Function at 0x1efcc
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
xor r12d, r12d
xor eax, eax
mov rdi, rcx
mov r15, rdx
mov dword [rsp + 0x64], eax
lea rcx, [r11 - 0x58]
lea r8d, [r12 + 0x28]
xor edx, edx
mov dword [rsp + 0x60], r12d
mov r14, r9
mov qword [r11 + 8], r12
mov qword [r11 - 0x80], rax
mov dword [r11 - 0x60], r12d
call fcn.000407c0
lea r8d, [r12 + 0x14]
lea rcx, [rsp + 0x74]
xor edx, edx
mov rbx, r12
mov dword [rsp + 0x70], r12d
call fcn.000407c0
mov esi, r12d
cmp rdi, r12
je 0x1f269
cmp r15, r12
je 0x1f269
cmp r14, r12
je 0x1f269
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
lea eax, [r12 + 1]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x88]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xf0]
mov edx, 0x80100000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x90], r12
mov dword [rsp + 0xa0], 0x240
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r12d
jl 0x1f269
mov rcx, qword [rsp + 0xf0]
lea r9d, [r12 + 0x18]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r12d
jne 0x1f242
mov edi, dword [rsp + 0x78]
cmp edi, r12d
je 0x1f242
cmp dword [rsp + 0x7c], r12d
jne 0x1f242
cmp edi, 0x4000000
ja 0x1f242
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
cmp rax, r12
je 0x1f242
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r12d
jne 0x1f242
mov rbp, qword [rsp + 0x118]
cmp rbp, r12
je 0x1f21a
mov rsi, qword [rsp + 0x128]
cmp rsi, r12
je 0x1f21a
mov r12, qword [rsp + 0x120]
test r12, r12
je 0x1f217
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbp], rax
test rax, rax
je 0x1f1df
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.00040300
mov dword [r12], edi
mov rax, qword [0x0006a6c8]
mov rcx, qword [rsp + 0xf0]
xor r12d, r12d
mov dword [rsp + 0x20], 4
lea r9d, [r12 + 0x28]
mov r8, rsi
lea rdx, [rsp + 0x60]
cmp rax, r12
je 0x1f20f
call rax
jmp 0x1f21a
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
jmp 0x1f21a
xor r12d, r12d
mov r9d, 0x10
mov r8, r15
mov edx, edi
mov rcx, rbx
call fcn.0001e000
mov r9d, 0x14
mov r8, r14
mov edx, edi
mov rcx, rbx
mov esi, eax
call fcn.0001f540
mov rcx, qword [rsp + 0xf0]
cmp rcx, r12
je 0x1f255
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp rbx, r12
je 0x1f265
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x1f26b
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret