Function at 0x1f92c
Capabilities:
Check os version
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r15
sub rsp, 0x280
mov rax, qword [0x00047100]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [0x0003c960]
lea rcx, [r11 - 0x58]
xor edx, edx
mov qword [rcx], rax
mov rax, qword [0x0003c968]
lea r8d, [rdx + 0x22]
mov qword [rcx + 8], rax
mov rax, qword [0x0003c970]
mov qword [rcx + 0x10], rax
mov eax, dword [0x0003c978]
mov dword [rcx + 0x18], eax
movzx eax, word [0x0003c97c]
mov word [rcx + 0x1c], ax
lea rcx, [r11 - 0x3a]
call fcn.0003bc80
mov rax, qword [0x0004c470]
xor esi, esi
mov edi, 0x114
lea rcx, [rsp + 0x110]
xor edx, edx
mov r8, rdi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x98], rsi
mov rbx, qword [rax + 0x40]
call fcn.0003bc80
lea rcx, [rsp + 0x110]
mov dword [rsp + 0x110], edi
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0xb8], 0x240
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
lea rax, [0x0004f120]
cmp byte [0x0004c2fe], sil
jne 0x1fa33
lea rax, [0x0004ef00]
mov rcx, qword [0x0004c470]
mov qword [rsp + 0xb0], rax
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rbx + 0x13], rax
cmp rax, rsi
jne 0x1fa59
mov rax, qword [rbx + 0xa]
mov qword [rbx + 0x13], rax
mov rax, qword [rbx + 0x13]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x80]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, esi
jl 0x1ff33
mov edi, 0x72647268
mov edx, 0x1010
xor ecx, ecx
mov r8d, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rsi
je 0x1ff25
mov r15d, 0x1000
xor edx, edx
mov rcx, rax
mov r8, r15
call fcn.0003bc80
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xd0]
xor r11d, r11d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x90073
mov qword [rsp + 0xe8], r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwFsControlFile]
mov rcx, qword [rsp + 0x80]
cmp eax, esi
jge 0x1fb6f
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rbx
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1ff33
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x80], rsi
mov rax, qword [rbx + 0x18]
mov qword [0x0004ef10], rax
mov rax, qword [rbx + 0x10]
mov qword [0x0004eee0], rax
mov rax, qword [0x0004f168]
cmp byte [0x0004c2fe], sil
jne 0x1fbaa
mov rax, qword [0x0004f158]
movzx ecx, word [rax]
lea rdx, [rsp + 0x230]
mov word [rsp + 0x248], cx
lea rcx, [rsp + 0x100]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x100]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0xb8], 0x240
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov rcx, rbx
cmp eax, esi
jl 0x1fb62
mov r8, r15
xor edx, edx
mov qword [rsp + 0x90], rsi
call fcn.0003bc80
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd0]
mov dword [rsp + 0x30], r15d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
jl 0x1ff1a
mov eax, dword [rbx + 3]
cmp eax, dword [0x0003c980]
jne 0x1fcf4
movzx eax, word [rbx + 0xb]
movzx ecx, byte [rbx + 0xd]
imul rcx, rax
mov rax, qword [0x0004ef10]
imul rax, rcx
mov qword [0x0004ef10], rax
mov rax, qword [0x0004eee0]
imul rax, rcx
jmp 0x1fd60
mov rax, qword [rbx + 0x52]
cmp rax, qword [0x0003c990]
jne 0x1ff1a
mov eax, dword [rbx + 0x24]
cmp eax, esi
jne 0x1fd10
movzx eax, word [rbx + 0x16]
mov qword [rsp + 0x90], rax
movzx ecx, byte [rbx + 0x10]
imul rcx, rax
movzx eax, word [rbx + 0xe]
add rcx, rax
mov qword [rsp + 0x90], rcx
movzx edx, byte [rbx + 0xd]
movzx r8d, word [rbx + 0xb]
mov rax, rdx
imul rax, qword [0x0004ef10]
add rax, rcx
imul rax, r8
imul r8, rdx
mov qword [0x0004ef10], rax
mov rax, qword [0x0004eee0]
imul rax, r8
mov r8, r15
xor edx, edx
mov rcx, rbx
mov qword [0x0004eee0], rax
mov qword [rsp + 0xe0], rsi
call fcn.0003bc80
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea rax, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x560020
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwDeviceIoControlFile]
cmp eax, esi
jl 0x1ff1a
mov rax, qword [rbx + 0x10]
mov r8d, dword [rbx + 8]
lea rdx, [0x0003c9a0]
add qword [0x0004ef10], rax
lea rcx, [rsp + 0x230]
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0xf0]
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, esi
jge 0x1fe89
mov r8d, dword [rbx + 8]
lea rdx, [0x0003c9e0]
lea rcx, [rsp + 0x230]
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0xf0]
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, esi
jl 0x1ff1a
mov rax, qword [rsp + 0x98]
cmp rax, rsi
je 0x1ff1a
cmp qword [0x0004c888], rsi
jne 0x1ff1a
cmp dword [rsp + 0x114], 6
mov rax, qword [rax + 8]
sbb ecx, ecx
and ecx, 3
jmp 0x1febf
cmp ecx, esi
jbe 0x1fed0
mov rax, qword [rdx]
dec ecx
lea rdx, [rax + 0x18]
mov qword [rsp + 0x88], rax
cmp qword [rdx], rsi
jne 0x1feb6
mov rcx, qword [rax + 8]
mov qword [0x0004c478], rax
mov rax, qword [rcx + 0x88]
mov qword [0x0004c880], rcx
mov qword [0x0004c888], rax
mov rax, qword [rcx + 0x90]
mov qword [0x0004c890], rax
lea rax, [0x0001f844]
mov qword [rcx + 0x88], rax
lea rax, [0x0001f8b4]
mov qword [rcx + 0x90], rax
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.0003a660
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r15
ret