Function at 0x4e1d8c
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push 0x298
mov eax, 0x58db01
call fcn.004fb9d0
mov ecx, dword [0x606438]
lea eax, [ebp - 0x25c]
push eax
call fcn.004a8b5e
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.utf_16
push str.utf_8
lea ecx, [ebp - 0x25c]
call fcn.004337ea
lea ecx, [ebp - 0x28c]
call fcn.00432a3a
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x260], esp
push str.GoogleChromeUser_DataDefaultWeb_Data
call fcn.0043479c
mov byte [ebp - 4], 3
push ecx
mov eax, esp
mov dword [ebp - 0x268], esp
push eax
lea ecx, [ebp - 0x28c]
call fcn.004bad73
mov byte [ebp - 4], 4
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28c]
call fcn.0049be74
mov byte [ebp - 4], 5
push dword [ebp - 0x264]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e2003
push 0x228
lea eax, [ebp - 0x254]
push ebx
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x258], ebx
call fcn.004fc1f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x258]
push eax
push esi
mov dword [ebp - 0x258], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x4e1ed3
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x268]
call fcn.0043479c
mov byte [ebp - 4], 6
push str.chrome.exe
lea ecx, [ebp - 0x268]
call fcn.00431e0c
test eax, eax
jne 0x4e1eae
mov dword [ebp - 0x260], 1
lea eax, [ebp - 0x258]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.004310e3
cmp edi, ebx
jne 0x4e1e7a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x260], ebx
je 0x4e1f07
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28c]
call fcn.00432a92
jmp 0x4e2023
push str.8C75C105_7496_4F62_8269_CC4F9BA159CB
lea ecx, [ebp - 0x2c]
call fcn.0040f0f0
mov byte [ebp - 4], 0xc
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x260], esp
push 0x59a2c0
call fcn.0043479c
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x268], esp
push str.http:__www.baidu.com_favicon.ico
call fcn.0043479c
mov byte [ebp - 4], 0xe
push ecx
lea eax, [ebp - 0x25c]
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.004324a9
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.baidu.com
call fcn.0043479c
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push 0x5a7bf8
call fcn.0043479c
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2a4]
call fcn.004b3e2c
mov byte [ebp - 4], 0x12
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x26c], esp
push eax
call fcn.004a9e41
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2c]
call fcn.004e1c98
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2a4]
call fcn.004a9da4
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040ff10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28c]
call fcn.00432a92
jmp 0x4e2023
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.004310e3
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28c]
call fcn.00432a92
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x25c]
add ecx, 0xfffffff0
call fcn.004310e3
call fcn.004fba53
ret