Function at 0x1800099a0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push rdi
sub rsp, 0xe70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xe80], rbx
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0xe60], rax
xor edi, edi
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180009a07
test al, 0x10
jne 0x180009a31
test al, 1
je 0x1800099fa
and eax, 0xfffffffe
mov edx, eax
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.180018a40
mov rdx, rax
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18000a077
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x16
je 0x180009a48
mov edx, 6
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, str.baktpktv.sys
call fcn.18002f9f0
test eax, eax
je 0x180009a86
cmp dword [0x1800b1b40], edi
je 0x180009a7f
lea r9, str.PrepareInstallDirectory_5
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800b1a88]
call fcn.180008e60
lea rbx, str.baktpktv64.sys
mov word [rsp + 0x260], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x262]
call fcn.18001ab30
mov word [rsp + 0xa60], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xa62]
call fcn.18001ab30
mov word [rsp + 0xc60], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc62]
call fcn.18001ab30
mov word [rsp + 0x660], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x662]
call fcn.18001ab30
mov edx, 0x104
lea rcx, [rsp + 0x660]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r9, rbx
lea r8, [rsp + 0x660]
lea rdx, str._s_s
lea rcx, [rsp + 0x260]
call fcn.180019b90
lea r9, str.baktpktvcat.sys
lea r8, [rsp + 0x660]
lea rdx, str._s_s
lea rcx, [rsp + 0xa60]
call fcn.180019b90
lea r9, str.baktpktvmcat.sys
lea r8, [rsp + 0x660]
lea rdx, str._s_s
lea rcx, [rsp + 0xc60]
call fcn.180019b90
mov word [rsp + 0x60], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x62]
call fcn.18001ab30
mov word [rsp + 0x860], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x862]
call fcn.18001ab30
mov word [rsp + 0x460], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x462]
call fcn.18001ab30
lea r9, str.tpacketv.sys
lea r8, str.C:TpacketV
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
call fcn.180019b90
lea r9, str.netsf.cat
lea r8, str.C:TpacketV
lea rdx, str._s_s
lea rcx, [rsp + 0x860]
call fcn.180019b90
lea r9, str.netsf_m.cat
lea r8, str.C:TpacketV
lea rdx, str._s_s
lea rcx, [rsp + 0x460]
call fcn.180019b90
cmp dword [0x1800b1b40], edi
je 0x180009c9a
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800143f0
mov rbx, rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
call fcn.1800143f0
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_6___s_______s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800b1a88]
call fcn.180008e60
nop
lea rcx, [rsp + 0x50]
call fcn.180013520
nop
lea rcx, [rsp + 0x40]
call fcn.180013520
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009d65
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180009ce7
lea rcx, [rsp + 0x60]
call fcn.180005300
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009d65
cmp dword [0x1800b1b40], 0
je 0x18000a09e
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800143f0
mov rbx, rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x40]
call fcn.1800143f0
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_7___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800b1a88]
call fcn.180008e60
nop
lea rcx, [rsp + 0x40]
call fcn.180013520
nop
lea rcx, [rsp + 0x50]
call fcn.180013520
jmp 0x18000a09e
xor r8d, r8d
lea rdx, [rsp + 0x860]
lea rcx, [rsp + 0xa60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009e39
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180009dbb
lea rcx, [rsp + 0x860]
call fcn.180005300
xor r8d, r8d
lea rdx, [rsp + 0x860]
lea rcx, [rsp + 0xa60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009e39
cmp dword [0x1800b1b40], 0
je 0x18000a09e
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800143f0
mov rbx, rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x40]
call fcn.1800143f0
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_8___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800b1a88]
call fcn.180008e60
nop
lea rcx, [rsp + 0x40]
call fcn.180013520
nop
lea rcx, [rsp + 0x50]
call fcn.180013520
jmp 0x18000a09e
xor r8d, r8d
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0xc60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009f0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180009e8f
lea rcx, [rsp + 0x460]
call fcn.180005300
xor r8d, r8d
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0xc60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180009f0d
cmp dword [0x1800b1b40], 0
je 0x18000a09e
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1800143f0
mov rbx, rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x40]
call fcn.1800143f0
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_9___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800b1a88]
call fcn.180008e60
nop
lea rcx, [rsp + 0x40]
call fcn.180013520
nop
lea rcx, [rsp + 0x50]
call fcn.180013520
jmp 0x18000a09e
lea r9, str.netsf.inf
lea r8, str.C:TpacketV
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
call fcn.180019b90
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180009f95
cmp dword [0x1800b1b40], 0
je 0x18000a09e
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_1_0x_lx
lea r8, str.InstTpacketV
lea edx, [rax + 0x10]
lea rcx, [0x1800b1a88]
call fcn.180008e60
jmp 0x18000a09e
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov r8d, 0x1582
lea rdx, str._____NETSF.INF____r_n__r_n__Tpacketv_driver_INF_file___this_is_the_INF_for_the_service__protocol__r_n__part._r_n__r_n__Copyright__c__1993_2001__Microsoft_Corporation_r_n__r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_in_this_INF_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._In_general_a_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____Since_Windows_2000_systems_do_not_have_support_for_CopyINF_directive__r_n_____a_notify_object_is_required_to_programmatically_copy_the_miniport_INF___r_n_____file_to_the_system_INF_directory._Previous_versions_of_this_INF_file_r_n_____erroneously_used_to_copy_the_INF_files_directly_by_using_the_CopyFiles__r_n_____directive._r_n_____On_Windows_XP__you_can_install_a_filter_IM_without_a_notify_object._r_n_____by_following_the_instructions_in__4_._r_n__r_n__3._If_you_want_to_use_this_INF_file_with_your_own_IM_driver__please_r_n_____make_the_following_modifications:_r_n_____File_netsf.inf_r_n____________________r_n_____a._In_section__SourceDiskFiles__and__Tpacketv.Files.Sys__r_n________change_tpacketv.sys_to_the_name_of_your_own_driver_binary._r_n_____b._In_section__Tpacketv.ndi.AddReg___change_values_of_r_n________BindForm_and_MiniportId_to_appropriate_values._r_n_____File_netsf_m.inf_r_n______________________r_n_____a._Replace_MS_TpacketvMP_with_InfId_of_your_miniport._r_n_____b._In_section__TpacketvMP.AddService___r_n________change_ServiceBinary_appropriately._r_n_____c._In_section__TpacketvMP.ndi.AddReg___r_n________change__Tpacketv__in_the_line_having__Service__r_n________to_reflect_the_appropriate_name_r_n__r_n__r_n_________________________________________________________________________r_n_r_n_Version__r_nSignature_____Windows_NT___r_nClass_______NetService_r_nClassGUID___4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____Msft__r_nDriverVer__10_01_2012_6.0.5019.0_r_nCatalogFile_netsf.cat_r_n_r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_ControlFlags__r_n_r_n__r_n__r_n__r_n_For_Win2K_r_n_r_n_MSFT__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n__r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTia64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTamd64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_r_n_Tpacketv.ndi__r_nAddReg___________Tpacketv.ndi.AddReg__Tpacketv.AddReg_r_nCharacteristics__0x4418____NCF_FILTER__NCF_NDIS_PROTOCOL__NCF_HIDEN____Filter_Specific_____r_nCopyFiles________Tpacketv.Files.Sys_r_nCopyInf__________netsf_m.inf_r_n_r_n_Tpacketv.ndi.Remove__r_nDelFiles__Tpacketv.Files.Sys_r_n_r_n_Tpacketv.ndi.Services__r_nAddService__Tpacketv___Tpacketv.AddService_r_n_r_n_Tpacketv.AddService__r_nDisplayName______TpacketvService_Desc__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________Tpacketv.AddService.AddReg_r_n_r_n_r_n_Tpacketv.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_r_n_________________________________________________________________________r_n__File_copy_r_n__r_n_SourceDisksNames__r
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.netsf_m.inf
lea r8, str.C:TpacketV
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
call fcn.180019b90
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000a043
cmp dword [0x1800b1b40], 0
je 0x18000a09e
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_2_0x_lx
lea r8, str.InstTpacketV
lea edx, [rax + 0x10]
lea rcx, [0x1800b1a88]
call fcn.180008e60
jmp 0x18000a09e
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov r8d, 0xa5a
lea rdx, str._____NETSF_M.INF____r_n__r_n__Tpacketv_Miniport_INF_file_r_n__r_n__Copyright__c__1993_1999__Microsoft_Corporation_r_n_r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_here_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._A_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____This_sample_uses_a_notify_object_as_an_example_only._If_you_do_not_r_n_____want_to_use_a_notify_object__please_comment_out_the_lines_that_add_r_n_____ClsId_and_ComponentDll_registry_keys._r_n_________________________________________________________________________r_n_r_n_Version__r_nsignature_____Windows_NT___r_nClass_______Net_r_nClassGUID___4d36e972_e325_11ce_bfc1_08002be10318_r_nProvider_____Msft__r_nDriverVer__10_01_2012_6.0.5019.0_r_nCatalogFile__netsf_m.cat_r_n_r_n_ControlFlags__r_nExcludeFromSelect__ms_tpacketvmp_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_n__No_files_to_copy__r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_For_Win2K_r_n_r_n_MSFT__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTia64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTamd64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_r_n_TpacketvMP.ndi__r_nAddReg___TpacketvMP.ndi.AddReg_r_nCharacteristics__0x29__NCF_NOT_USER_REMOVABLE__NCF_VIRTUAL__NCF_HIDDEN_r_n_r_n_TpacketvMP.ndi.AddReg__r_nHKR__Ndi__Service___0___TpacketvMP_r_n_r_n_TpacketvMP.ndi.Services__r_nAddService__TpacketvMP_0x2__TpacketvMP.AddService_r_n_r_n_r_n_TpacketvMP.AddService__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________TpacketvMP.AddService.AddReg_r_n_r_n_r_n_TpacketvMP.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_Strings__r_nMsft___Microsoft__r_nTpacketvMP_Desc___Tpacketv_Miniport__r_n_r_n_SourceDisksNames__r_n_None__r_n_r_n_SourceDisksFiles__r_n_None_r_n_r_n_r_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x18000a09e
cmp dword [0x1800b1b40], edi
je 0x18000a09e
lea r9, str.PrepareInstallDirectory_3
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800b1a88]
call fcn.180008e60
mov eax, edi
mov rcx, qword [rsp + 0xe60]
xor rcx, rsp
call fcn.1800190b0
mov rbx, qword [rsp + 0xe80]
add rsp, 0xe70
pop rdi
ret