Function at 0x1400153ec
Capabilities:
Get file attributes
Read file on windows
Set file attributes

Disassembly:
push r15
push r14
clc
push rsi
or sil, cl
test si, 0xc818
push rdi
push rbp
xchg rsi, rdi
sub rsi, 0x6c3dc5bb
push rbx
dec bl
sub rsp, 0xe8
cmove si, r10w
mov rsi, rcx
not dil
mov rdi, rcx
mov bx, 0x2b8d
bswap bx
not bh
lea rbx, [rsp + 0xa8]
jmp 0x14001543a
mov rcx, rbx
jmp 0x140015442
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0xb8]
test r12b, r13b
shrd rdx, r13, 0xb2
shld r9d, esi, 9
mov dword [r8], 0x30
and r9, r11
xor eax, eax
sal r9, 9
rol rdx, 0x3d
xor dx, 0x6c31
sub ecx, ecx
setnp r9b
cmovo edx, r15d
cwd
mov qword [r8 + 8], rcx
jmp 0x14001548b
mov dword [r8 + 0x18], 0x240
bswap dx
mov qword [r8 + 0x10], rbx
xchg dh, dh
xorps xmm0, xmm0
xchg r9w, r9w
bswap r9d
movups xmmword [r8 + 0x20], xmm0
not dx
xchg dx, r9w
cqo
mov qword [rsp + 0x60], rcx
movsx r9, r9w
jmp 0x1400154c2
mov dword [rsp + 0x58], eax
bswap r9w
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rcx
setp al
rdtsc
movzx r9, r15w
mov eax, 1
movzx r9d, r13w
cqo
movzx rdx, bx
mov dword [rsp + 0x38], eax
not dh
mov dx, cx
mov dword [rsp + 0x30], eax
cmova r9w, cx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x68], 0x100
mov dword [rsp + 0x40], 0x60
movsxd r9, r13d
movsx rdx, bp
mov rdx, r11
mov dword [rsp + 0x28], 0x80
cdq
movzx cx, dl
lea rcx, [rsp + 0x70]
jmp 0x14001553b
lea r9, [rsp + 0x78]
mov edx, 1
jmp 0x14001554a
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov r14d, 0
mov ebp, 0
cmp r13, 0x631e7c9c
jmp 0x140015567
test eax, eax
js 0x14001571c
lea r8, [rsp + 0x88]
xchg dl, r9b
mov qword [r8], 0
movsx cx, ch
mov rcx, qword [rsp + 0x70]
movzx rdx, dx
movsx r9w, spl
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x78]
mov r9w, 0x723d
mov r9d, 8
jmp 0x1400155b0
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov rcx, qword [rsp + 0x70]
cmp r15d, 0xef25c0be
test eax, eax
jmp 0x1400155c9
js 0x140015704
mov dword [rsp + 0x20], 5
setp r8b
movzx r9d, dx
cmovle r8w, ax
lea rbx, [rsp + 0x78]
movsxd rdx, ecx
lea r8, [rsp + 0x90]
movsx r9d, r15w
mov rdx, rbx
movzx r9d, r12w
mov r9b, 0x21
jmp 0x140015607
mov r9d, 0x18
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jmp 0x14001561a
js 0x1400156fa
mov r15, qword [rsp + 0x98]
movsx r8d, r13w
cwd
mov ecx, 0x200
mov rdx, r15
mov r8d, 0x5a4557
jmp 0x140015641
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, qword [rsp + 0x70]
test rax, rax
jmp 0x140015654
je 0x140015704
mov r14, rax
bt ebp, esp
movzx rbp, di
or bpl, 0x80
mov ebp, r15d
clc
xorps xmm0, xmm0
clc
cmp r12w, 0xf73b
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r15d
test rsp, rdi
mov qword [rsp + 0x28], rax
stc
test rsp, rsp
mov qword [rsp + 0x20], rbx
cmp r10, r9
jmp 0x14001569e
xor edx, edx
xor r8d, r8d
stc
test bp, 0xbd03
cmc
xor r9d, r9d
jmp 0x1400156b2
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
movzx ecx, r14w
not cx
cmovge cx, ax
mov rcx, qword [rsp + 0x70]
jmp 0x1400156cf
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jmp 0x1400156dc
jns 0x14001571c
mov rcx, r14
mov edx, 0x5a4557
jmp 0x1400156ef
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14001570a
mov rcx, qword [rsp + 0x70]
jmp 0x140015704
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r14d, r14d
btr r15, r9
xor ebp, ebp
shl rbx, 0x83
cmovb ax, r15w
mov qword [rsi], r14
mov dword [rsi + 8], ebp
shld rsi, rdx, 0x25
sbb al, bpl
sbb rax, 0xffffffff949a1cac
mov rax, rdi
rol bl, cl
bswap bx
mov di, 0x3b89
add rsp, 0xe8
movzx esi, bx
jmp 0x140015750
pop rbx
jmp 0x140015759
pop rbp
pop rdi
movsx r15w, bl
movzx si, al
pop rsi
movzx r14d, r15w
mov r14b, r9b
pop r14
movsxd r15, ebx
setbe r15b
bswap r15w
pop r15
jmp 0x140015780
ret