Function at 0x17530
Capabilities:
Get file attributes
Hash data via bcrypt
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
xor r12d, r12d
mov r15, rdx
mov rsi, rcx
mov r14, r8
lea rdx, [0x00018590]
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x68], r12
mov r13, r12
mov rdi, r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], r12
call sub.ksecdd.sys_BCryptOpenAlgorithmProvider
cmp eax, r12d
mov ebx, eax
jl 0x17854
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
lea ebp, [r12 + 4]
lea r8, [rsp + 0x60]
lea rdx, [0x000185a0]
mov r9d, ebp
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call sub.ksecdd.sys_BCryptGetProperty
cmp eax, r12d
mov ebx, eax
jl 0x17854
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x128]
lea rdx, [0x000185c0]
mov r9d, ebp
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call sub.ksecdd.sys_BCryptGetProperty
cmp eax, r12d
mov ebx, eax
jl 0x17854
mov edx, dword [rsp + 0x60]
lea ebp, [r12 + 1]
mov r8d, 0x7668704b
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r13, rax
cmp rax, r12
jne 0x1762f
mov ebx, 0xc000009a
jmp 0x17854
mov edx, dword [rsp + 0x128]
mov r8d, 0x7668704b
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, r12
je 0x17625
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x78]
mov r8, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call sub.ksecdd.sys_BCryptCreateHash
cmp eax, r12d
mov ebx, eax
jl 0x17854
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], ebp
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0x70]
mov edx, 0x120089
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0xb0], 0x200
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc0], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r12d
mov ebx, eax
jl 0x17854
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0x88]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, r12d
mov ebx, eax
jl 0x17854
mov rax, qword [rsp + 0xd0]
cmp rax, r12
jg 0x17750
mov ebx, 0xc0000001
jmp 0x17854
cmp rax, 0x2000000
jle 0x17762
mov ebx, 0xc0000904
jmp 0x17854
mov edx, 0x2000
mov r8d, 0x7668704b
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
cmp rax, r12
jne 0x17787
mov ebx, 0xc000009a
jmp 0x17841
mov rsi, qword [rsp + 0xd0]
cmp esi, r12d
je 0x17808
mov rcx, qword [rsp + 0x70]
mov r12d, 0x2000
lea rax, [rsp + 0x88]
cmp esi, r12d
cmovb r12d, esi
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x1783e
cmp dword [rsp + 0x90], r12d
jne 0x17839
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
call sub.ksecdd.sys_BCryptHashData
mov ebx, eax
test eax, eax
js 0x1783e
sub esi, r12d
jne 0x17794
xor r12d, r12d
mov r8d, dword [rsp + 0x128]
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov rdx, rdi
call sub.ksecdd.sys_BCryptFinishHash
cmp eax, r12d
mov ebx, eax
jl 0x17841
mov eax, dword [rsp + 0x128]
mov qword [r15], rdi
mov rdi, r12
mov dword [r14], eax
jmp 0x17841
mov ebx, 0xc00000e5
xor r12d, r12d
cmp rbp, r12
je 0x17854
mov edx, 0x7668704b
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x70]
cmp rcx, r12
je 0x17864
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x78]
cmp rcx, r12
je 0x17873
call sub.ksecdd.sys_BCryptDestroyHash
cmp rdi, r12
je 0x17886
mov edx, 0x7668704b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r13, r12
je 0x17899
mov edx, 0x7668704b
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x68]
cmp rcx, r12
je 0x178aa
xor edx, edx
call sub.ksecdd.sys_BCryptCloseAlgorithmProvider
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret