Function at 0x42bc40
Capabilities:
Get common file path
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5e6e28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x718
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 6
push 0x64a290
mov dword [esp + 0x24], ebx
call fcn.00422640
add esp, 8
test eax, eax
je 0x42bfd2
push ebx
call fcn.00419540
push eax
call fcn.00404300
mov esi, eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
mov byte [esp + 0x530], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x531]
mov byte [esp + 0x630], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x631]
mov byte [esp + 0x230], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x231]
add esp, 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x228]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x228]
push esi
push ecx
lea edx, [esp + 0x130]
push 0x638274
push edx
call fcn.004446b2
add esp, 0x10
lea eax, [esp + 0x228]
lea ecx, [esp + 0x528]
push str.baktpktvcat.sys
push eax
push 0x638274
push ecx
call fcn.004446b2
add esp, 0x10
lea edx, [esp + 0x228]
lea eax, [esp + 0x628]
push str.baktpktvmcat.sys
push edx
push 0x638274
push eax
call fcn.004446b2
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x339]
mov byte [esp + 0x338], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
add esp, 0x10
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x429]
mov byte [esp + 0x428], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.tpacketv.sys
push 0x64a290
lea ecx, [esp + 0x30]
push 0x638274
push ecx
stosb byte es:[edi], al
call fcn.004446b2
add esp, 0x10
lea edx, [esp + 0x328]
push str.netsf.cat
push 0x64a290
push 0x638274
push edx
call fcn.004446b2
add esp, 0x10
lea eax, [esp + 0x428]
push str.netsf_m.cat
push 0x64a290
push 0x638274
push eax
call fcn.004446b2
mov eax, dword [0x676468]
add esp, 0x10
cmp eax, ebx
je 0x42be89
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
call fcn.0045d440
mov esi, eax
lea edx, [esp + 0x128]
lea ecx, [esp + 0x10]
push edx
mov dword [esp + 0x734], ebx
call fcn.0045d440
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
push str.PrepareInstallDirectory_6___s_______s_
push str.InstTpacketV
push 0xf
push 0x6763fc
mov byte [esp + 0x748], 1
call fcn.00429e80
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x730], bl
call fcn.0045ddc0
or edi, 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x730], edi
call fcn.0045ddc0
jmp 0x42be8c
or edi, 0xffffffff
lea eax, [esp + 0x28]
push ebx
lea ecx, [esp + 0x12c]
push eax
push ecx
call fcn.0040e580
add esp, 0xc
test eax, eax
je 0x42bffc
lea edx, [esp + 0x328]
push ebx
lea eax, [esp + 0x52c]
push edx
push eax
call fcn.0040e580
add esp, 0xc
test eax, eax
je 0x42c081
lea ecx, [esp + 0x428]
push ebx
lea edx, [esp + 0x62c]
push ecx
push edx
call fcn.0040e580
add esp, 0xc
test eax, eax
je 0x42c106
push 0x64a26c
push 0x64a290
lea eax, [esp + 0x30]
push 0x638274
push eax
call fcn.004446b2
add esp, 0x10
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x28]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push ecx
call ebp
mov esi, eax
cmp esi, edi
je 0x42c188
lea edx, [esp + 0x18]
push ebx
push edx
mov edx, dword [str._____NETSF.INF____r_n__r_n__Tpacketv_driver_INF_file___this_is_the_INF_for_the_service__protocol__r_n__part._r_n__r_n__Copyright__c__1993_2001__Microsoft_Corporation_r_n__r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_in_this_INF_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._In_general_a_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____Since_Windows_2000_systems_do_not_have_support_for_CopyINF_directive__r_n_____a_notify_object_is_required_to_programmatically_copy_the_miniport_INF___r_n_____file_to_the_system_INF_directory._Previous_versions_of_this_INF_file_r_n_____erroneously_used_to_copy_the_INF_files_directly_by_using_the_CopyFiles__r_n_____directive._r_n_____On_Windows_XP__you_can_install_a_filter_IM_without_a_notify_object._r_n_____by_following_the_instructions_in__4_._r_n__r_n__3._If_you_want_to_use_this_INF_file_with_your_own_IM_driver__please_r_n_____make_the_following_modifications:_r_n_____File_netsf.inf_r_n____________________r_n_____a._In_section__SourceDiskFiles__and__Tpacketv.Files.Sys__r_n________change_tpacketv.sys_to_the_name_of_your_own_driver_binary._r_n_____b._In_section__Tpacketv.ndi.AddReg___change_values_of_r_n________BindForm_and_MiniportId_to_appropriate_values._r_n_____File_netsf_m.inf_r_n______________________r_n_____a._Replace_MS_TpacketvMP_with_InfId_of_your_miniport._r_n_____b._In_section__TpacketvMP.AddService___r_n________change_ServiceBinary_appropriately._r_n_____c._In_section__TpacketvMP.ndi.AddReg___r_n________change__Tpacketv__in_the_line_having__Service__r_n________to_reflect_the_appropriate_name_r_n__r_n__r_n_________________________________________________________________________r_n_r_n_Version__r_nSignature_____Windows_NT___r_nClass_______NetService_r_nClassGUID___4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____Msft__r_nDriverVer__10_01_2012_6.0.5019.0_r_nCatalogFile_netsf.cat_r_n_r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_ControlFlags__r_n_r_n__r_n__r_n__r_n_For_Win2K_r_n_r_n_MSFT__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n__r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTia64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTamd64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_r_n_Tpacketv.ndi__r_nAddReg___________Tpacketv.ndi.AddReg__Tpacketv.AddReg_r_nCharacteristics__0x4418____NCF_FILTER__NCF_NDIS_PROTOCOL__NCF_HIDEN____Filter_Specific_____r_nCopyFiles________Tpacketv.Files.Sys_r_nCopyInf__________netsf_m.inf_r_n_r_n_Tpacketv.ndi.Remove__r_nDelFiles__Tpacketv.Files.Sys_r_n_r_n_Tpacketv.ndi.Services__r_nAddService__Tpacketv___Tpacketv.AddService_r_n_r_n_Tpacketv.AddService__r_nDisplayName______TpacketvService_Desc__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________Tpacketv.AddService.AddReg_r_n_r_n_r_n_Tpacketv.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_r_n_________________________________________________________________________r_n__File_copy_r_n__r_n_SourceDisksNames__r]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x20], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64a260
push 0x64a290
lea eax, [esp + 0x30]
push 0x638274
push eax
call fcn.004446b2
add esp, 0x10
lea ecx, [esp + 0x28]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x42c198
lea edx, [esp + 0x18]
push ebx
push edx
mov edx, dword [str._____NETSF_M.INF____r_n__r_n__Tpacketv_Miniport_INF_file_r_n__r_n__Copyright__c__1993_1999__Microsoft_Corporation_r_n_r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_here_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._A_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____This_sample_uses_a_notify_object_as_an_example_only._If_you_do_not_r_n_____want_to_use_a_notify_object__please_comment_out_the_lines_that_add_r_n_____ClsId_and_ComponentDll_registry_keys._r_n_________________________________________________________________________r_n_r_n_Version__r_nsignature_____Windows_NT___r_nClass_______Net_r_nClassGUID___4d36e972_e325_11ce_bfc1_08002be10318_r_nProvider_____Msft__r_nDriverVer__10_01_2012_6.0.5019.0_r_nCatalogFile__netsf_m.cat_r_n_r_n_ControlFlags__r_nExcludeFromSelect__ms_tpacketvmp_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_n__No_files_to_copy__r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_For_Win2K_r_n_r_n_MSFT__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTia64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTamd64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_r_n_TpacketvMP.ndi__r_nAddReg___TpacketvMP.ndi.AddReg_r_nCharacteristics__0x29__NCF_NOT_USER_REMOVABLE__NCF_VIRTUAL__NCF_HIDDEN_r_n_r_n_TpacketvMP.ndi.AddReg__r_nHKR__Ndi__Service___0___TpacketvMP_r_n_r_n_TpacketvMP.ndi.Services__r_nAddService__TpacketvMP_0x2__TpacketvMP.AddService_r_n_r_n_r_n_TpacketvMP.AddService__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________TpacketvMP.AddService.AddReg_r_n_r_n_r_n_TpacketvMP.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_Strings__r_nMsft___Microsoft__r_nTpacketvMP_Desc___Tpacketv_Miniport__r_n_r_n_SourceDisksNames__r_n_None__r_n_r_n_SourceDisksFiles__r_n_None_r_n_r_n_r_n]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x20], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1c], 1
jmp 0x42c1bb
cmp dword [0x676468], ebx
je 0x42c1bb
push str.PrepareInstallDirectory_3
push str.InstTpacketV
push 0xf
push 0x6763fc
call fcn.00429e80
add esp, 0x10
jmp 0x42c1bb
cmp dword [0x676468], ebx
je 0x42c1bb
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
call fcn.0045d440
mov esi, eax
lea ecx, [esp + 0x128]
mov dword [esp + 0x730], 2
push ecx
lea ecx, [esp + 0x18]
call fcn.0045d440
mov edx, dword [esi]
mov eax, dword [eax]
push edx
push eax
push str.PrepareInstallDirectory_7___s____s_
push str.InstTpacketV
push 0xf
push 0x6763fc
mov byte [esp + 0x748], 3
call fcn.00429e80
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x730], 2
call fcn.0045ddc0
lea ecx, [esp + 0x10]
mov dword [esp + 0x730], edi
call fcn.0045ddc0
jmp 0x42c1bb
cmp dword [0x676468], ebx
je 0x42c1bb
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.0045d440
mov esi, eax
lea edx, [esp + 0x128]
mov ebx, 4
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x734], ebx
call fcn.0045d440
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
push str.PrepareInstallDirectory_8___s____s_
push str.InstTpacketV
push 0xf
push 0x6763fc
mov byte [esp + 0x748], 5
call fcn.00429e80
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x730], bl
call fcn.0045ddc0
lea ecx, [esp + 0x10]
mov dword [esp + 0x730], edi
call fcn.0045ddc0
jmp 0x42c1bb
cmp dword [0x676468], ebx
je 0x42c1bb
lea eax, [esp + 0x28]
lea ecx, [esp + 0x24]
push eax
call fcn.0045d440
mov esi, eax
lea ecx, [esp + 0x128]
mov dword [esp + 0x730], 6
push ecx
lea ecx, [esp + 0x24]
call fcn.0045d440
mov edx, dword [esi]
mov eax, dword [eax]
push edx
push eax
push str.PrepareInstallDirectory_9___s____s_
push str.InstTpacketV
push 0xf
push 0x6763fc
mov byte [esp + 0x748], 7
call fcn.00429e80
add esp, 0x18
lea ecx, [esp + 0x20]
mov byte [esp + 0x730], 6
call fcn.0045ddc0
lea ecx, [esp + 0x24]
mov dword [esp + 0x730], edi
call fcn.0045ddc0
jmp 0x42c1bb
cmp dword [0x676468], ebx
je 0x42c1bb
push edi
push str.PrepareInstallDirectory_1_0x_lx
jmp 0x42c1a7
cmp dword [0x676468], ebx
je 0x42c1bb
push 0xffffffffffffffff
push str.PrepareInstallDirectory_2_0x_lx
push str.InstTpacketV
push 0xf
push 0x6763fc
call fcn.00429e80
add esp, 0x14
mov ecx, dword [esp + 0x728]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x724
ret