Function at 0x1b5f0
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x110
mov rdi, qword [0x00026300]
xor r12d, r12d
mov rbp, rdx
mov rsi, rcx
cmp rdi, r12
je ZwDeleteFile
mov rdi, qword [rdi + 0x40]
mov edx, 0x20000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
cmp rax, r12
jne 0x1b63f
mov eax, 0xc000009a
jmp 0x1ba24
mov rcx, qword [0x00026300]
mov r13d, 0x30
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0x98], r13d
mov dword [rsp + 0xb0], 0x40
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc0], r12
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rdi + 0x10], rax
cmp rax, r12
jne KeQueryTimeIncrement
mov rax, qword [rdi + 8]
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x10]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x98]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x150]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, r12d
mov esi, eax
jge IoCreateDevice
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp ZwDeleteKey
mov rcx, qword [0x00026300]
mov dword [rsp + 0x98], r13d
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0xb0], 0x40
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc0], r12
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov qword [rdi + 0x10], rax
cmp rax, r12
jne KeAcquireSpinLockRaiseToDpc
mov rax, qword [rdi + 8]
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x10]
mov esi, 5
lea r9, [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 3
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x158]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
cmp eax, r12d
mov edi, eax
jge 0x1b802
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
jmp 0x1ba24
mov rcx, qword [rsp + 0x150]
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x80]
mov r9d, 0x18
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jge reloc.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x80]
jmp 0x1ba24
mov rdi, qword [rsp + 0xd0]
mov qword [rsp + 0x90], r12
cmp rdi, r12
je 0x1b984
mov r13d, 0x20000
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.00021090
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov ebp, r13d
cmp rdi, r13
mov qword [rsp + 0x38], rax
cmovl ebp, edi
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl _snprintf
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x158]
xor r8d, r8d
mov dl, 1
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl _snprintf
mov eax, ebp
add qword [rsp + 0x90], rax
sub rdi, rax
jne ObQueryNameString
mov rcx, qword [rsp + 0x150]
mov edi, 4
lea r8, [rsp + 0xe0]
lea ebp, [rdi + 0x24]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x20], edi
mov r9d, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov rcx, qword [rsp + 0x150]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
cmp dword [rsp + 0x80], r12d
jl 0x1b9f3
mov rcx, qword [rsp + 0x158]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x80]
mov r9d, ebp
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1b715
mov eax, 0xc000000e
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret