Function at 0x18001bfc0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x998]
sub rsp, 0xa70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800cb660]
xor rax, rsp
mov qword [rbp + 0x960], rax
mov r12, rcx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001c02a
test al, 0x10
jne 0x18001c04c
test al, 1
je 0x18001c021
and eax, 0xfffffffe
mov edx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.180032e00
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18001c52d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 6
je 0x18001c05f
mov edx, 6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x1800e72d4], esi
jne 0x18001c0e6
call fcn.18004ba30
test eax, eax
jne 0x18001c0a1
call fcn.18004ba80
test eax, eax
je 0x18001c082
call fcn.18004bab0
test eax, eax
je 0x18001c0a1
call fcn.18004bb10
test eax, eax
jne 0x18001c0a1
call fcn.18004bab0
test eax, eax
jne 0x18001c0a1
mov edi, 1
mov dword [0x1800e72d8], edi
jmp 0x18001c0a9
mov dword [0x1800e72d8], esi
mov edi, esi
mov dword [0x1800e72d4], 1
cmp dword [0x1800e52c0], esi
je 0x18001c0ec
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
lea r9, str.GetInstallNewDrive___lu____lu_
lea r8, str.CheckModule
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
mov edi, dword [0x1800e72d8]
mov ecx, edi
call fcn.18000fbb0
mov r13, rax
lea r14, str.baktpkt7catt.sys
test edi, edi
je 0x18001c146
mov rax, qword [0x180087258]
mov qword [rsp + 0x40], rax
call fcn.18000f620
mov r8, rax
mov r9, r14
lea rdx, [0x18009c688]
lea rcx, [rsp + 0x40]
call fcn.180026420
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.180033e70
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.180025870
test ebx, ebx
cmove edi, esi
lea rbx, str.baktpkt7cat.sys
test edi, edi
cmovne rbx, r14
mov word [rbp + 0x360], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x362]
call fcn.180037550
mov word [rbp + 0x560], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x562]
call fcn.180037550
mov word [rbp + 0x760], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x762]
call fcn.180037550
call fcn.18000f620
mov rdx, rax
mov r8d, 0xff
lea rcx, [rbp + 0x760]
call fcn.180035de4
mov r9, r13
lea r8, [rbp + 0x760]
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x360]
call fcn.180036368
mov r9, rbx
lea r8, [rbp + 0x760]
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x560]
call fcn.180036368
mov word [rsp + 0x60], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x62]
call fcn.180037550
mov word [rbp + 0x160], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x162]
call fcn.180037550
lea r9, str.tpacket7.sys
mov r8, r12
lea rdx, [0x18009c688]
lea rcx, [rsp + 0x60]
call fcn.180036368
lea r9, str.tpacket7.cat
mov r8, r12
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x160]
call fcn.180036368
cmp dword [0x1800e52c0], 0
je 0x18001c2d6
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_6___s_______s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
nop
lea rcx, [rsp + 0x48]
call fcn.180025870
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001c3a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001c326
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.18001b5e0
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001c3a3
cmp dword [0x1800e52c0], 0
je 0x18001c554
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x48]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory1_4___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x48]
call fcn.180025870
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
jmp 0x18001c554
lea r9, str.tpacket7.inf
mov r8, r12
lea rdx, [0x18009c688]
lea rcx, [rsp + 0x60]
call fcn.180036368
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001c427
cmp dword [0x1800e52c0], 0
je 0x18001c554
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory1_1_0x_lx
lea r8, str.InstTpacketV
lea edx, [rax + 0x10]
lea rcx, [0x1800e5208]
call fcn.180018f90
jmp 0x18001c554
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0xc73
lea rdx, str.___________________________________________________________________________r_n__TPacket7.INF____NDIS_Usermode_I_O_Driver_r_n__r_n__Copyright__c__Microsoft_Corporation.__All_rights_reserved._r_n___________________________________________________________________________r_n_version__r_nSignature____t___Windows_NT___r_nClass______t_NetService_r_nClassGUID___t_4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____t__Msft__r_nDriverVer___t_03_17_2016_3.31.202.0_r_nCatalogFile_tpacket7.cat_r_n_r_n_Manufacturer__r_n_Msft_MSFT_NTx86_NTia64_NTamd64_r_n_r_n_MSFT.NTx86__r_n_TPacket7_Desc_Install__TPacket7_r_n_r_n_MSFT.NTia64__r_n_TPacket7_Desc_Install__TPacket7_r_n_r_n_MSFT.NTamd64__r_n_TPacket7_Desc_Install__TPacket7_r_n_r_n___________________________________________________________________________r_n__Installation_Section_r_n___________________________________________________________________________r_n_Install__r_nAddRegInst_Ndi_r_nCharacteristics0x40008_r_nNetCfgInstanceId_3f1eaa9f_7472_4d8e_a69f_b23588a92f1b__r_nCopyfiles__tpacket7.copyfiles.sys_r_n_r_n_SourceDisksNames__r_n1_TPacket7_Desc_______r_n_r_n_SourceDisksFiles__r_nTPacket7.sys1_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_nTPacket7.copyfiles.sys12_r_n_r_n_TPacket7.copyfiles.sys__r_nTPacket7.sys___2_r_n_r_n_r_n___________________________________________________________________________r_n__Ndi_installation_support_r_n___________________________________________________________________________r_n_Inst_Ndi__r_nHKR__Ndi_Service___TPacket7__r_nHKR__Ndi_CoServices_0x00010000__TPacket7__r_nHKR__Ndi_HelpText___TPacket7_HelpText__r_nHKR__Ndi_FilterClass___compression_r_nHKR__Ndi_FilterType_0x00010001_0x00000002_r_nHKR__NdiInterfaces_UpperRange___noupper__r_nHKR__NdiInterfaces_LowerRange___nolower__ndis5__r_nHKR__NdiInterfaces__FilterMediaTypes___ethernet__wan__atm__ndis5__r_nHKR__NdiInterfaces__LowerExclude_______ndisatm__ndiscowan__ndiswan__ndiswanasync__ndiswanipx__ndiswannbf__r_nHKR__Ndi_FilterRunType__0x00010001__2__this_filter_must_run_before_any_protocol_can_bind_to_the_below_miniport__r_n_r_n___________________________________________________________________________r_n__Service_installation_support_r_n___________________________________________________________________________r_n_Install.Services__r_nAddServiceTPacket7__TPacket7_Service_Inst_r_n_r_n_TPacket7_Service_Inst__r_nDisplayName_______TPacket7_Desc__r_nServiceType______1__SERVICE_KERNEL_DRIVER_r_nStartType________1__SERVICE_SYSTEM_START_r_nErrorControl_____1__SERVICE_ERROR_NORMAL_r_nServiceBinary_____12_TPacket7.sys_r_nLoadOrderGroup___NDIS_r_nDescription_______TPacket7_Desc__r_nAddReg___________Common.Params.reg_r_n_r_n_Install.Remove.Services__r_nDelServiceTPacket7_0x200_r_n_r_n_Install.Remove__r_nDelFiles__TPacket7.copyfiles.sys_r_n_r_n_Common.Params.reg__r_n_r_nHKR__FilterDriverParamsDriverParam___t_tParamDesc___t___Driverparam_for_lwf__r_nHKR__FilterDriverParamsDriverParam___t_tdefault___t___5__r_nHKR__FilterDriverParamsDriverParam___t_ttype___t_t___int__r_n_r_nHKR__FilterAdapterParamsAdapterParam___t_tParamDesc___t___Adapterparam_for_lwf__r_nHKR__FilterAdapterParamsAdapterParam___t_tdefault___t___10__r_nHKR__FilterAdapterParamsAdapterParam___t_ttype___t_t___int__r_n_r_n_Strings__r_nMsft___TEC_Solutions_Limited.__r_nTPacket7_Desc___TPacket7_Driver__r_nTPacket7_HelpText___TPacket7_Driver__r_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001c526
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001c4aa
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x160]
call fcn.18001b5e0
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001c526
cmp dword [0x1800e52c0], 0
je 0x18001c554
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x560]
lea rcx, [rsp + 0x48]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory1_10___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x48]
call fcn.180025870
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
jmp 0x18001c554
mov esi, 1
jmp 0x18001c554
cmp dword [0x1800e52c0], esi
je 0x18001c554
lea r9, str.PrepareInstallDirectory1_3
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
mov eax, esi
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.1800356a0
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret