Function at 0x1400248b3
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
bts r8w, ax
jmp 0x1400248dc
mov qword [rax + 0x10], rbx
mov bl, 0xc1
btr bx, r10w
movsx ebx, r15w
mov qword [rax + 0x18], rsi
xor esi, 0x1b20013e
bswap rbx
mov qword [rax + 0x20], rdi
setg dil
push rbp
movzx r8w, bpl
sal sil, cl
lea rbp, [rax - 0x5f]
add r8b, 0xc9
and rdi, 0x3c4f0253
clc
sub rsp, 0xe0
mov r8, 0x62e54ea2
mov rax, qword [0x14001fe00]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx esi, r10w
sub r8d, ebp
and qword [rbp - 0x29], 0
cmp r9w, 0x3174
setnp r8b
xor eax, eax
mov rsi, rcx
btr cx, 0xa1
cmc
rcl cl, 0x20
mov qword [rbp - 9], rax
shl r8b, cl
bt rcx, 0xb8
dec dil
xor edx, edx
mov qword [rbp - 1], rax
movsx edi, r12w
movzx rbx, sp
mov ecx, eax
lea rcx, [rbp + 7]
mov rbx, r11
movsx di, al
mov qword [rbp - 0x21], rax
lea edi, [rax + 0x30]
setno r8b
movzx bx, r15b
movzx ebx, r13w
mov qword [rbp - 0x19], rax
mov r8w, r15w
mov r8d, edi
movsxd rbx, ecx
mov ebx, 0xc0000001
jmp 0x1400249af
call fcn.140024e7f
test rsi, rsi
jmp 0x1400249bc
je 0x140024c50
lea rdx, [0x140002bb0]
lea rcx, [rbp - 9]
jmp 0x1400249d2
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
cmc
and r9b, 0x94
xadd r8b, r9b
lea rax, [rbp - 9]
rcl r9b, cl
and qword [rsp + 0x48], 0
lea r9, [rbp - 0x21]
rcr r8b, cl
sub r8b, 0xf5
or cx, 0x3b8
and qword [rbp + 0xf], 0
movzx rcx, r13w
movzx r8w, bpl
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x20
cmovge ecx, r10d
setnp ch
lea rcx, [rbp - 0x29]
mov qword [rbp + 0x17], rax
jmp 0x140024a31
xorps xmm0, xmm0
lea eax, [rdi - 0x2f]
rcr rdx, cl
bts dx, r8w
ror dx, cl
mov dword [rbp + 7], edi
mov dword [rsp + 0x38], eax
mov edx, 0x80000000
mov dword [rsp + 0x30], eax
clc
mov dword [rsp + 0x28], pe_nt_image_headers64
cmp edx, 0x6e6441a6
and qword [rsp + 0x20], 0
jmp 0x140024a6c
mov dword [rbp + 0x1f], 0x240
movdqu xmmword [rbp + 0x27], xmm0
jmp 0x140024a7d
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
jmp 0x140024a8c
js 0x140024c50
mov rcx, qword [rbp - 0x29]
sbb dl, 0xdc
add dl, 0
lea r9d, [rdi - 0x18]
sal dl, 0x8c
sub eax, eax
mov dword [rsp + 0x20], 5
movsx dx, r8b
mov r8b, r8b
lea r8, [rbp + 0x37]
cwd
mov qword [rbp + 0x37], rax
bswap dx
lea rdx, [rbp - 0x21]
mov qword [rbp + 0x3f], rax
jmp 0x140024acf
mov qword [rbp + 0x47], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
cmp bpl, 0x54
test r9b, cl
test eax, eax
jmp 0x140024ae9
js 0x140024c41
cmp dword [rbp + 0x3f], 0x1000
jbe 0x140024c41
mov ecx, dword [rbp + 0x3f]
jmp 0x140024b04
call fcn.14002327c
mov rdi, rax
test r13b, 0x18
cmp cl, ch
test r15b, r11b
test rax, rax
jmp 0x140024b1d
je 0x140024c41
mov ecx, dword [rbp + 0x3f]
test r12b, r10b
cmp r13b, 0x98
xor eax, eax
and qword [rsp + 0x40], rax
sub r9d, r9d
cmp r8b, 0x38
mov qword [rbp - 0x11], rax
shl al, 0x16
jmp 0x140024b47
xor r8d, r8d
clc
lahf
adc al, ah
lea rax, [rbp - 0x11]
cmp bx, di
jmp 0x140024b5a
xor edx, edx
mov qword [rsp + 0x38], rax
cwde
lea rax, [rbp - 0x21]
jmp 0x140024b6b
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
jmp 0x140024b78
mov qword [rsp + 0x28], rdi
jmp 0x140024b82
mov qword [rsp + 0x20], rax
jmp 0x140024b8c
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test bpl, 0x34
cmp r11b, 0x13
test eax, eax
js 0x140024c34
mov r8d, dword [rbp + 0x3f]
movsx cx, r13b
xchg r9w, r9w
lea r9, [0x140002bf0]
mov dh, 0x73
mov rdx, rdi
jmp 0x140024bc7
mov rcx, rsi
call fcn.14002285a
mov rdx, qword [0x14001fe10]
movsx r8, bp
not r8b
movzx cx, spl
lea r9, [0x140002c10]
movzx rcx, sp
mov rcx, rsi
movsxd r8, eax
jmp 0x140024bf8
mov qword [rdx + 0x68], rax
cdq
mov r8w, 0xbdc
movsx r8d, r10w
mov rdx, rdi
mov r8b, 0x9c
mov r8d, dword [rbp + 0x3f]
jmp 0x140024c15
call fcn.14002285a
mov rcx, qword [0x14001fe10]
jmp 0x140024c26
mov qword [rcx + 0x70], rax
setae cl
movzx ecx, r9w
not rcx
mov rcx, rdi
jmp 0x140024c3c
call fcn.14002367b
mov rcx, qword [rbp - 0x29]
jmp 0x140024c4a
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
rcr ch, 0x4f
mov rcx, qword [rbp + 0x4f]
jmp 0x140024c5f
xor rcx, rsp
call fcn.140024e14
lea r11, [rsp + 0xe0]
cmovge bx, bx
not dil
movzx ebp, r12w
mov rbx, qword [r11 + 0x18]
movzx edi, si
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
jmp 0x140024c95
mov rsp, r11
movzx bp, r12b
mov bp, 0x51dd
movsx rbp, di
pop rbp
jmp 0x140024cab
ret