Function at 0x1ff64
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rcx, qword [0x0004c470]
xor ebp, ebp
mov qword [rax + 8], rbp
mov rbx, qword [rcx + 0x40]
mov dword [rax - 0x50], 0x30
mov qword [rax - 0x48], rbp
mov dword [rax - 0x38], 0x40
mov qword [rax - 0x30], rbp
mov qword [rax - 0x28], rbp
lea rax, [0x0004f120]
cmp byte [0x0004c2fe], bpl
jne 0x1ffb7
lea rax, [0x0004ef00]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rbx + 0x13], rax
cmp rax, rbp
jne 0x1ffd6
mov rax, qword [rbx + 0xa]
mov qword [rbx + 0x13], rax
mov rax, qword [rbx + 0x13]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xb8]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 0x68
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x110]
mov edx, 0xc0100000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, ebp
jl 0x2029d
mov edx, dword [0x0004eee0]
xor ecx, ecx
mov r8d, 0x72647268
and rdx, 0xfffffffffffffff0
add rdx, 0x10
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x118], rbp
mov rdi, rax
cmp rax, rbp
je 0x2028a
mov ecx, dword [0x0004eee0]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x118]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, dword [rsp + 0x88]
cmp eax, ebp
jl 0x2027c
mov rcx, qword [rsp + 0x110]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [0x0004c470]
mov qword [rsp + 0x110], rbp
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rbx + 0x13], rax
cmp rax, rbp
jne 0x20113
mov rax, qword [rbx + 0xa]
mov qword [rbx + 0x13], rax
mov rax, qword [rbx + 0x13]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xb8]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x110]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, ebp
jl 0x2027c
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x118]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x110]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [rsp + 0x110]
mov ebx, 4
lea esi, [rbx + 0x24]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov r9d, esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp dword [rsp + 0x80], ebp
jl 0x2027c
mov ecx, 0x1c126e1
mov eax, 0xcfddc800
lea r8, [rsp + 0x90]
mov dword [rsp + 0xa4], ecx
mov dword [rsp + 0x94], ecx
mov dword [rsp + 0xac], ecx
mov dword [rsp + 0x9c], ecx
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x80]
mov r9d, esi
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x90], eax
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edx, 0x72647268
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x110]
cmp rcx, rbp
je 0x2029d
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret