Function at 0x1d344
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14d, r8d
mov r12, rdx
mov rdi, rcx
call fcn.0001cf68
movabs rax, qword [0xfffff78000000014]
mov edx, 0x803
mov r8b, 0xb
mov rcx, rdi
call fcn.0001d118
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, rdi
call fcn.0001d09c
mov r8b, byte [rsp + 0xd0]
xor edx, edx
or r8b, 0x20
mov rcx, rdi
call fcn.0001d118
mov edx, 0x801
xor r8d, r8d
mov rcx, rdi
call fcn.0001d118
mov edx, 0x800
xor r8d, r8d
mov rcx, rdi
call fcn.0001d118
xor r15d, r15d
mov ebp, r15d
cmp r14d, 1
jae 0x1d3f7
cmp r14d, r15d
je 0x1d3f7
lea rcx, [rdi + 8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov eax, 0xc0000001
jmp 0x1d6d4
mov edx, 0x100
xor ecx, ecx
mov r8d, 0x74786e43
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, r15
jne 0x1d421
mov esi, 0xc000009a
jmp 0x1d63b
mov byte [rsp + 0xd8], 1
mov esi, 0xc0000001
xor edx, edx
mov r8d, 0x100
mov rcx, rbx
call fcn.00039700
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], 0x100
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, r15d
mov r13d, eax
jl 0x1d5fc
mov r12, qword [rsp + 0x70]
mov r15, rbx
mov ecx, r12d
mov dword [rsp + 0x58], ecx
cmp r12, 4
jb 0x1d57c
cmp r14d, 1
jb 0x1d4f5
cmp byte [rsp + 0xd8], 1
jne 0x1d4c0
mov rcx, qword [rdi]
mov byte [rsp + 0xd8], 0
test rcx, rcx
jne 0x1d4bc
mov ebp, esi
jmp 0x1d55e
mov dl, 1
jmp 0x1d4ea
lea eax, [r12 - 4]
test eax, eax
jne 0x1d4e0
cmp ecx, 0x100
jae 0x1d4e0
mov rcx, qword [rdi]
test rcx, rcx
je 0x1d4b5
mov r8b, 1
xor edx, edx
jmp 0x1d4ed
mov rcx, qword [rdi]
test rcx, rcx
je 0x1d4b5
xor edx, edx
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ebp, eax
test ebp, ebp
js 0x1d55e
mov rcx, rdi
call fcn.0001cf68
mov rcx, qword [rdi]
mov byte [rsp + 0x50], 2
mov byte [rsp + 0x51], 8
mov rax, qword [rcx]
lea r9, [rsp + 0x50]
mov r8d, 2
mov dl, 0x44
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
call qword [rax + 0x38]
lea rcx, [rdi + 8]
dec al
neg al
sbb ebx, ebx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
and ebx, esi
jns 0x1d561
cmp r14d, 1
jb 0x1d55e
mov rcx, qword [rdi]
test rcx, rcx
je 0x1d55e
mov rax, qword [rcx]
mov r8b, 1
mov dl, r8b
call qword [rax + 0x28]
mov r13d, esi
mov ecx, dword [rsp + 0x58]
sub r12, 4
add r15, 4
cmp r12, 4
jae 0x1d495
mov rbx, qword [rsp + 0x60]
test r12, r12
je 0x1d5f1
cmp r14d, 1
jb 0x1d5b0
mov rcx, qword [rdi]
cmp r12, 1
jne 0x1d59e
test rcx, rcx
jne 0x1d599
mov ebp, esi
jmp 0x1d5e2
mov r8b, 1
jmp 0x1d5a6
test rcx, rcx
je 0x1d595
xor r8d, r8d
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x28]
mov ebp, eax
test ebp, ebp
js 0x1d5e2
mov r8b, byte [r15]
mov edx, 0x802
mov rcx, rdi
call fcn.0001d118
test eax, eax
jns 0x1d5e5
cmp r14d, 1
jb 0x1d5e2
mov rcx, qword [rdi]
test rcx, rcx
je 0x1d5e2
mov rax, qword [rcx]
mov r8b, 1
mov dl, r8b
call qword [rax + 0x28]
mov r13d, esi
dec r12
inc r15
cmp r12, 4
jb 0x1d57c
mov r12, qword [rsp + 0xc8]
xor r15d, r15d
cmp r13d, r15d
je 0x1d42e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
cmp r13d, 0xc0000011
cmove r13d, r15d
cmp r14d, 1
jb 0x1d636
mov rcx, qword [rdi]
cmp rcx, r15
je 0x1d63b
mov r9, qword [rcx]
mov r8b, 1
mov dl, r8b
call qword [r9 + 0x28]
mov ebp, eax
cmp ebp, r15d
jge 0x1d64e
lea rcx, [rdi + 8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov eax, esi
jmp 0x1d6d4
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, rdi
call fcn.0001d09c
mov r8b, byte [rsp + 0xd0]
xor edx, edx
and r8b, 0xdf
mov rcx, rdi
call fcn.0001d118
mov ebx, 0x800
lea r8, [rsp + 0x54]
mov edx, ebx
mov rcx, rdi
mov dword [rsp + 0x54], 0xff
call fcn.0001d2c8
mov r8d, dword [rsp + 0x54]
mov edx, ebx
and r8d, 0xffffff
mov rcx, rdi
or r8d, 0x3000000
mov dword [rsp + 0x54], r8d
call fcn.0001d1a0
mov dword [rdi + 0x40], 2
movabs rax, qword [0xfffff78000000014]
lea rcx, [rdi + 8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov eax, r13d
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret