Function at 0x409441
Capabilities:
Enumerate files on windows

Disassembly:
push 0x284
mov eax, 0x41ccbc
call fcn.0041b8a8
sub ebx, ebx
push ebx
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x268], esp
push eax
mov edi, str.chromeUserPath
call fcn.00402d3a
lea eax, [ebp - 0x26c]
push eax
call fcn.004010bd
add esp, 0x10
push ebx
push 1
push ecx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x268], esp
push eax
mov edi, str.chromeExtID
call fcn.00402d3a
lea eax, [ebp - 0x278]
push eax
call fcn.004010bd
add esp, 0x10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x26c]
cmp dword [eax - 0xc], ebx
je 0x4097a7
mov eax, dword [ebp - 0x278]
cmp dword [eax - 0xc], ebx
je 0x4097a7
push eax
push str.___saw_change_to_extension_install_folders___checking_for_our_extension___s_
call fcn.0040709d
mov eax, dword [0x428020]
pop ecx
pop ecx
mov esi, 0x428020
push esi
pop ecx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x278]
lea eax, [ebp - 0x280]
push dword [ebp - 0x26c]
push str._sExtensions_s.
call fcn.00402420
add esp, 0xc
push ebx
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x268], esp
mov ebx, str.clientID
push eax
push ebx
pop edi
call fcn.00402d3a
lea eax, [ebp - 0x274]
push eax
call fcn.004010bd
add esp, 0x10
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x274]
cmp dword [eax - 0xc], 0
jne 0x4095bb
push str.BUGBUG___we_did_not_find_a_client_ID_laid_down_by_the_installer___We_will_generate_one_but_this_should_be_fixed.
call fcn.0040709d
pop ecx
lea ecx, [ebp - 0x270]
call section..text
lea edi, [ebp - 0x274]
mov byte [ebp - 4], 4
call fcn.0040291a
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [ebp - 0x274]
push 0
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x268], esp
mov edi, esp
call fcn.004028be
add eax, 0x10
mov dword [edi], eax
push ecx
mov byte [ebp - 4], 5
mov eax, esp
mov dword [ebp - 0x270], esp
push eax
push ebx
pop edi
call fcn.00402d3a
mov byte [ebp - 4], 3
call fcn.004011f0
add esp, 0x10
push 0
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x268], esp
push eax
mov edi, str.userDefBrowser
call fcn.00402d3a
lea eax, [ebp - 0x288]
push eax
call fcn.004010bd
add esp, 0x10
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 6
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x40977d
test byte [ebp - 0x264], 0x10
je 0x409756
cmp word [ebp - 0x238], 0x2e
je 0x409756
mov eax, dword [0x428020]
push esi
pop ecx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x274]
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x278]
lea eax, [ebp - 0x284]
push dword [ebp - 0x26c]
push str._sExtensions_s_sctid__s
call fcn.00402420
add esp, 0x10
mov eax, esp
mov dword [ebp - 0x27c], esp
push eax
call fcn.0040a13e
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x284]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x268], esp
mov edi, esp
mov dword [ebp - 0x268], eax
call fcn.004028be
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 7
call fcn.004017a9
pop ecx
pop ecx
test al, al
je 0x4096b4
push str.service_successfully_created_CTID_file_for_Chrome_extension
call fcn.0040709d
pop ecx
mov eax, dword [0x428020]
push esi
pop ecx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 9
push dword [ebp - 0x288]
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x278]
lea eax, [ebp - 0x27c]
push dword [ebp - 0x26c]
push str._sExtensions_s_sdefbrows__s
call fcn.00402420
add esp, 0x10
mov eax, esp
mov dword [ebp - 0x28c], esp
push eax
call fcn.0040a13e
mov byte [ebp - 4], 0xa
mov edi, dword [ebp - 0x27c]
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x290], esp
mov ebx, esp
call fcn.004028be
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 9
call fcn.004017a9
pop ecx
pop ecx
test al, al
je 0x40973f
push str.service_successfully_created_default_browser_file_for_Chrome_extension
call fcn.0040709d
pop ecx
lea eax, [edi - 0x10]
call fcn.00402daa
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x268]
call fcn.00402daa
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
or eax, eax
jne 0x409608
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x288]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [ebp - 0x280]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.00402daa
call fcn.0041b8f2
ret