Function at 0x1bf64
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x110
mov rax, qword [0x0002aa20]
mov rbp, rdx
mov rsi, rcx
mov rdi, qword [rax + 0x40]
mov edx, 0x20000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor r12d, r12d
mov rbx, rax
cmp rax, r12
jne 0x1bfaa
mov eax, 0xc000009a
jmp 0x1c3d1
mov rcx, qword [0x0002aa20]
mov r13d, 0x30
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xd8], 0x40
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r12
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rdi + 0x13], rax
cmp rax, r12
jne 0x1c001
mov rax, qword [rdi + 0xa]
mov qword [rdi + 0x13], rax
mov rax, qword [rdi + 0x13]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x150]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, r12d
mov esi, eax
jge 0x1c087
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x1c3d1
mov rcx, qword [0x0002aa20]
mov dword [rsp + 0xc0], r13d
mov qword [rsp + 0xc8], r12
mov dword [rsp + 0xd8], 0x40
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], r12
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rdi + 0x13], rax
cmp rax, r12
jne 0x1c0d8
mov rax, qword [rdi + 0xa]
mov qword [rdi + 0x13], rax
mov rax, qword [rdi + 0x13]
mov esi, 5
lea r9, [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 3
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0x158]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, r12d
mov edi, eax
jge 0x1c16d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
jmp 0x1c3d1
mov rcx, qword [rsp + 0x150]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x80]
mov r9d, 0x18
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jge 0x1c1e7
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x80]
jmp 0x1c3d1
mov rdi, qword [rsp + 0xf8]
mov qword [rsp + 0x90], r12
cmp rdi, r12
je 0x1c2ef
mov r13d, 0x20000
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.00022a90
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov esi, r13d
cmp rdi, r13
mov qword [rsp + 0x38], rax
cmovl esi, edi
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1c1b4
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x158]
xor r8d, r8d
mov dl, 1
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1c1b4
mov eax, esi
add qword [rsp + 0x90], rax
sub rdi, rax
jne 0x1c206
mov rcx, qword [rsp + 0x150]
mov edi, 4
lea r8, [rsp + 0x98]
lea esi, [rdi + 0x24]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x20], edi
mov r9d, esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1c3a8
or dword [rsp + 0xb8], 6
mov ecx, 0x1c126e1
mov eax, 0xcfddc800
mov dword [rsp + 0xac], ecx
mov dword [rsp + 0x9c], ecx
mov dword [rsp + 0xb4], ecx
mov dword [rsp + 0xa4], ecx
mov rcx, qword [rsp + 0x158]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x80]
mov r9d, esi
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebp
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret