Function at 0x454110
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481657
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x4b700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 4], 0
push 0x48780e
lea ecx, [ebp - 0x1a8]
call fcn.0045d100
mov byte [ebp - 4], 1
push str._n_t_policies_:__n_t_t_DisableAppUpdate_:_true_n_t_n
lea ecx, [ebp - 0x1c4]
call fcn.0045d100
mov byte [ebp - 4], 2
push str.C:Program_Files__x86_Mozilla_Thunderbirddistribution
lea ecx, [ebp - 0x1c0]
call fcn.0045d100
mov byte [ebp - 4], 3
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x4541b8
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or edi, esi
jmp 0x4545d7
push str.policies.json
lea ecx, [ebp - 0x1b4]
call fcn.0045d100
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x1c0]
lea ecx, [ebp - 0x1b8]
call fcn.0045c7c0
mov byte [ebp - 4], 5
push 0x491278
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1b8]
lea edx, [ecx - 0x10]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454228
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45424d
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
test ebx, ebx
je 0x454397
nop word [eax + eax]
push ebx
push 0xc8
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
add esp, 0xc
test eax, eax
je 0x45438d
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.004026c0
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov dword [ebp - 0x1bc], ecx
mov ebx, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x1a8]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x1b4], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x1b8], esi
test ebx, ebx
js 0x454969
test ecx, ecx
jne 0x4542ca
xor ebx, ebx
jmp 0x4542dd
push ebx
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x1a8]
mov ecx, 0x7fffffff
sub ecx, ebx
cmp ecx, esi
jl 0x454973
add esi, ebx
js 0x45497d
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x454317
push esi
lea ecx, [ebp - 0x1a8]
call fcn.004032b0
mov eax, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1b4]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x454330
mov ecx, dword [ebp - 0x1bc]
push ebx
push ecx
lea ecx, [eax + edx*2]
mov edx, ebx
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp esi, dword [eax - 8]
jg 0x454969
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1a8]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 9
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454382
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, dword [ebp - 0x1ac]
jmp 0x454260
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push ecx
push str._DisableAppUpdate_:_true
lea ecx, [ebp - 0x1a8]
call fcn.0045cc50
push ecx
test eax, eax
js 0x454463
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x1b0], esp
push str.disableAutoUpdateThunderBird_:
call fcn.0045d100
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c0]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454412
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454437
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x454806
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x454806
push str._DisableAppUpdate_:_false
lea ecx, [ebp - 0x1a8]
call fcn.0045cc50
test eax, eax
js 0x454491
push str._DisableAppUpdate_:_true
push str._DisableAppUpdate_:_false
lea ecx, [ebp - 0x1a8]
call fcn.0045cc90
jmp 0x4545d7
push 0x4937cc
lea ecx, [ebp - 0x1b4]
call fcn.0045d100
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x1c4]
push eax
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x1b8]
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
mov dword [ebp - 0x1bc], ecx
mov ebx, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x1a8]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x1b0], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x1ac], esi
test ebx, ebx
js 0x454987
test ecx, ecx
jne 0x4544fa
xor ebx, ebx
jmp 0x45450d
push ebx
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x1a8]
mov ecx, 0x7fffffff
sub ecx, ebx
cmp ecx, esi
jl 0x454991
add esi, ebx
js 0x45499b
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x454547
push esi
lea ecx, [ebp - 0x1a8]
call fcn.004032b0
mov eax, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b0]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x454560
mov ecx, dword [ebp - 0x1bc]
push ebx
push ecx
lea ecx, [eax + edx*2]
mov edx, ebx
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp esi, dword [eax - 8]
jg 0x454969
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1a8]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x1b8]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4545b2
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4545d7
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [ebp - 0x1a8]
mov ebx, dword [eax - 0xc]
test ebx, ebx
jne 0x4546af
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1b8], edx
mov esi, dword [edx - 0xc]
mov ecx, edx
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x1bc], ecx
test esi, esi
js 0x4549a5
push esi
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edx, eax
mov dword [ebp - 0x1b0], edx
mov eax, 0x7fffffff
sub eax, edx
cmp eax, ebx
jl 0x4549af
lea esi, [ebx + edx]
test esi, esi
js 0x4549b9
mov eax, dword [ebp - 0x1a8]
mov ecx, 1
sub ecx, dword [eax - 4]
mov dword [ebp - 0x1ac], ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, dword [ebp - 0x1ac]
jge 0x454671
push esi
lea ecx, [ebp - 0x1a8]
call fcn.004032b0
mov eax, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1bc]
cmp ecx, ebx
lea ecx, [eax + ecx*2]
jbe 0x454684
mov ecx, dword [ebp - 0x1b8]
push edx
push ecx
lea ecx, [eax + ebx*2]
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp esi, dword [eax - 8]
jg 0x454969
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1a8]
mov word [eax + esi*2], cx
push str.policies.json
lea ecx, [ebp - 0x1b4]
call fcn.0045d100
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x1c0]
lea ecx, [ebp - 0x1ac]
call fcn.0045c7c0
mov byte [ebp - 4], 0x14
push 0x491568
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1ac]
lea edx, [ecx - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454716
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45473b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
test esi, esi
je 0x454792
push esi
push dword [ebp - 0x1a8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 8
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x1b0], esp
push str.disableAutoUpdateThunderBird_:
call fcn.0045d100
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c0]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4547b7
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4547dc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4547ff
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046dda6
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
int3