Function at 0x1d0a4
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x110
mov rax, qword [0x0004c470]
mov rbp, rdx
mov rsi, rcx
mov rdi, qword [rax + 0x40]
mov r13d, 0x72647268
mov edx, 0x20010
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r12d, r12d
mov rbx, rax
cmp rax, r12
jne 0x1d0f9
mov eax, 0xc000009a
jmp 0x1d51f
mov rcx, qword [0x0004c470]
mov r14d, 0x30
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xc0], r14d
mov dword [rsp + 0xd8], 0x40
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r12
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rdi + 0x13], rax
cmp rax, r12
jne 0x1d150
mov rax, qword [rdi + 0xa]
mov qword [rdi + 0x13], rax
mov rax, qword [rdi + 0x13]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov eax, 1
lea rcx, [rsp + 0x150]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, r12d
mov esi, eax
jge 0x1d1d2
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1d51d
mov rcx, qword [0x0004c470]
mov dword [rsp + 0xc0], r14d
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xd8], 0x40
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r12
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rdi + 0x13], rax
cmp rax, r12
jne 0x1d223
mov rax, qword [rdi + 0xa]
mov qword [rdi + 0x13], rax
mov rax, qword [rdi + 0x13]
mov esi, 5
lea r9, [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 3
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0x158]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, r12d
mov edi, eax
jge 0x1d2b9
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
jmp 0x1d51f
mov rcx, qword [rsp + 0x150]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x80]
mov r9d, 0x18
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jge 0x1d334
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x80]
jmp 0x1d51f
mov rdi, qword [rsp + 0xf8]
mov qword [rsp + 0x90], r12
cmp rdi, r12
je 0x1d43c
mov r14d, 0x20000
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.0003bc80
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov ebp, r14d
cmp rdi, r14
mov qword [rsp + 0x38], rax
cmovl ebp, edi
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1d300
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x158]
xor r8d, r8d
mov dl, 1
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1d300
mov eax, ebp
add qword [rsp + 0x90], rax
sub rdi, rax
jne 0x1d353
mov rcx, qword [rsp + 0x150]
mov edi, 4
lea r8, [rsp + 0x98]
lea ebp, [rdi + 0x24]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x20], edi
mov r9d, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1d4f5
or dword [rsp + 0xb8], 6
mov ecx, 0x1c126e1
mov eax, 0xcfddc800
mov dword [rsp + 0xac], ecx
mov dword [rsp + 0x9c], ecx
mov dword [rsp + 0xb4], ecx
mov dword [rsp + 0xa4], ecx
mov rcx, qword [rsp + 0x158]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x80]
mov r9d, ebp
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret