ebp - 0x880]
call fcn.10001860
mov esi, dword [ebp - 0x880]
mov edi, dword [ebp - 0x884]
cmp dword [edi - 4], 1
jle 0x10006703
push dword [edi - 0xc]
lea ecx, [ebp - 0x884]
call fcn.10001860
mov edi, dword [ebp - 0x884]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 5
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000672b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10006746
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x888]
lea eax, [ebp - 0x878]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100060c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
add ebx, 0xfffffff0
lock xadd dword [ebx + 0xc], esi
dec esi
test esi, esi
jg 0x10006785
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007975
mov esp, ebp
pop ebp
ret