Function at 0x4e22c8
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push 0x3a0
mov eax, 0x58dca3
call fcn.004fba06
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2e4]
push eax
call fcn.004c32cc
mov byte [ebp - 4], 1
push dword [ebp - 0x2e4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e2312
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x2e4]
add ecx, 0xfffffff0
call fcn.004310e3
jmp 0x4e25bd
mov eax, dword [ebp - 0x2e4]
xor edi, edi
inc edi
cmp dword [eax - 4], edi
jle 0x4e2334
push dword [eax - 0xc]
lea ecx, [ebp - 0x2e4]
call fcn.00431f53
mov eax, dword [ebp - 0x2e4]
push 0xfde9
push eax
call fcn.004a0856
pop ecx
pop ecx
mov esi, eax
push edi
push 0x40
push edi
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x3ac]
call fcn.004c47ab
mov byte [ebp - 4], 4
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.00445a94
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.00442485
mov byte [ebp - 4], 6
push edi
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0xb4]
call fcn.004433c7
lea ecx, [ebp - 0x3ac]
call fcn.004b9a8c
cmp esi, ebx
je 0x4e23ab
push esi
call fcn.004fc324
pop ecx
mov byte [ebp - 4], 7
push str.restore_on_startup
push str.session
lea ecx, [ebp - 0x2fc]
call fcn.0044738e
mov ecx, eax
call fcn.0044738e
mov ecx, eax
call fcn.00443755
cmp eax, edi
jne 0x4e2424
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.0044283a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2fc]
call fcn.00445ba5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3ac]
call fcn.004c9920
mov byte [ebp - 4], 8
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x2e4]
add ecx, 0xfffffff0
call fcn.004310e3
mov dword [ebp - 4], 9
jmp 0x4e25bd
mov dword [ebp - 4], 6
jmp 0x4e243c
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e0], ebx
push 0x228
push ebx
lea eax, [ebp - 0x2dc]
push eax
call fcn.004fc1f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x2e0], 0x22c
lea eax, [ebp - 0x2e0]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x4e24db
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.0043479c
mov byte [ebp - 4], 0xb
push str.chrome.exe
lea ecx, [ebp - 0x2ec]
call fcn.00431e0c
test eax, eax
jne 0x4e24b6
mov dword [ebp - 0x2e8], 1
lea eax, [ebp - 0x2e0]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2ec]
add ecx, 0xfffffff0
call fcn.004310e3
cmp edi, ebx
jne 0x4e2482
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2e8], ebx
je 0x4e2538
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.0044283a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2fc]
call fcn.00445ba5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x344]
call fcn.004c4858
lea ecx, [ebp - 0x344]
call fcn.004475fc
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x2e4]
add ecx, 0xfffffff0
call fcn.004310e3
jmp 0x4e25bd
lea ecx, [ebp - 0x34]
call fcn.004aa267
mov byte [ebp - 4], 0xf
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x2e8], esp
lea eax, [ebp + 8]
push eax
call fcn.004324a9
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x34]
call fcn.004e21d8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.004aa2a5
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.0044283a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2fc]
call fcn.00445ba5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x344]
call fcn.004c4858
lea ecx, [ebp - 0x344]
call fcn.004475fc
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x2e4]
add ecx, 0xfffffff0
call fcn.004310e3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004310e3
call fcn.004fba62
ret 4