Function at 0x1b4f0
Capabilities:
Get file attributes
Hash data with crc32
Read file on windows
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
xor eax, eax
mov r13, r8
mov word [r11 - 0x70], r14w
mov qword [r11 - 0x6e], rax
mov r15, rcx
mov rbx, rdx
lea r8d, [r14 + 0x14]
lea rcx, [r11 - 0x4c]
xor edx, edx
mov qword [r11 + 0x20], r14
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov dword [r11 - 0x50], r14d
call fcn.00028240
lea rsi, [r15 + 0xfc8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, r15
call fcn.0001b3b4
lea rcx, [rsp + 0x58]
mov rdx, rbx
call qword [fcn.004e696c]
lea r12d, [r14 + 1]
mov dword [rsp + 0x30], 0x68
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xe8]
lea r9d, [r12 + 0x7f]
mov r8d, 0x80100000
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call fcn.0001549c
cmp eax, r14d
mov edi, eax
jl 0x1b766
mov rcx, qword [rsp + 0xe8]
lea r9d, [r14 + 0x18]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r14d
mov edi, eax
jl 0x1b766
mov ebp, dword [rsp + 0x80]
cmp ebp, r14d
je 0x1b761
cmp dword [rsp + 0x84], r14d
jne 0x1b761
mov ebx, ebp
test ebp, 0x1fff
je 0x1b611
shr ebx, 0xd
add ebx, r12d
shl ebx, 0xd
mov edx, ebx
xor ecx, ecx
mov r12d, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r14
jne 0x1b637
mov edi, 0xc0000153
lea rsi, [r15 + 0xfc8]
jmp 0x1b766
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.00028240
mov r14, qword [rsp + 0xe8]
and dword [rsp + 0xd0], 0
xor eax, eax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
and qword [rsp + 0x50], rax
lea r9d, [rax + 8]
mov rcx, r14
mov dword [rsp + 0xd4], eax
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
js 0x1b712
xor eax, eax
add r12, rsi
mov rdi, rsi
mov qword [rsp + 0xd0], rax
cmp rsi, r12
jae 0x1b710
or dword [rsp + 0xd4], 0xffffffff
xor eax, eax
xor r9d, r9d
and qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], 0x2000
mov rcx, r14
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0xd0], 0xfffffffe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x1b709
mov eax, dword [rsp + 0x70]
add rdi, rax
cmp rdi, r12
jb 0x1b69e
jmp 0x1b710
cmp eax, 0xc0000011
jne 0x1b712
xor eax, eax
xor r14d, r14d
mov edi, eax
cmp eax, r14d
jl 0x1b751
lea rcx, [0x0002a590]
mov r8d, ebp
mov rdx, rsi
mov qword [r13], rsi
mov dword [r13 + 8], ebx
mov dword [r13 + 0xc], ebp
call fcn.000140f0
lea rdx, [r13 + 0x14]
mov r8, rsi
mov ecx, ebp
mov dword [r13 + 0x10], eax
call fcn.00013e40
jmp 0x1b62b
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1b62b
mov edi, 0xc0000098
mov rcx, qword [rsp + 0xe8]
cmp rcx, r14
je 0x1b779
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, r15
call fcn.0001b458
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
mov rbx, qword [rsp + 0xd8]
mov eax, edi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret