Function at 0x19998
Capabilities:
Read file on windows
Resolve function by parsing pe exports
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r13, qword [0x00065e90]
xor r15d, r15d
xor eax, eax
mov rdi, r8
mov rbx, rdx
mov dword [r11 - 0x78], r15d
mov dword [rsp + 0x64], eax
lea rcx, [r11 - 0x60]
lea r8d, [r15 + 0x28]
xor edx, edx
mov sil, r15b
mov dword [r11 + 0x20], r15d
mov dword [r11 + 0x24], eax
mov qword [r11 - 0x70], rax
mov qword [r11 + 0x18], r15
mov dword [r11 - 0x68], r15d
call fcn.00028240
cmp rdi, r15
jne 0x199fd
xor al, al
jmp 0x19c97
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x88], 0x240
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], r15
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r15d
jl 0x199f6
mov rcx, qword [rsp + 0xf0]
mov r14d, 0xe
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x60]
lea r9d, [r14 - 6]
mov qword [rsp + 0xf8], r15
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
cmp eax, r15d
jl 0x19c81
mov ebp, 0x1000
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
cmp rax, r15
je 0x19c81
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00028240
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r15d
jl 0x19c76
movsxd rax, dword [rbx + 0x3c]
mov ecx, 0x10b
add rax, rbx
cmp word [rax + 0x18], cx
jne 0x19b3c
add rax, 0x98
jmp 0x19b51
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x19c76
add rax, 0xa8
mov ecx, dword [rax]
mov r12d, dword [rax + 4]
cmp rcx, 0x600
jbe 0x19c76
cmp r12d, 0x1c
jb 0x19c76
mov qword [rsp + 0xf8], rcx
mov rcx, qword [rsp + 0xf0]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x60]
mov r9d, 8
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
cmp eax, r15d
jl 0x19c76
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
cmp rax, r15
je 0x19c81
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.00028240
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r15d
jl 0x19c76
lea rcx, [r13 + 0x18]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rbp, r15
mov r14b, al
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x19c66
mov r9d, dword [rdi + 0x80]
cmp r9d, r15d
je 0x19c66
cmp byte [rdi], r15b
je 0x19c66
mov r8, rdi
mov edx, r12d
mov rcx, rbx
call fcn.00014188
cmp eax, r15d
jne 0x19c61
inc rbp
add rdi, 0x84
cmp rbp, 0x40
jl 0x19c1d
jmp 0x19c69
mov sil, 1
jmp 0x19c69
mov sil, r15b
lea rcx, [r13 + 0x18]
mov dl, r14b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xf0]
cmp rcx, r15
je 0x19c94
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, sil
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret