Function at 0x1400022c0
Capabilities:
Get file attributes
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x130
xor r13d, r13d
xor eax, eax
mov rsi, rdx
mov rbp, rcx
mov qword [r11 + 0x20], r13
mov qword [rsp + 0x60], r13
mov dword [r11 + 8], r13d
mov dword [r11 + 0xc], eax
mov edi, r13d
mov r12, r13
test rcx, rcx
je 0x1400026de
test rdx, rdx
je 0x1400026de
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov qword [r11 - 0xb0], r13
mov dword [rsp + 0xb8], 0x240
mov qword [r11 - 0xa8], rcx
mov dword [rsp + 0x30], 1
lea rcx, [r11 + 0x20]
lea r9, [rsp + 0x78]
lea r8, [r11 - 0xb8]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x80
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x98], r13
mov qword [r11 - 0x90], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x14000269a
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], r13d
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
mov edx, 0x100002
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0x20], r13
mov dword [rsp + 0xb8], 0x240
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x14000269a
xor eax, eax
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xf8]
lea rcx, [rsp + 0x170]
mov edx, 0x120089
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x88], r13d
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x9c], eax
mov dword [rsp + 0xd0], r13d
mov dword [rsp + 0xd4], eax
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xdc], eax
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0xe8], eax
mov dword [rsp + 0xec], eax
mov dword [rsp + 0xf0], eax
mov dword [rsp + 0xf4], eax
mov dword [rsp + 0xf8], 0x30
mov qword [rsp + 0x100], r13
mov dword [rsp + 0x110], 0x240
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x120], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x14000258e
mov rcx, qword [rsp + 0x170]
lea r9d, [r13 + 0x18]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x14000258e
mov rcx, qword [rsp + 0x170]
lea r9d, [r13 + 0x28]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
mov ebx, eax
cmovns r12, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x1400025a1
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x14000269a
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x46424350
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x1400025ce
mov ebx, 0xc000009a
jmp 0x140002687
test r12, r12
je 0x140002687
nop word [rax + rax]
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x160]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x30], 0x1000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140002687
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x30], ebp
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
js 0x140002687
add edi, dword [rsp + 0x80]
mov eax, ebp
add qword [rsp + 0x160], rax
mov eax, edi
cmp rax, r12
jb 0x1400025e0
test rsi, rsi
je 0x14000269a
mov edx, 0x46424350
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x1400026b5
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x178], r13
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400026c5
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x168]
add rsp, 0x130
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xc000000d
add rsp, 0x130
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret