Function at 0x1400012bc
Capabilities:
Get file attributes
Hash data via bcrypt
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x140004070]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov esi, edx
mov dword [rsp + 0x84], esi
mov r13, rcx
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov dword [0x14000410c], eax
mov edx, esi
mov r8d, 1
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
nop
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x88], rdi
mov r12d, edi
mov r14d, edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x70], rdi
mov r15d, edi
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rdx, [rsp + 0x98]
mov rcx, rax
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov ebx, eax
test eax, eax
jns 0x140001372
lea rcx, [0x1400026d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000173f
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002700]
lea rcx, [rsp + 0x68]
call sub.cng.sys_BCryptOpenAlgorithmProvider
mov ebx, eax
test eax, eax
jns 0x140001398
lea rcx, [0x140002710]
jmp 0x140001368
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x64]
lea rdx, [0x140002740]
mov rcx, qword [rsp + 0x68]
call sub.cng.sys_BCryptGetProperty
mov ebx, eax
test eax, eax
jns 0x1400013d4
lea rcx, [0x140002760]
jmp 0x140001368
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x60]
lea rdx, [0x140002780]
mov rcx, qword [rsp + 0x68]
call sub.cng.sys_BCryptGetProperty
mov ebx, eax
test eax, eax
jns 0x140001413
lea rcx, [0x1400027b0]
jmp 0x140001368
mov edx, dword [rsp + 0x64]
mov ebx, 0x401
mov r8d, 0x79726b6e
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rax, rax
jne 0x140001448
lea rcx, [0x1400027d0]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc000009a
jmp 0x14000173f
mov edx, dword [rsp + 0x60]
mov r8d, 0x79726b6e
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x14000146b
lea rcx, [0x1400027f0]
jmp 0x140001439
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x64]
mov r8, r12
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call sub.cng.sys_BCryptCreateHash
mov ebx, eax
test eax, eax
jns 0x1400014a1
lea rcx, [0x140002810]
jmp 0x140001368
mov dword [rsp + 0xb0], 0x30
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xc8], 0x200
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x60
mov eax, 1
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0xb0]
mov edx, 0x120089
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
jns 0x140001538
lea rcx, [0x140002830]
jmp 0x140001368
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
jns 0x140001573
lea rcx, [0x140002850]
jmp 0x140001368
mov rax, qword [rsp + 0xe8]
test rax, rax
jg 0x140001591
mov ebx, 0xc0000001
lea rcx, [0x140002870]
jmp 0x140001368
cmp rax, 0x2000000
jle 0x1400015af
lea rcx, [0x1400028a0]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc0000904
jmp 0x14000173f
mov edx, 0x2000
mov ecx, 0x401
mov r8d, 0x79726b6e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
test rax, rax
jne 0x1400015d9
lea rcx, [0x1400028d0]
jmp 0x140001439
mov edi, dword [rsp + 0xe8]
test edi, edi
je 0x140001656
mov esi, 0x2000
cmp edi, esi
cmovb esi, edi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x1400016a1
cmp dword [rsp + 0xa8], esi
jne 0x14000168b
xor r9d, r9d
mov r8d, esi
mov rdx, r15
mov rcx, qword [rsp + 0x78]
call sub.cng.sys_BCryptHashData
mov ebx, eax
test eax, eax
js 0x14000167f
sub edi, esi
jne 0x1400015e4
mov esi, dword [rsp + 0x84]
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, r14
mov rcx, qword [rsp + 0x78]
call sub.cng.sys_BCryptFinishHash
mov ebx, eax
xor edi, edi
test eax, eax
jns 0x1400016ad
lea rcx, [0x140002970]
jmp 0x140001368
lea rcx, [0x140002950]
jmp 0x140001368
lea rcx, [0x140002920]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc00000e5
jmp 0x14000173f
lea rcx, [0x140002900]
jmp 0x140001368
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002990]
lea rcx, [rsp + 0x88]
call sub.cng.sys_BCryptOpenAlgorithmProvider
mov ebx, eax
test eax, eax
js 0x14000138f
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x98
lea rax, str.ECS30
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
lea r8, [0x1400029b0]
xor edx, edx
mov rcx, qword [rsp + 0x88]
call sub.cng.sys_BCryptImportKeyPair
mov ebx, eax
test eax, eax
jns 0x140001719
lea rcx, [0x1400029d0]
jmp 0x140001368
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
mov r9d, dword [rsp + 0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sub.cng.sys_BCryptVerifySignature
mov ebx, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140001753
xor edx, edx
call sub.cng.sys_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140001765
call sub.cng.sys_BCryptDestroyKey
test r15, r15
je 0x140001778
mov edx, 0x79726b6e
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140001788
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140001797
call sub.cng.sys_BCryptDestroyHash
test r14, r14
je 0x1400017aa
mov edx, 0x79726b6e
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r12, r12
je 0x1400017bd
mov edx, 0x79726b6e
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400017ce
xor edx, edx
call sub.cng.sys_BCryptCloseAlgorithmProvider
mov eax, ebx
jmp 0x1400017d7
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140001eb0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret