Function at 0x18001a600
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x998]
sub rsp, 0xa70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800c4650]
xor rax, rsp
mov qword [rbp + 0x960], rax
mov r12, rcx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001a66a
test al, 0x10
jne 0x18001a68c
test al, 1
je 0x18001a661
and eax, 0xfffffffe
mov edx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.180030030
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18001ab5b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 6
je 0x18001a69f
mov edx, 6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [0x1800dfd84], esi
jne 0x18001a726
call fcn.180048a80
test eax, eax
jne 0x18001a6e1
call fcn.180048ad0
test eax, eax
je 0x18001a6c2
call fcn.180048b00
test eax, eax
je 0x18001a6e1
call fcn.180048b60
test eax, eax
jne 0x18001a6e1
call fcn.180048b00
test eax, eax
jne 0x18001a6e1
mov edi, 1
mov dword [0x1800dfd88], edi
jmp 0x18001a6e9
mov dword [0x1800dfd88], esi
mov edi, esi
mov dword [0x1800dfd84], 1
cmp dword [0x1800dde20], esi
je 0x18001a72c
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
lea r9, str.GetInstallNewDrive___lu____lu_
lea r8, str.CheckModule
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800ddd68]
call fcn.180017680
mov edi, dword [0x1800dfd88]
mov ecx, edi
call fcn.18000e8f0
mov r13, rax
lea r14, str.baktpkt7catt.sys
test edi, edi
je 0x18001a786
mov rax, qword [0x180081bb8]
mov qword [rsp + 0x40], rax
call fcn.18000e400
mov r8, rax
mov r9, r14
lea rdx, [0x180096e60]
lea rcx, [rsp + 0x40]
call fcn.180023e40
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.180030f90
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.180023290
test ebx, ebx
cmove edi, esi
lea rbx, str.baktpkt7cat.sys
test edi, edi
cmovne rbx, r14
mov word [rbp + 0x360], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x362]
call fcn.180034650
mov word [rbp + 0x560], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x562]
call fcn.180034650
mov word [rbp + 0x760], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x762]
call fcn.180034650
mov edx, 0x104
lea rcx, [rbp + 0x760]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r9, r13
lea r8, [rbp + 0x760]
lea rdx, [0x180096e60]
lea rcx, [rbp + 0x360]
call fcn.180033468
mov r9, rbx
lea r8, [rbp + 0x760]
lea rdx, [0x180096e60]
lea rcx, [rbp + 0x560]
call fcn.180033468
mov word [rsp + 0x60], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x62]
call fcn.180034650
mov word [rbp + 0x160], si
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x162]
call fcn.180034650
lea r9, str.tpacket7.sys
mov r8, r12
lea rdx, [0x180096e60]
lea rcx, [rsp + 0x60]
call fcn.180033468
lea r9, str.tpacket7.cat
mov r8, r12
lea rdx, [0x180096e60]
lea rcx, [rbp + 0x160]
call fcn.180033468
cmp dword [0x1800dde20], 0
je 0x18001a90e
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.180024700
mov rbx, rax
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x40]
call fcn.180024700
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_6___s_______s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800ddd68]
call fcn.180017680
nop
lea rcx, [rsp + 0x40]
call fcn.180023290
nop
lea rcx, [rsp + 0x48]
call fcn.180023290
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001a9d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001a959
lea rcx, [rsp + 0x60]
call fcn.180019d10
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001a9d6
cmp dword [0x1800dde20], 0
je 0x18001ab82
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180024700
mov rbx, rax
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x48]
call fcn.180024700
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory1_4___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800ddd68]
call fcn.180017680
nop
lea rcx, [rsp + 0x48]
call fcn.180023290
nop
lea rcx, [rsp + 0x40]
call fcn.180023290
jmp 0x18001ab82
lea r9, str.tpacket7.inf
mov r8, r12
lea rdx, [0x180096e60]
lea rcx, [rsp + 0x60]
call fcn.180033468
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001aa5a
cmp dword [0x1800dde20], 0
je 0x18001ab82
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory1_1_0x_lx
lea r8, str.InstTpacketV
lea edx, [rax + 0x10]
lea rcx, [0x1800ddd68]
call fcn.180017680
jmp 0x18001ab82
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0xc73
lea rdx, str.___________________________________________________________________________r_n__TPacket7.INF____NDIS_Usermode_I_O_Driver_r_n__r_n__Copyright__c__Microsoft_Corporation.__All_rights_reserved._r_n___________________________________________________________________________r_n_version__r_nSignature____t___Windows_NT___r_nClass______t_NetService_r_nClassGUID___t_4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____t__Msft__r_nDriverVer___t_03_17_2016_3.31.202.0_r_nCatalogFile_tpacket7.cat_r_n_r_n_Manufacturer__r_n_Msft_MSFT_NTx86_NTia64_NTamd64_r_n_r_n_MSFT.NTx86__r_n_TPacket7_Desc_Install__TPacket7_r_n_r_n_MSFT.NTia64__r_n_TPacket7_Desc_Install__TPacket7_r_n_r_n_MSFT.NTamd64__r_n_TPacket7_Desc_Install__TPacket7_r_n_r_n___________________________________________________________________________r_n__Installation_Section_r_n___________________________________________________________________________r_n_Install__r_nAddRegInst_Ndi_r_nCharacteristics0x40008_r_nNetCfgInstanceId_3f1eaa9f_7472_4d8e_a69f_b23588a92f1b__r_nCopyfiles__tpacket7.copyfiles.sys_r_n_r_n_SourceDisksNames__r_n1_TPacket7_Desc_______r_n_r_n_SourceDisksFiles__r_nTPacket7.sys1_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_nTPacket7.copyfiles.sys12_r_n_r_n_TPacket7.copyfiles.sys__r_nTPacket7.sys___2_r_n_r_n_r_n___________________________________________________________________________r_n__Ndi_installation_support_r_n___________________________________________________________________________r_n_Inst_Ndi__r_nHKR__Ndi_Service___TPacket7__r_nHKR__Ndi_CoServices_0x00010000__TPacket7__r_nHKR__Ndi_HelpText___TPacket7_HelpText__r_nHKR__Ndi_FilterClass___compression_r_nHKR__Ndi_FilterType_0x00010001_0x00000002_r_nHKR__NdiInterfaces_UpperRange___noupper__r_nHKR__NdiInterfaces_LowerRange___nolower__ndis5__r_nHKR__NdiInterfaces__FilterMediaTypes___ethernet__wan__atm__ndis5__r_nHKR__NdiInterfaces__LowerExclude_______ndisatm__ndiscowan__ndiswan__ndiswanasync__ndiswanipx__ndiswannbf__r_nHKR__Ndi_FilterRunType__0x00010001__2__this_filter_must_run_before_any_protocol_can_bind_to_the_below_miniport__r_n_r_n___________________________________________________________________________r_n__Service_installation_support_r_n___________________________________________________________________________r_n_Install.Services__r_nAddServiceTPacket7__TPacket7_Service_Inst_r_n_r_n_TPacket7_Service_Inst__r_nDisplayName_______TPacket7_Desc__r_nServiceType______1__SERVICE_KERNEL_DRIVER_r_nStartType________1__SERVICE_SYSTEM_START_r_nErrorControl_____1__SERVICE_ERROR_NORMAL_r_nServiceBinary_____12_TPacket7.sys_r_nLoadOrderGroup___NDIS_r_nDescription_______TPacket7_Desc__r_nAddReg___________Common.Params.reg_r_n_r_n_Install.Remove.Services__r_nDelServiceTPacket7_0x200_r_n_r_n_Install.Remove__r_nDelFiles__TPacket7.copyfiles.sys_r_n_r_n_Common.Params.reg__r_n_r_nHKR__FilterDriverParamsDriverParam___t_tParamDesc___t___Driverparam_for_lwf__r_nHKR__FilterDriverParamsDriverParam___t_tdefault___t___5__r_nHKR__FilterDriverParamsDriverParam___t_ttype___t_t___int__r_n_r_nHKR__FilterAdapterParamsAdapterParam___t_tParamDesc___t___Adapterparam_for_lwf__r_nHKR__FilterAdapterParamsAdapterParam___t_tdefault___t___10__r_nHKR__FilterAdapterParamsAdapterParam___t_ttype___t_t___int__r_n_r_n_Strings__r_nMsft___TEC_Solutions_Limited.__r_nTPacket7_Desc___TPacket7_Driver__r_nTPacket7_HelpText___TPacket7_Driver__r_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001ab54
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001aad8
lea rcx, [rbp + 0x160]
call fcn.180019d10
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001ab54
cmp dword [0x1800dde20], 0
je 0x18001ab82
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.180024700
mov rbx, rax
lea rdx, [rbp + 0x560]
lea rcx, [rsp + 0x48]
call fcn.180024700
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory1_10___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800ddd68]
call fcn.180017680
nop
lea rcx, [rsp + 0x48]
call fcn.180023290
nop
lea rcx, [rsp + 0x40]
call fcn.180023290
jmp 0x18001ab82
mov esi, 1
jmp 0x18001ab82
cmp dword [0x1800dde20], esi
je 0x18001ab82
lea r9, str.PrepareInstallDirectory1_3
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800ddd68]
call fcn.180017680
mov eax, esi
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.1800327a0
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret