Function at 0x455270
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485207
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x4bc00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 4], 0
push 0x48d10a
lea ecx, [ebp - 0x1a8]
call fcn.0045fcf0
mov byte [ebp - 4], 1
push str._n_t_policies_:__n_t_t_DisableAppUpdate_:_true_n_t_n
lea ecx, [ebp - 0x1c4]
call fcn.0045fcf0
mov byte [ebp - 4], 2
push str.C:Program_Files__x86_Mozilla_Thunderbirddistribution
lea ecx, [ebp - 0x1c0]
call fcn.0045fcf0
mov byte [ebp - 4], 3
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x455318
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or edi, esi
jmp 0x455737
push str.policies.json
lea ecx, [ebp - 0x1b4]
call fcn.0045fcf0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x1c0]
lea ecx, [ebp - 0x1b8]
call fcn.0045f3b0
mov byte [ebp - 4], 5
push 0x496ca8
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1b8]
lea edx, [ecx - 0x10]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455388
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4553ad
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
test ebx, ebx
je 0x4554f7
nop word [eax + eax]
push ebx
push 0xc8
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
add esp, 0xc
test eax, eax
je 0x4554ed
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.00402680
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov dword [ebp - 0x1bc], ecx
mov ebx, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x1a8]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x1b4], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x1b8], esi
test ebx, ebx
js 0x455ac9
test ecx, ecx
jne 0x45542a
xor ebx, ebx
jmp 0x45543d
push ebx
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x1a8]
mov ecx, SysReAllocString
sub ecx, ebx
cmp ecx, esi
jl 0x455ad3
add esi, ebx
js 0x455add
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x455477
push esi
lea ecx, [ebp - 0x1a8]
call fcn.004032e0
mov eax, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1b4]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x455490
mov ecx, dword [ebp - 0x1bc]
push ebx
push ecx
lea ecx, [eax + edx*2]
mov edx, ebx
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp esi, dword [eax - 8]
jg 0x455ac9
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1a8]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 9
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4554e2
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, dword [ebp - 0x1ac]
jmp 0x4553c0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push ecx
push str._DisableAppUpdate_:_true
lea ecx, [ebp - 0x1a8]
call fcn.0045f840
push ecx
test eax, eax
js 0x4555c3
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push 0x48d168
call fcn.0045fcf0
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x1b0], esp
push str.disableAutoUpdateThunderBird_:
call fcn.0045fcf0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c0]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455572
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455597
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x455966
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x455966
push str._DisableAppUpdate_:_false
lea ecx, [ebp - 0x1a8]
call fcn.0045f840
test eax, eax
js 0x4555f1
push str._DisableAppUpdate_:_true
push str._DisableAppUpdate_:_false
lea ecx, [ebp - 0x1a8]
call fcn.0045f880
jmp 0x455737
push 0x4991f8
lea ecx, [ebp - 0x1b4]
call fcn.0045fcf0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x1c4]
push eax
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x1b8]
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
mov dword [ebp - 0x1bc], ecx
mov ebx, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x1a8]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x1b0], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x1ac], esi
test ebx, ebx
js 0x455ae7
test ecx, ecx
jne 0x45565a
xor ebx, ebx
jmp 0x45566d
push ebx
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x1a8]
mov ecx, SysReAllocString
sub ecx, ebx
cmp ecx, esi
jl 0x455af1
add esi, ebx
js 0x455afb
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x4556a7
push esi
lea ecx, [ebp - 0x1a8]
call fcn.004032e0
mov eax, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b0]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x4556c0
mov ecx, dword [ebp - 0x1bc]
push ebx
push ecx
lea ecx, [eax + edx*2]
mov edx, ebx
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp esi, dword [eax - 8]
jg 0x455ac9
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1a8]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x1b8]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455712
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455737
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, dword [ebp - 0x1a8]
mov ebx, dword [eax - 0xc]
test ebx, ebx
jne 0x45580f
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1b8], edx
mov esi, dword [edx - 0xc]
mov ecx, edx
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x1bc], ecx
test esi, esi
js 0x455b05
push esi
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edx, eax
mov dword [ebp - 0x1b0], edx
mov eax, SysReAllocString
sub eax, edx
cmp eax, ebx
jl 0x455b0f
lea esi, [ebx + edx]
test esi, esi
js 0x455b19
mov eax, dword [ebp - 0x1a8]
mov ecx, 1
sub ecx, dword [eax - 4]
mov dword [ebp - 0x1ac], ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, dword [ebp - 0x1ac]
jge 0x4557d1
push esi
lea ecx, [ebp - 0x1a8]
call fcn.004032e0
mov eax, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1bc]
cmp ecx, ebx
lea ecx, [eax + ecx*2]
jbe 0x4557e4
mov ecx, dword [ebp - 0x1b8]
push edx
push ecx
lea ecx, [eax + ebx*2]
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x1a8]
cmp esi, dword [eax - 8]
jg 0x455ac9
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1a8]
mov word [eax + esi*2], cx
push str.policies.json
lea ecx, [ebp - 0x1b4]
call fcn.0045fcf0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x1c0]
lea ecx, [ebp - 0x1ac]
call fcn.0045f3b0
mov byte [ebp - 4], 0x14
push 0x496f98
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1ac]
lea edx, [ecx - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455876
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45589b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
test esi, esi
je 0x4558f2
push esi
push dword [ebp - 0x1a8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 8
mov ecx, esp
mov dword [ebp - 0x1ac], esp
push 0x48d168
call fcn.0045fcf0
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x1b0], esp
push str.disableAutoUpdateThunderBird_:
call fcn.0045fcf0
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 3
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c0]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455917
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c4]
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45593c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x45595f
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00471083
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
int3