Function at 0x32a18
Capabilities:
Get file attributes
Hash data with crc32
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
call sub.ntoskrnl.exe_IoSetThreadHardErrorMode
push 0x68466d73
mov esi, 0x10000
push esi
mov byte [ebp - 0x10], al
call fcn.0001fc94
mov ebx, eax
cmp ebx, edi
jne 0x32a51
mov esi, 0xc000009a
jmp 0x32c61
cmp dword [ebp + 0xc], edi
jne 0x32a75
push esi
push ebx
push edi
call sub.ntoskrnl.exe_MmCreateMdl
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x32a6f
mov esi, 0xc000009a
jmp 0x32c4b
push eax
call sub.ntoskrnl.exe_MmBuildMdlForNonPagedPool
push esi
push edi
push ebx
call sub.ntoskrnl.exe_memset
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebx], 0x45634d67
mov dword [ebx + 4], 3
cmp esi, edi
je 0x32a9c
push 6
lea edi, [ebx + 0x10]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x1c]
push 6
lea edi, [ebx + 0x28]
pop ecx
test eax, eax
jne 0x32ab8
mov esi, 0x2cc18
push 0x44
rep movsd dword es:[edi], dword [esi]
pop ecx
jmp 0x32b69
mov esi, dword [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, 0x148
mov dword [ebp - 8], edi
mov dword [ebp + 0x18], edi
cmp dword [ebp + 0x14], edi
jbe 0x32b6b
mov dword [ebp + 0x1c], eax
lea eax, [ebx + 0x44]
mov dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x1c]
mov edx, dword [edx + 0x1c]
mov esi, dword [edx + 4]
lea eax, [ecx + 3]
and eax, 0xfffffffc
mov dword [ebp - 0x1c], edi
xor edi, edi
add esi, eax
adc edi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x30], esi
test edi, edi
ja 0x32b55
jb 0x32b0c
cmp esi, 0x10000
ja 0x32b55
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0x1c], eax
push dword [edx + 4]
add eax, ebx
push edx
push eax
call sub.ntoskrnl.exe_memcpy
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
add esp, 0xc
xor edx, edx
add ecx, dword [ebp - 0x20]
push edx
pop eax
adc edx, eax
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
add dword [ebp + 0x10], 0x20
add dword [ebp + 0x1c], 0x20
xor edi, edi
mov dword [ebp - 8], edx
cmp eax, dword [ebp + 0x14]
jb 0x32adc
jmp 0x32b6b
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x32b66
mov esi, 0xc0000040
jmp 0x32c4b
mov dword [ebp + 0x14], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
push ecx
push ebx
push edi
mov dword [ebx + 0x40], eax
mov dword [ebx + 8], ecx
call sub.ntoskrnl.exe_RtlComputeCrc32
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0xc], edi
jne 0x32bf8
push 5
push 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call sub.ntoskrnl.exe_ZwQueryInformationFile
mov esi, eax
cmp esi, 0x103
jne 0x32bc0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push edi
push edi
push edi
push edi
add eax, 0x5c
push eax
call sub.ntoskrnl.exe_KeWaitForSingleObject
mov esi, dword [ebp - 0x18]
cmp esi, edi
jl 0x32c4b
push 0
push 0
lea eax, [ebp - 0x40]
push eax
call sub.ntoskrnl.exe_KeInitializeEvent
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.ntoskrnl.exe_IoSynchronousPageWrite
mov esi, eax
lea eax, [ebp - 0x40]
xor edi, edi
jmp 0x32c1f
push edi
lea eax, [ebp - 0x28]
push eax
push 0x10000
push ebx
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push edi
push edi
push edi
push dword [eax]
call sub.ntoskrnl.exe_ZwWriteFile
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x5c
cmp esi, 0x103
jne 0x32c34
push edi
push edi
push edi
push edi
push eax
call sub.ntoskrnl.exe_KeWaitForSingleObject
mov esi, dword [ebp - 0x18]
cmp esi, edi
jl 0x32c4b
mov esi, dword [ebp - 0x14]
sub esi, 0x10000
neg esi
sbb esi, esi
and esi, 0xc000016a
push ebx
call fcn.0001fcb0
cmp dword [ebp - 4], 0
je 0x32c61
push 0
push dword [ebp - 4]
call sub.ntoskrnl.exe_ExFreePoolWithTag
push dword [ebp - 0x10]
call sub.ntoskrnl.exe_IoSetThreadHardErrorMode
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18