Function at 0x180019b30
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd78]
sub rsp, 0xe70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1800cb660]
xor rax, rsp
mov qword [rbp + 0xd60], rax
xor edi, edi
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180019b9f
test al, 0x10
jne 0x180019bc9
test al, 1
je 0x180019b92
and eax, 0xfffffffe
mov edx, eax
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.180032e00
mov rdx, rax
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18001a1ef
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x16
je 0x180019be0
mov edx, 6
lea rcx, str.C:TpacketV
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, str.baktpktv.sys
call fcn.18004b880
test eax, eax
je 0x180019c1e
cmp dword [0x1800e52c0], edi
je 0x180019c17
lea r9, str.PrepareInstallDirectory_5
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
lea rbx, str.baktpktv64.sys
mov word [rbp + 0x160], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x162]
call fcn.180037550
mov word [rbp + 0x960], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x962]
call fcn.180037550
mov word [rbp + 0xb60], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xb62]
call fcn.180037550
mov word [rbp + 0x560], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x562]
call fcn.180037550
call fcn.18000f620
mov rdx, rax
mov r8d, 0xff
lea rcx, [rbp + 0x560]
call fcn.180035de4
mov r9, rbx
lea r8, [rbp + 0x560]
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x160]
call fcn.180036368
lea r9, str.baktpktvcat.sys
lea r8, [rbp + 0x560]
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x960]
call fcn.180036368
lea r9, str.baktpktvmcat.sys
lea r8, [rbp + 0x560]
lea rdx, [0x18009c688]
lea rcx, [rbp + 0xb60]
call fcn.180036368
mov word [rsp + 0x60], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x62]
call fcn.180037550
mov word [rbp + 0x760], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x762]
call fcn.180037550
mov word [rbp + 0x360], di
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x362]
call fcn.180037550
lea r9, str.tpacketv.sys
lea r8, str.C:TpacketV
lea rdx, [0x18009c688]
lea rcx, [rsp + 0x60]
call fcn.180036368
lea r9, str.netsf.cat
lea r8, str.C:TpacketV
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x760]
call fcn.180036368
lea r9, str.netsf_m.cat
lea r8, str.C:TpacketV
lea rdx, [0x18009c688]
lea rcx, [rbp + 0x360]
call fcn.180036368
cmp dword [0x1800e52c0], edi
je 0x180019e24
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_6___s_______s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x50]
call fcn.180025870
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180019ef1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180019e74
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180012250
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180019ef1
cmp dword [0x1800e52c0], 0
je 0x18001a216
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_7___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
nop
lea rcx, [rsp + 0x50]
call fcn.180025870
jmp 0x18001a216
xor r8d, r8d
lea rdx, [rbp + 0x760]
lea rcx, [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180019fc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180019f47
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x760]
call fcn.180012250
xor r8d, r8d
lea rdx, [rbp + 0x760]
lea rcx, [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180019fc4
cmp dword [0x1800e52c0], 0
je 0x18001a216
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_8___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
nop
lea rcx, [rsp + 0x50]
call fcn.180025870
jmp 0x18001a216
xor r8d, r8d
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xb60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001a097
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001a01a
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x360]
call fcn.180012250
xor r8d, r8d
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xb60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18001a097
cmp dword [0x1800e52c0], 0
je 0x18001a216
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.180027390
mov rbx, rax
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.180027390
mov r11, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [r11]
mov qword [rsp + 0x20], rax
lea r9, str.PrepareInstallDirectory_9___s____s_
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
nop
lea rcx, [rsp + 0x40]
call fcn.180025870
nop
lea rcx, [rsp + 0x50]
call fcn.180025870
jmp 0x18001a216
lea r9, str.netsf.inf
lea r8, str.C:TpacketV
lea rdx, [0x18009c688]
lea rcx, [rsp + 0x60]
call fcn.180036368
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001a125
cmp dword [0x1800e52c0], 0
je 0x18001a216
lea r9, str.PrepareInstallDirectory_1_0x_lx
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
jmp 0x18001a216
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov r8d, 0x1582
lea rdx, str._____NETSF.INF____r_n__r_n__Tpacketv_driver_INF_file___this_is_the_INF_for_the_service__protocol__r_n__part._r_n__r_n__Copyright__c__1993_2001__Microsoft_Corporation_r_n__r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_in_this_INF_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._In_general_a_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____Since_Windows_2000_systems_do_not_have_support_for_CopyINF_directive__r_n_____a_notify_object_is_required_to_programmatically_copy_the_miniport_INF___r_n_____file_to_the_system_INF_directory._Previous_versions_of_this_INF_file_r_n_____erroneously_used_to_copy_the_INF_files_directly_by_using_the_CopyFiles__r_n_____directive._r_n_____On_Windows_XP__you_can_install_a_filter_IM_without_a_notify_object._r_n_____by_following_the_instructions_in__4_._r_n__r_n__3._If_you_want_to_use_this_INF_file_with_your_own_IM_driver__please_r_n_____make_the_following_modifications:_r_n_____File_netsf.inf_r_n____________________r_n_____a._In_section__SourceDiskFiles__and__Tpacketv.Files.Sys__r_n________change_tpacketv.sys_to_the_name_of_your_own_driver_binary._r_n_____b._In_section__Tpacketv.ndi.AddReg___change_values_of_r_n________BindForm_and_MiniportId_to_appropriate_values._r_n_____File_netsf_m.inf_r_n______________________r_n_____a._Replace_MS_TpacketvMP_with_InfId_of_your_miniport._r_n_____b._In_section__TpacketvMP.AddService___r_n________change_ServiceBinary_appropriately._r_n_____c._In_section__TpacketvMP.ndi.AddReg___r_n________change__Tpacketv__in_the_line_having__Service__r_n________to_reflect_the_appropriate_name_r_n__r_n__r_n_________________________________________________________________________r_n_r_n_Version__r_nSignature_____Windows_NT___r_nClass_______NetService_r_nClassGUID___4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____Msft__r_nDriverVer__10_01_2012_6.0.5019.0_r_nCatalogFile_netsf.cat_r_n_r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_ControlFlags__r_n_r_n__r_n__r_n__r_n_For_Win2K_r_n_r_n_MSFT__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n__r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTia64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTamd64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_r_n_Tpacketv.ndi__r_nAddReg___________Tpacketv.ndi.AddReg__Tpacketv.AddReg_r_nCharacteristics__0x4418____NCF_FILTER__NCF_NDIS_PROTOCOL__NCF_HIDEN____Filter_Specific_____r_nCopyFiles________Tpacketv.Files.Sys_r_nCopyInf__________netsf_m.inf_r_n_r_n_Tpacketv.ndi.Remove__r_nDelFiles__Tpacketv.Files.Sys_r_n_r_n_Tpacketv.ndi.Services__r_nAddService__Tpacketv___Tpacketv.AddService_r_n_r_n_Tpacketv.AddService__r_nDisplayName______TpacketvService_Desc__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________Tpacketv.AddService.AddReg_r_n_r_n_r_n_Tpacketv.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_r_n_________________________________________________________________________r_n__File_copy_r_n__r_n_SourceDisksNames__r
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.netsf_m.inf
lea r8, str.C:TpacketV
lea rdx, [0x18009c688]
lea rcx, [rsp + 0x60]
call fcn.180036368
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001a1bb
cmp dword [0x1800e52c0], 0
je 0x18001a216
lea r9, str.PrepareInstallDirectory_2_0x_lx
jmp 0x18001a0ff
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov r8d, 0xa5a
lea rdx, str._____NETSF_M.INF____r_n__r_n__Tpacketv_Miniport_INF_file_r_n__r_n__Copyright__c__1993_1999__Microsoft_Corporation_r_n_r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_here_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._A_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____This_sample_uses_a_notify_object_as_an_example_only._If_you_do_not_r_n_____want_to_use_a_notify_object__please_comment_out_the_lines_that_add_r_n_____ClsId_and_ComponentDll_registry_keys._r_n_________________________________________________________________________r_n_r_n_Version__r_nsignature_____Windows_NT___r_nClass_______Net_r_nClassGUID___4d36e972_e325_11ce_bfc1_08002be10318_r_nProvider_____Msft__r_nDriverVer__10_01_2012_6.0.5019.0_r_nCatalogFile__netsf_m.cat_r_n_r_n_ControlFlags__r_nExcludeFromSelect__ms_tpacketvmp_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_n__No_files_to_copy__r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_For_Win2K_r_n_r_n_MSFT__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTia64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTamd64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_r_n_TpacketvMP.ndi__r_nAddReg___TpacketvMP.ndi.AddReg_r_nCharacteristics__0x29__NCF_NOT_USER_REMOVABLE__NCF_VIRTUAL__NCF_HIDDEN_r_n_r_n_TpacketvMP.ndi.AddReg__r_nHKR__Ndi__Service___0___TpacketvMP_r_n_r_n_TpacketvMP.ndi.Services__r_nAddService__TpacketvMP_0x2__TpacketvMP.AddService_r_n_r_n_r_n_TpacketvMP.AddService__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________TpacketvMP.AddService.AddReg_r_n_r_n_r_n_TpacketvMP.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_Strings__r_nMsft___Microsoft__r_nTpacketvMP_Desc___Tpacketv_Miniport__r_n_r_n_SourceDisksNames__r_n_None__r_n_r_n_SourceDisksFiles__r_n_None_r_n_r_n_r_n
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x18001a216
cmp dword [0x1800e52c0], edi
je 0x18001a216
lea r9, str.PrepareInstallDirectory_3
lea r8, str.InstTpacketV
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [0x1800e5208]
call fcn.180018f90
mov eax, edi
mov rcx, qword [rbp + 0xd60]
xor rcx, rsp
call fcn.1800356a0
lea r11, [rsp + 0xe70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret