Function at 0x401a00
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x5270
call fcn.00403e00
mov eax, dword [0x4240c0]
xor eax, esp
mov dword [esp + 0x526c], eax
mov eax, dword [esp + 0x5274]
test byte [eax], 0x10
push ebx
push esi
mov esi, dword [esp + 0x5280]
push edi
push 0
je 0x401a37
push 0x2200000
jmp 0x401a3c
push 0x200000
push 3
push 0
push 3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov bl, byte [0x424fad]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401a91
test bl, bl
jne 0x401a91
push esi
push str._rFailed_to_open__s:
call fcn.0040384b
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004019c0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x526c]
xor ecx, esp
call fcn.00403600
add esp, 0x5270
ret
mov ecx, dword [0x424fa4]
inc ecx
mov eax, 0x10624dd3
mul ecx
shr edx, 5
imul edx, edx, 0x1f4
mov dword [0x424fa4], ecx
sub ecx, edx
jne 0x401af9
test bl, bl
jne 0x401af9
cmp dword [0x424fa8], 3
jne 0x401ad5
push 0x41fafc
call fcn.0040384b
mov dword [0x424fa8], 0
jmp 0x401ae5
inc dword [0x424fa8]
push 0x41faf8
call fcn.0040384b
add esp, 4
call fcn.00403c3d
add eax, 0x20
push eax
call fcn.00403be1
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
je 0x401de8
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x4268
lea edx, [esp + 0x101c]
push edx
push 0
push 0
push 0x900a8
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x401dbc
mov eax, dword [esp + 0x1010]
test eax, eax
jns 0x401d62
cmp eax, 0xa0000003
ja 0x401c79
je 0x401b86
cmp eax, 0x80000000
je 0x401c9d
cmp eax, 0x80000007
je 0x401b7b
cmp eax, 0x8000000a
jne 0x401c87
push esi
push str._s:_DISTRIBUTED_FILE_SYSTEM_POINT_n
jmp 0x401d4e
push esi
push str._s:_SINGLE_INSTANCE_STORE_POINT_n
jmp 0x401d4e
movzx eax, word [esp + 0x101e]
movzx ecx, word [esp + 0x101c]
push eax
lea edx, [esp + ecx + 0x1024]
push edx
lea eax, [esp + 0x818]
push eax
call fcn.00403a0d
movzx ecx, word [esp + 0x102a]
movzx eax, word [esp + 0x1026]
shr ecx, 1
xor edx, edx
mov word [esp + ecx*2 + 0x81c], dx
movzx ecx, word [esp + 0x1024]
push eax
lea edx, [esp + ecx + 0x1030]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00403a0d
movzx ecx, word [esp + 0x1032]
lea eax, [esp + 0x28]
shr ecx, 1
xor edx, edx
push 0x41fa60
push eax
mov word [esp + ecx*2 + 0x30], dx
call fcn.004039ac
add esp, 0x20
push esi
test eax, eax
je 0x401c12
push str._s:_JUNCTION_n
jmp 0x401c17
push str._s:_MOUNT_POINT_n
call fcn.0040384b
add esp, 8
cmp word [esp + 0x101e], 0
je 0x401c3f
lea ecx, [esp + 0x810]
push ecx
push str.___Print_Name_____:__s_n
call fcn.0040384b
add esp, 8
cmp word [esp + 0x101a], 0
je 0x401d56
push 4
lea edx, [esp + 0x14]
push str.___
push edx
call fcn.00403975
add esp, 0xc
test eax, eax
jne 0x401c6f
lea eax, [esp + 0x18]
jmp 0x401d48
lea ecx, [esp + 0x10]
push ecx
jmp 0x401d49
cmp eax, 0xa000000c
je 0x401c9d
cmp eax, 0xc0000004
je 0x401c92
push esi
push str._s:_UNKNOWN_MICROSOFT_REPARSE_POINT_n
jmp 0x401d4e
push esi
push str._s:_HIERARCHICAL_STORAGE_MANAGEMENT_REPARSE_n
jmp 0x401d4e
movzx edx, word [esp + 0x101e]
movzx eax, word [esp + 0x101c]
push edx
lea ecx, [esp + eax + 0x1028]
push ecx
lea edx, [esp + 0x818]
push edx
call fcn.00403a0d
movzx eax, word [esp + 0x102a]
movzx edx, word [esp + 0x1026]
shr eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x81c], cx
movzx eax, word [esp + 0x1024]
push edx
lea ecx, [esp + eax + 0x1034]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00403a0d
movzx eax, word [esp + 0x1032]
shr eax, 1
xor ecx, ecx
push esi
push str._s:_SYMBOLIC_LINK_n
mov word [esp + eax*2 + 0x30], cx
call fcn.0040384b
add esp, 0x20
cmp word [esp + 0x101e], 0
je 0x401d39
lea edx, [esp + 0x810]
push edx
push str.___Print_Name_____:__s_n
call fcn.0040384b
add esp, 8
cmp word [esp + 0x101a], 0
je 0x401d56
lea eax, [esp + 0x10]
push eax
push 0x41f8e0
call fcn.0040384b
add esp, 8
push 0x41f8dc
call fcn.0040384b
jmp 0x401ddf
push esi
push str._s:_THIRD_PARTY_REPARSE_POINT_n
call fcn.0040384b
mov ecx, dword [esp + 0x1018]
push ecx
push str.___Tag_________:_0x_X_n
call fcn.0040384b
add esp, 0x10
test dword [esp + 0x1010], 0x20000000
mov eax, str.TRUE
jne 0x401d99
mov eax, str.FALSE
push eax
push str.___Surrogate___:__s_n
call fcn.0040384b
movzx edx, word [esp + 0x101c]
push edx
push str.___Size_of_data:__d_bytes_n_n
call fcn.0040384b
add esp, 0x10
jmp 0x401de2
cmp byte [0x424fad], 0
jne 0x401de2
push esi
push str._rFailed_to_query_reparse_info_for__s:
call fcn.0040384b
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004019c0
add esp, 4
inc byte [0x424faf]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x5278]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403600
add esp, 0x5270
ret