Function at 0x140001310
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x540
mov rbx, rcx
mov qword [rax - 0x28], r13
lea rcx, [rax - 0x428]
xor r13d, r13d
xor edx, edx
mov r8d, 0x400
mov qword [rax + 0x18], r13
call fcn.14000aca0
lea rcx, [rsp + 0xc8]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0xc8]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x560]
mov edx, 0x100
mov dword [rsp + 0x28], 0x204000
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], r13
mov dword [rsp + 0xb0], 0x40
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0xc0], r13
mov dword [rsp + 0x20], 7
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x140001424
mov rcx, qword [rsp + 0x560]
xor eax, eax
lea r9d, [r13 + 0x28]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov rcx, qword [rsp + 0x560]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x560], r13
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x560]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x14000165e
mov rcx, qword [rsp + 0x560]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x60]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x14000165e
test byte [rsp + 0x110], 0x10
mov qword [rsp + 0x550], rbp
mov qword [rsp + 0x538], rsi
mov qword [rsp + 0x530], rdi
mov qword [rsp + 0x528], r12
jne 0x140001605
mov rcx, qword [rsp + 0x560]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x60]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x14000163e
mov rax, qword [rsp + 0xe0]
mov edi, r13d
cqo
and edx, 0x3ff
add rax, rdx
mov rbp, rax
and eax, 0x3ff
sub rax, rdx
sar rbp, 0xa
mov r12, rax
test ebp, ebp
jle 0x1400015a8
mov esi, r13d
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x568]
movsxd rcx, esi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x120]
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x568], rcx
mov rcx, qword [rsp + 0x560]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
js 0x14000163e
inc edi
add esi, 0x400
cmp edi, ebp
jl 0x140001540
test r12d, r12d
je 0x140001605
mov rcx, qword [rsp + 0x560]
mov qword [rsp + 0x40], r13
shl ebp, 0xa
movsxd rax, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x568], rax
lea rax, [rsp + 0x568]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x120]
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
js 0x14000163e
mov rcx, qword [rsp + 0x560]
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0x60]
mov r9d, 1
mov byte [rsp + 0x558], 1
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebx, eax
test eax, eax
cmovns ebx, r13d
mov rdi, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x538]
mov rbp, qword [rsp + 0x550]
mov r12, qword [rsp + 0x528]
mov rcx, qword [rsp + 0x560]
mov r13, qword [rsp + 0x520]
test rcx, rcx
je 0x140001679
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
add rsp, 0x540
pop rbx
ret