Function at 0x1d544
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xf0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0x72647268
mov edx, 0x20010
xor ecx, ecx
mov r8d, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r12d, r12d
mov rbx, rax
cmp rax, r12
jne 0x1d58e
mov eax, 0xc000009a
jmp 0x1d8d5
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov ebp, 0x30
mov dword [rsp + 0x30], 1
lea r15d, [rbp + 0x10]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x130]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x90], r15d
mov dword [rsp + 0x78], ebp
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r12d
mov edi, eax
jge 0x1d629
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x1d8d5
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov qword [rsp + 0x88], rsi
mov esi, 5
lea r9, [rsp + 0x60]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 3
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x138]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x78], ebp
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r12d
mov edi, eax
jge 0x1d6c8
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1d622
mov rcx, qword [rsp + 0x130]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x60]
mov r9d, 0x18
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x130]
xor r8d, r8d
mov dl, 1
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x60], r12d
jge 0x1d73a
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x60]
jmp 0x1d8d5
mov rdi, qword [rsp + 0xd8]
mov qword [rsp + 0x70], r12
cmp rdi, r12
je 0x1d82a
mov r15d, 0x20000
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.0003bc80
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
mov esi, r15d
cmp rdi, r15
mov qword [rsp + 0x38], rax
cmovl esi, edi
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x130]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x60], r12d
jl 0x1d709
mov rcx, qword [rsp + 0x138]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x138]
xor r8d, r8d
mov dl, 1
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x60], r12d
jl 0x1d709
mov eax, esi
add qword [rsp + 0x70], rax
sub rdi, rax
jne 0x1d756
mov rcx, qword [rsp + 0x130]
mov edi, 4
lea r8, [rsp + 0xa8]
lea esi, [rdi + 0x24]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], edi
mov r9d, esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x130]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x60], r12d
jl 0x1d898
mov rcx, qword [rsp + 0x138]
or dword [rsp + 0xc8], 6
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x60]
mov r9d, esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov rcx, qword [rsp + 0x138]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebp
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret