Function at 0x411b6d
Capabilities:
Get common file path
Write file on windows

Disassembly:
jmp 0x411b40
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55550c
push eax
mov dword fs:[0], esp
sub esp, 0x314
push ebx
push ebp
push esi
push edi
push 0x5967cc
xor ebx, ebx
xor ebp, ebp
call fcn.0045fcf0
push 6
push 0x5967cc
call fcn.0045de20
add esp, 0xc
test eax, eax
je 0x411db8
mov esi, str.baktpktv.sys
call fcn.00468300
test eax, eax
je 0x411bb0
push str.PrepareInstallDirectory_5
push str.InstTpacketV
push 0xffffffffffffffff
push 0x5b200c
call fcn.00452100
add esp, 0x10
mov esi, str.baktpktv64.sys
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x125]
mov byte [esp + 0x124], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x224]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x224]
push esi
push ecx
lea edx, [esp + 0x12c]
push 0x591ecc
push edx
call fcn.00421a02
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0x10
stosb byte es:[edi], al
push str.tpacketv.sys
push 0x5967cc
lea eax, [esp + 0x2c]
push 0x591ecc
push eax
call fcn.00421a02
add esp, 0x10
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x24]
call fcn.0043a5d0
mov esi, eax
lea edx, [esp + 0x124]
lea ecx, [esp + 0x1c]
push edx
mov dword [esp + 0x330], ebx
call fcn.0043a5d0
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
push str.PrepareInstallDirectory_6___s_______s_
or edi, 0xffffffff
push str.InstTpacketV
push edi
push 0x5b200c
mov byte [esp + 0x344], 1
call fcn.00452100
add esp, 0x18
lea ecx, [esp + 0x1c]
mov byte [esp + 0x32c], bl
call fcn.0043af50
lea ecx, [esp + 0x20]
mov dword [esp + 0x32c], edi
call fcn.0043af50
lea eax, [esp + 0x24]
push ebx
lea ecx, [esp + 0x128]
push eax
push ecx
call fcn.0045c740
add esp, 0xc
test eax, eax
je 0x411dd8
push 0x596720
push 0x5967cc
lea edx, [esp + 0x2c]
push 0x591ecc
push edx
call fcn.00421a02
add esp, 0x10
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [esp + 0x24]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x411e4f
mov edx, dword [str._____NETSF.INF____r_n__r_n__Tpacketv_driver_INF_file___this_is_the_INF_for_the_service__protocol__r_n__part._r_n__r_n__Copyright__c__1993_2001__Microsoft_Corporation_r_n__r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_in_this_INF_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._In_general_a_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____Since_Windows_2000_systems_do_not_have_support_for_CopyINF_directive__r_n_____a_notify_object_is_required_to_programmatically_copy_the_miniport_INF___r_n_____file_to_the_system_INF_directory._Previous_versions_of_this_INF_file_r_n_____erroneously_used_to_copy_the_INF_files_directly_by_using_the_CopyFiles__r_n_____directive._r_n_____On_Windows_XP__you_can_install_a_filter_IM_without_a_notify_object._r_n_____by_following_the_instructions_in__4_._r_n__r_n__3._If_you_want_to_use_this_INF_file_with_your_own_IM_driver__please_r_n_____make_the_following_modifications:_r_n_____File_netsf.inf_r_n____________________r_n_____a._In_section__SourceDiskFiles__and__Tpacketv.Files.Sys__r_n________change_tpacketv.sys_to_the_name_of_your_own_driver_binary._r_n_____b._In_section__Tpacketv.ndi.AddReg___change_values_of_r_n________BindForm_and_MiniportId_to_appropriate_values._r_n_____File_netsf_m.inf_r_n______________________r_n_____a._Replace_MS_TpacketvMP_with_InfId_of_your_miniport._r_n_____b._In_section__TpacketvMP.AddService___r_n________change_ServiceBinary_appropriately._r_n_____c._In_section__TpacketvMP.ndi.AddReg___r_n________change__Tpacketv__in_the_line_having__Service__r_n________to_reflect_the_appropriate_name_r_n__r_n__r_n_________________________________________________________________________r_n_r_n_Version__r_nSignature_____Windows_NT___r_nClass_______NetService_r_nClassGUID___4D36E974_E325_11CE_BFC1_08002BE10318_r_nProvider_____Msft__r_nDriverVer__10_01_2002_6.0.5019.0_r_n_r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_ControlFlags__r_n_r_n__r_n__r_n__r_n_For_Win2K_r_n_r_n_MSFT__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n__r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTia64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_MSFT.NTamd64__r_n_Tpacketv_Desc___Tpacketv.ndi__ms_tpacketv_r_n_r_n_r_n_Tpacketv.ndi__r_nAddReg___________Tpacketv.ndi.AddReg__Tpacketv.AddReg_r_nCharacteristics__0x4418____NCF_FILTER__NCF_NDIS_PROTOCOL__NCF_HIDEN____Filter_Specific_____r_nCopyFiles________Tpacketv.Files.Sys_r_nCopyInf__________netsf_m.inf_r_n_r_n_Tpacketv.ndi.Remove__r_nDelFiles__Tpacketv.Files.Sys_r_n_r_n_Tpacketv.ndi.Services__r_nAddService__Tpacketv___Tpacketv.AddService_r_n_r_n_Tpacketv.AddService__r_nDisplayName______TpacketvService_Desc__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________Tpacketv.AddService.AddReg_r_n_r_n_r_n_Tpacketv.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_r_n_________________________________________________________________________r_n__File_copy_r_n__r_n_SourceDisksNames__r_n1_DiskDescription______]
lea ecx, [esp + 0x10]
push ebx
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x596710
push 0x5967cc
lea edx, [esp + 0x2c]
push 0x591ecc
push edx
call fcn.00421a02
add esp, 0x10
lea eax, [esp + 0x24]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x411e58
mov edx, dword [str._____NETSF_M.INF____r_n__r_n__Tpacketv_Miniport_INF_file_r_n__r_n__Copyright__c__1993_1999__Microsoft_Corporation_r_n_r_n_________________________________________________________________________r_n__Notes:_r_n__0._The_term__filter__is_used_here_to_refer_to_an_NDIS_IM_driver_that_r_n_____implements_a_1:1_relationship_between_upper_and_lower_bindings._r_n__1._Items_specifically_required_for_a_filter_have_been_marked_with_r_n__________Filter_Specific______keyword_r_n__2._A_filter_DOES_NOT_require_a_notify_object_for_proper_installation._r_n_____A_notify_object_is_only_required_if_one_wants_to_have_better_control_r_n_____over_binding_operations_or_if_one_wants_to_receive_notifications_r_n_____when_other_components_get_installed_removed_bound_unbound._r_n_____This_sample_uses_a_notify_object_as_an_example_only._If_you_do_not_r_n_____want_to_use_a_notify_object__please_comment_out_the_lines_that_add_r_n_____ClsId_and_ComponentDll_registry_keys._r_n_________________________________________________________________________r_n_r_n_Version__r_nsignature_____Windows_NT___r_nClass_______Net_r_nClassGUID___4d36e972_e325_11ce_bfc1_08002be10318_r_nProvider_____Msft__r_nDriverVer__10_01_2002_6.0.5019.0_r_n_r_n_ControlFlags__r_nExcludeFromSelect__ms_tpacketvmp_r_n_r_n_DestinationDirs__r_nDefaultDestDir12_r_n__No_files_to_copy__r_n_r_n_Manufacturer__r_n_Msft___MSFT_NTx86_NTia64_NTamd64_r_n_r_n_For_Win2K_r_n_r_n_MSFT__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_For_WinXP_and_later_r_n_r_n_MSFT.NTx86__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTia64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_MSFT.NTamd64__r_n_TpacketvMP_Desc___TpacketvMP.ndi__ms_tpacketvmp_r_n_r_n_r_n_TpacketvMP.ndi__r_nAddReg___TpacketvMP.ndi.AddReg_r_nCharacteristics__0x29__NCF_NOT_USER_REMOVABLE__NCF_VIRTUAL__NCF_HIDDEN_r_n_r_n_TpacketvMP.ndi.AddReg__r_nHKR__Ndi__Service___0___TpacketvMP_r_n_r_n_TpacketvMP.ndi.Services__r_nAddService__TpacketvMP_0x2__TpacketvMP.AddService_r_n_r_n_r_n_TpacketvMP.AddService__r_nServiceType_____1__SERVICE_KERNEL_DRIVER_r_nStartType_______3__SERVICE_DEMAND_START_r_nErrorControl____1__SERVICE_ERROR_NORMAL_r_nServiceBinary____12__tpacketv.sys_r_nAddReg__________TpacketvMP.AddService.AddReg_r_n_r_n_r_n_TpacketvMP.AddService.AddReg__r_n_________________________________________________________________________r_n__Add_any_miniport_specific_parameters_here.__These_are_params_that_your_r_n__filter_device_is_going_to_use._r_n__r_n_HKR__Parameters__ParameterName___0x10000___MultiSz____Parameter____Value__r_n_HKR__Parameters__ParameterName2__0x10001__4_r_n_r_n_Strings__r_nMsft___Microsoft__r_nTpacketvMP_Desc___Tpacketv_Miniport__r_n_r_n_SourceDisksNames__r_n_None__r_n_r_n_SourceDisksFiles__r_n_None_r_n_r_n_r_n]
lea ecx, [esp + 0x10]
push ebx
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x411e75
push str.PrepareInstallDirectory_3
push str.InstTpacketV
push 0xffffffffffffffff
push 0x5b200c
call fcn.00452100
add esp, 0x10
mov eax, ebp
jmp 0x411e75
lea edx, [esp + 0x24]
lea ecx, [esp + 0x18]
push edx
call fcn.0043a5d0
mov esi, eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x330], 2
call fcn.0043a5d0
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
push str.PrepareInstallDirectory_4___s____s_
push str.InstTpacketV
push edi
push 0x5b200c
mov byte [esp + 0x344], 3
call fcn.00452100
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x32c], 2
call fcn.0043af50
lea ecx, [esp + 0x18]
mov dword [esp + 0x32c], edi
call fcn.0043af50
mov eax, ebp
jmp 0x411e75
push 0xffffffffffffffff
push str.PrepareInstallDirectory_1_0x_lx
jmp 0x411e5f
push 0xffffffffffffffff
push str.PrepareInstallDirectory_2_0x_lx
push str.InstTpacketV
push 0xffffffffffffffff
push 0x5b200c
call fcn.00452100
add esp, 0x14
xor eax, eax
mov ecx, dword [esp + 0x324]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x320
ret