Function at 0x502af0
Capabilities:
Check if file exists
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c866
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x503176
push 0x7c
call fcn.00418aea
add esp, 4
mov dword [ebp - 0x25c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x25c], 0
je 0x502b81
lea ecx, [ebp - 0x260]
push ecx
call fcn.004eee80
add esp, 4
push eax
mov ecx, dword [ebp - 0x25c]
call fcn.004ef190
mov dword [ebp - 0x2dc], eax
jmp 0x502b8b
mov dword [ebp - 0x2dc], 0
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x258], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x60], eax
push 0
lea ecx, [ebp - 0x5c]
call fcn.004ebad0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004e7500
mov byte [ebp - 4], 2
push 0x523ed8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041625a
add esp, 8
mov dword [ebp - 0x10], eax
push 2
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00416afd
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call fcn.004169d3
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00416afd
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.00415d52
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0041651a
add esp, 0x10
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00416bf5
add esp, 4
cmp dword [ebp - 0x14], 0xa
jge 0x502c99
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00415c75
add esp, 4
mov dword [ebp - 0x14], 0xb37
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
call fcn.00415d52
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00415fc0
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
push str._account_id_migration_state_:2__account_tracker_service_last_update_:_13150265246298617___bookmark_editor_:_expanded_nodes_:____browser_:_window_placement_:_bottom_:728__docked_:false__left_:10__maximized_:false__right_:1014__top_:10__work_area_bottom_:738__work_area_left_:0__work_area_right_:1024__work_area_top_:0__countryid_at_install_:17230__data_reduction_:_daily_original_length_:____daily_original_length_via_data_reduction_proxy_:____daily_original_length_with_data_reduction_proxy_enabled_:____daily_received_length_:____daily_received_length_https_with_data_reduction_proxy_enabled_:____daily_received_length_long_bypass_with_data_reduction_proxy_enabled_:____daily_received_length_short_bypass_with_data_reduction_proxy_enabled_:____daily_received_length_unknown_with_data_reduction_proxy_enabled_:____daily_received_length_via_data_reduction_proxy_:____daily_received_length_with_data_reduction_proxy_enabled_:____last_update_date_:_0___data_reduction_lo_fi_:_consecutive_session_disables_:0__load_images_requests_per_session_:0__was_used_this_session_:false__default_apps_install_state_:2__dns_prefetching_:_host_referral_list_:_2___startup_list_:_1__http:__www.126.com____https:__clients2.google.com____https:__www.googleapis.com_____extensions_:_alerts_:_initialized_:true__autoupdate_:_next_check_:_13150282636807226___chrome_url_overrides_:_bookmarks_:__chrome_extension:__eemcgdkfndhakfknompkggombfjjjeno_main.html____last_chrome_version_:_45.0.2454.85___http_original_content_length_:_0___http_received_content_length_:_0___intl_:_accept_languages_:_zh_CN_zh___invalidator_:_client_id_:_ueUiSdS0ha1DxorFgCGjSQ___media_:_device_id_salt_:_vqfNme_F48APBPTLzzKghA___plugins_:_npapi_flash_migrated_to_pepper_flash_:true__plugins_list_:____profile_:_avatar_bubble_tutorial_shown_:2__avatar_index_:26__content_settings_:_exceptions_:_app_banner_:__auto_select_certificate_:__automatic_downloads_:__cookies_:__durable_storage_:__fullscreen_:__geolocation_:__images_:__javascript_:__media_stream_:__media_stream_camera_:__media_stream_mic_:__metro_switch_to_desktop_:__midi_sysex_:__mixed_script_:__mouselock_:__notifications_:__plugins_:__popups_:__ppapi_broker_:__protocol_handlers_:__push_messaging_:__site_engagement_:__ssl_cert_decisions_:__pattern_pairs_:__pref_version_:1__created_by_version_:_45.0.2454.85___exit_type_:_Normal___exited_cleanly_:true__icon_version_:3__managed_user_id_:____migrated_content_settings_exceptions_:true__migrated_default_content_settings_:true__migrated_default_media_stream_content_settings_:true__name_:_1___per_host_zoom_levels_:__protection_:_macs_:__session_:_restore_on_startup_migrated_:true__startup_urls_migration_time_:_13150265245637985___translate_blocked_languages_:__zh___zh_CN____translate_whitelists_:
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00415910
add esp, 0xc
cmp dword [ebp - 0x14], 0x3e8
jle 0x502d0f
push 0x523edc
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401000
add esp, 8
test eax, eax
je 0x502d0f
push 0x523ee0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401000
add esp, 8
push eax
lea ecx, [ebp - 0x280]
call fcn.00401e20
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2d8]
or ecx, 1
mov dword [ebp - 0x2d8], ecx
push 1
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x280]
push eax
mov ecx, dword [ebp - 0x60]
call fcn.004f3df0
movzx ecx, al
test ecx, ecx
je 0x502d0f
mov dword [ebp - 0x2e0], 1
jmp 0x502d19
mov dword [ebp - 0x2e0], 0
mov dl, byte [ebp - 0x2e0]
mov byte [ebp - 0x261], dl
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2d8]
and eax, 1
je 0x502d49
and dword [ebp - 0x2d8], 0xfffffffe
lea ecx, [ebp - 0x280]
call fcn.00401260
movzx ecx, byte [ebp - 0x261]
test ecx, ecx
je 0x503112
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x284], esp
push 4
call fcn.004eac00
mov dword [ebp - 0x2e4], eax
mov edx, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], edx
mov byte [ebp - 4], 4
push 0x523eec
push 0x523ee4
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004eb520
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x288], esp
mov eax, dword [0x55bc34]
push eax
call fcn.004ed9d0
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f0], ecx
mov byte [ebp - 4], 5
push 0x523f08
push 0x523f00
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004eb520
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.004edc90
mov byte [ebp - 4], 6
lea eax, [ebp - 0x2a4]
push eax
push 0x523f20
push 0x523f18
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov ecx, eax
call fcn.004ee2a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2a4]
call fcn.004eb3f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2a8], esp
mov edx, dword [0x55bc34]
push edx
call fcn.004ed9d0
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f8], eax
mov byte [ebp - 4], 7
push 0x523f38
push 0x523f30
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004eb520
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2c4]
call fcn.004edc90
mov byte [ebp - 4], 8
lea edx, [ebp - 0x2c4]
push edx
push 0x523f5c
push 0x523f54
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov ecx, eax
call fcn.004ee2a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c4]
call fcn.004eb3f0
lea eax, [ebp - 0x254]
push eax
call fcn.0050f820
add esp, 4
lea ecx, [ebp - 0x1d4]
push ecx
push 0x523f78
push str.session.restore_on_startup
lea edx, [ebp - 0x254]
push edx
call fcn.0050f720
add esp, 0x10
lea eax, [ebp - 0x1d4]
push eax
push str._DEBUGINFO__LOCK__SET_LockGoogleChrome_session.restore_on_startup_hash___s_n
call fcn.004e4170
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c8], esp
lea edx, [ebp - 0x1d4]
push edx
call fcn.004edc90
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], eax
mov byte [ebp - 4], 9
push 0x524004
push 0x523ffc
push 0x523ff4
push 0x523fe8
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004eb520
mov byte [ebp - 0x16c], 0
push 0x103
push 0
lea ecx, [ebp - 0x16b]
push ecx
call fcn.00415fc0
add esp, 0xc
push 0x524018
lea edx, [ebp - 0x16c]
push edx
call fcn.00415eb0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x16c]
push ecx
call fcn.00415ec0
add esp, 8
push 0x52401c
lea edx, [ebp - 0x16c]
push edx
call fcn.00415ec0
add esp, 8
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x16c]
push ecx
push str.session.startup_urls
lea edx, [ebp - 0x254]
push edx
call fcn.0050f720
add esp, 0x10
lea eax, [ebp - 0x1d4]
push eax
push str._DEBUGINFO__LOCK__SET_LockGoogleChrome_session.startup_urls_hash___s_n
call fcn.004e4170
add esp, 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2cc], esp
lea edx, [ebp - 0x1d4]
push edx
call fcn.004edc90
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x308], eax
mov byte [ebp - 4], 0xa
push 0x52409c
push 0x524094
push str.macs
push str.protection
lea ecx, [ebp - 0x5c]
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov ecx, eax
call fcn.004ee360
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004eb520
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x188]
push edx
lea ecx, [ebp - 0x44]
call fcn.004ea3e0
mov byte [ebp - 4], 0xb
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x5240ac
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041625a
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push 1
lea ecx, [ebp - 0x188]
call fcn.004012e0
push eax
call fcn.00415e20
add esp, 4
push eax
lea ecx, [ebp - 0x188]
call fcn.004012e0
push eax
call fcn.004167ae
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
call fcn.00416bf5
add esp, 4
push 0x5240b0
call fcn.004e4170
add esp, 4
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x188]
call fcn.00401260
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x2d4], ecx
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 0
je 0x503145
push 1
mov ecx, dword [ebp - 0x2d0]
call fcn.00413240
mov dword [ebp - 0x30c], eax
jmp 0x50314f
mov dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00415c75
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.00410630
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.004eb3f0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret