Function at 0x4d461a
Capabilities:
Check if file exists
Enumerate processes
Get file attributes
Set file attributes

Disassembly:
push 0x514
mov eax, 0x589468
call fcn.004fb9d0
push 2
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x3c8]
call fcn.00432a3a
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x37c], esp
push str.GoogleChromeUser_DataDefaultBookMarks
call fcn.0043479c
mov byte [ebp - 4], 5
push ecx
mov eax, esp
mov dword [ebp - 0x380], esp
push eax
lea ecx, [ebp - 0x3c8]
call fcn.004bad73
mov byte [ebp - 4], 6
lea eax, [ebp - 0x370]
push eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3c8]
call fcn.0049be74
mov byte [ebp - 4], 7
push dword [ebp - 0x370]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d4bbd
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x360]
push ebx
push eax
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x364], ebx
call fcn.004fc1f0
add esp, 0xc
push ebx
push esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x364]
push eax
push esi
mov dword [ebp - 0x364], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x4d473c
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp - 0x374]
call fcn.0043479c
mov byte [ebp - 4], 8
push str.chrome.exe
lea ecx, [ebp - 0x374]
call fcn.00431e0c
test eax, eax
jne 0x4d4717
mov dword [ebp - 0x36c], 1
lea eax, [ebp - 0x364]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x374]
add ecx, 0xfffffff0
call fcn.004310e3
cmp edi, ebx
jne 0x4d46e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x36c], ebx
je 0x4d478f
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x370]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c8]
call fcn.00432a92
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
jmp 0x4d4bfc
push dword [ebp - 0x370]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d47b4
test al, 1
je 0x4d47b4
and eax, 0xfffffffe
push eax
push dword [ebp - 0x370]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push dword [ebp - 0x370]
call fcn.004a0856
pop ecx
pop ecx
mov dword [ebp - 0x374], eax
cmp eax, ebx
je 0x4d4bbd
push ebx
lea ecx, [ebp - 0x3a0]
call fcn.00445a94
mov byte [ebp - 4], 0xf
push 1
push 0x40
push 1
push dword [ebp - 0x374]
lea ecx, [ebp - 0x520]
call fcn.004c4648
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x138]
call fcn.00442485
mov byte [ebp - 4], 0x11
push 1
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x138]
call fcn.004433c7
lea ecx, [ebp - 0x520]
call fcn.004b9a8c
push str.children
mov edi, str.bookmark_bar
push edi
mov esi, str.roots
push esi
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 0x365], 0
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
push eax
lea ecx, [ebp - 0x3b0]
call fcn.00446b85
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3b0]
call fcn.0044537e
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], ebx
cmp eax, ebx
jle 0x4d49e7
push dword [ebp - 0x378]
lea ecx, [ebp - 0x3b0]
call fcn.00447112
push eax
lea ecx, [ebp - 0x390]
call fcn.00446b85
mov byte [ebp - 4], 0x13
push 0x5a5800
lea ecx, [ebp - 0x64]
call fcn.0040f0f0
mov ebx, eax
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x48]
push eax
push str.type
lea ecx, [ebp - 0x390]
call fcn.0044738e
mov ecx, eax
call fcn.00445c0c
mov byte [ebp - 4], 0x15
push ebx
mov ecx, eax
call fcn.00417940
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0x14
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040ff10
mov byte [ebp - 4], 0x13
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.0040ff10
inc bl
je 0x4d49be
lea eax, [ebp - 0x2c]
push eax
push 0x5a5800
lea ecx, [ebp - 0x390]
call fcn.0044738e
mov ecx, eax
call fcn.00445c0c
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4d4944
lea eax, [ebp - 0x2c]
mov ebx, 0xfde9
push ebx
push eax
call fcn.004a08a3
pop ecx
pop ecx
mov dword [ebp - 0x380], eax
test eax, eax
je 0x4d49ae
push eax
lea ecx, [ebp - 0x36c]
call fcn.0043479c
mov byte [ebp - 4], 0x17
push dword [ebp - 0x380]
call fcn.004fa278
pop ecx
lea ecx, [ebp - 0x36c]
call fcn.00433966
push 0
push dword [ebp + 0x10]
lea ecx, [ebp - 0x36c]
call fcn.00432533
cmp eax, 0xffffffff
jne 0x4d4c16
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x36c]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x13
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040ff10
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x390]
call fcn.00445ba5
inc dword [ebp - 0x378]
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x37c]
jl 0x4d4890
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x390]
mov byte [ebp - 0x365], 1
call fcn.00445a94
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x390]
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x37c], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x1c
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x380], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x1d
push ecx
mov ecx, esp
mov dword [ebp - 0x36c], esp
push 0x5a84ac
call fcn.0043479c
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0x1b
call fcn.004d0204
add esp, 0x10
lea eax, [ebp - 0x390]
push eax
push str.children
push edi
push esi
lea ecx, [ebp - 0x3a0]
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.004472da
push str.date_added
lea ecx, [ebp - 0x390]
call fcn.0044738e
push eax
push str.date_modified
push edi
push esi
lea ecx, [ebp - 0x3a0]
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.00446c88
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x390]
call fcn.00445ba5
cmp byte [ebp - 0x365], 0
je 0x4d4b6a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x37c], esp
push 0x59c030
call fcn.0040f0f0
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xb8]
call fcn.0044b070
mov byte [ebp - 4], 0x20
push 1
push 0x40
push 2
push dword [ebp - 0x374]
lea ecx, [ebp - 0x470]
call fcn.004b9b77
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0044bd54
lea ecx, [ebp - 0x470]
call fcn.004b9dca
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x410]
call fcn.004b9d87
lea ecx, [ebp - 0x410]
call fcn.004475fc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xb8]
call fcn.0044aca8
push dword [ebp - 0x374]
call fcn.004fc324
pop ecx
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x3b0]
call fcn.00445ba5
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x138]
call fcn.0044283a
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4b8]
call fcn.004c4858
lea ecx, [ebp - 0x4b8]
call fcn.004475fc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3a0]
call fcn.00445ba5
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x370]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c8]
call fcn.00432a92
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004310e3
xor eax, eax
inc eax
call fcn.004fba53
ret 0xc
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x36c]
call fcn.00432533
cmp eax, 0xffffffff
jne 0x4d4ca7
push ebx
push dword [ebp + 0xc]
call fcn.004a0856
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4d4ca7
push ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x365], 1
call fcn.00444827
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x3c]
push eax
push 0x5a5800
push dword [ebp - 0x378]
lea ecx, [ebp - 0x3a0]
push str.children
push edi
push esi
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.00447112
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.00446c88
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x3c]
call fcn.00445ba5
push ebx
call fcn.004fa278
pop ecx
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x36c]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], 0x13
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040ff10
jmp 0x4d4aba