Function at 0x40d7d0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x304
push ebx
push ebp
push esi
push edi
push 6
push str.C:TpacketV
xor ebx, ebx
call fcn.0040a820
add esp, 8
test eax, eax
je 0x40d996
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x214]
push str.baktpktv.sys
push ecx
lea edx, [esp + 0x11c]
push 0x47c054
push edx
call fcn.0041198f
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0x10
stosb byte es:[edi], al
push str.tpacketv.sys
push str.C:TpacketV
lea eax, [esp + 0x1c]
push 0x47c054
push eax
call fcn.0041198f
lea ecx, [esp + 0x24]
push ebx
lea edx, [esp + 0x128]
push ecx
push edx
call fcn.00406a40
add esp, 0x1c
test eax, eax
je 0x40d9bc
push str.netsf.inf
push str.C:TpacketV
lea eax, [esp + 0x1c]
push 0x47c054
push eax
call fcn.0041198f
add esp, 0x10
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x14]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x40d9ef
lea edx, [esp + 0x10]
push ebx
push edx
mov edx, dword [str._____NETSF.INF____r_n__r_n__Tpacketv_driver_INF_file___this_is_the_INF_for_the_service__protocol__r_n__part._r_n__r_n__Copyright__c__1993_2001__Microsoft_Corporation_r_n__r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_in_this_INF_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._In_general_a_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____Since_Windows_2000_systems_do_not_have_support_for_CopyINF_directive__r_n_____a_notify_object_is_required_to_programmatically_copy_the_miniport_INF___r_n_____file_to_the_system_INF_directory._Previous_versions_of_this_INF_file_r_n_____erroneously_used_to_copy_the_INF_files_directly_by_using_the_CopyFiles__r_n_____directive._r_n_____On_Windows_XP__you_can_install_a_filter_IM_without_a_notify_object._r_n_____by_following_the_instructions_in__4_._r_n__r_n__3._If_you_want_to_use_this_INF_file_with_your_own_IM_driver__please_r_n_____make_the_following_modifications:_r_n_____File_netsf.inf_r_n____________________r_n_____a._In_section__SourceDiskFiles__and__Tpacketv.Files.Sys__r_n________change_tpacketv.sys_to_the_name_of_your_own_driver_binary._r_n_____b._In_section__Tpacketv.ndi.AddReg___change_values_of_r_n________BindForm_and_MiniportId_to_appropriate_values._r_n_____File_netsf_m.inf_r_n______________________r_n_____a._Replace_MS_TpacketvMP_with_InfId_of_your_miniport._r_n_____b._In_section__TpacketvMP.AddService___r_n________change_ServiceBinary_appropriately._r_n_____c._In_section__TpacketvMP.ndi.AddReg___r_n________change__Tpacketv__in_the_line_having__Service__r_n________to_reflect_the_appropriate_name_r_n__r_n__r_n_________________________________________________________________________r_n_r_n_Version__r_nSignature_____Windows_NT___r_nClass_______NetService_r_nClassGUID___4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____Msft__r_nDriverVer__10_01_2002_6.0.5019.0_r_n_r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_ControlFlags__r_n_r_n__r_n__r_n__r_n_For_Win2K_r_n_r_n_MSFT__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n__r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTia64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTamd64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_r_n_Tpacketv.ndi__r_nAddReg___________Tpacketv.ndi.AddReg__Tpacketv.AddReg_r_nCharacteristics__0x4418____NCF_FILTER__NCF_NDIS_PROTOCOL__NCF_HIDEN____Filter_Specific_____r_nCopyFiles________Tpacketv.Files.Sys_r_nCopyInf__________netsf_m.inf_r_n_r_n_Tpacketv.ndi.Remove__r_nDelFiles__Tpacketv.Files.Sys_r_n_r_n_Tpacketv.ndi.Services__r_nAddService__Tpacketv___Tpacketv.AddService_r_n_r_n_Tpacketv.AddService__r_nDisplayName______TpacketvService_Desc__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________Tpacketv.AddService.AddReg_r_n_r_n_r_n_Tpacketv.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_r_n_________________________________________________________________________r_n__File_copy_r_n__r_n_SourceDisksNames__r_n1_DiskDescription______]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], ebx
repne scasb al, byte es:[edi]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
not ecx
dec ecx
push ecx
push edx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.netsf_m.inf
push str.C:TpacketV
lea eax, [esp + 0x1c]
push 0x47c054
push eax
call fcn.0041198f
add esp, 0x10
lea ecx, [esp + 0x14]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x40da17
lea edx, [esp + 0x10]
push 0
push edx
mov edx, dword [str._____NETSF_M.INF____r_n__r_n__Tpacketv_Miniport_INF_file_r_n__r_n__Copyright__c__1993_1999__Microsoft_Corporation_r_n_r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_here_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._A_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____This_sample_uses_a_notify_object_as_an_example_only._If_you_do_not_r_n_____want_to_use_a_notify_object__please_comment_out_the_lines_that_add_r_n_____ClsId_and_ComponentDll_registry_keys._r_n_________________________________________________________________________r_n_r_n_Version__r_nsignature_____Windows_NT___r_nClass_______Net_r_nClassGUID___4d36e972_e325_11ce_bfc1_08002be10318_r_nProvider_____Msft__r_nDriverVer__10_01_2002_6.0.5019.0_r_n_r_n_ControlFlags__r_nExcludeFromSelect__ms_tpacketvmp_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_n__No_files_to_copy__r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_For_Win2K_r_n_r_n_MSFT__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTia64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTamd64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_r_n_TpacketvMP.ndi__r_nAddReg___TpacketvMP.ndi.AddReg_r_nCharacteristics__0x29__NCF_NOT_USER_REMOVABLE__NCF_VIRTUAL__NCF_HIDDEN_r_n_r_n_TpacketvMP.ndi.AddReg__r_nHKR__Ndi__Service___0___TpacketvMP_r_n_r_n_TpacketvMP.ndi.Services__r_nAddService__TpacketvMP_0x2__TpacketvMP.AddService_r_n_r_n_r_n_TpacketvMP.AddService__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________TpacketvMP.AddService.AddReg_r_n_r_n_r_n_TpacketvMP.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_Strings__r_nMsft___Microsoft__r_nTpacketvMP_Desc___Tpacketv_Miniport__r_n_r_n_SourceDisksNames__r_n_None__r_n_r_n_SourceDisksFiles__r_n_None_r_n_r_n_r_n]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x304
ret
push str.PrepareInstallDirectory_3
push str.InstTpacketV
push 0xffffffffffffffff
push 0x4858f4
call fcn.0040c750
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x304
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x114]
push eax
push ecx
push str.PrepareInstallDirectory_4___S____S_
push str.InstTpacketV
push 0xffffffffffffffff
push 0x4858f4
call fcn.0040c750
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x304
ret
push 0xffffffffffffffff
push str.PrepareInstallDirectory_1_0x_lx
push str.InstTpacketV
push 0xffffffffffffffff
push 0x4858f4
call fcn.0040c750
add esp, 0x14
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x304
ret
push 0xffffffffffffffff
push str.PrepareInstallDirectory_2_0x_lx
push str.InstTpacketV
push 0xffffffffffffffff
push 0x4858f4
call fcn.0040c750
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x304
ret