Function at 0x438206
Capabilities:
Get common file path
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x620
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esp + 0x618], eax
xor esi, esi
lea edi, [esp + 0x410]
push 0x208
push esi
push edi
call fcn.004ab560
add esp, 0xc
push esi
push 0x19
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x438e5c
xor ebx, ebx
dec ebx
lea esi, [esp + 0xa0]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push edi
call fcn.004c3f8c
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0043d840
lea edi, [esp + 0x94]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, esi
push edi
call fcn.0043df50
lea esi, [esp + 0x88]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, edi
push 0x15
push str.2345Soft2345Explorer
push esi
call fcn.0043e830
push esi
call fcn.00450320
add esp, 4
test al, al
jne 0x4382c5
push esi
call fcn.0043f650
add esp, 4
test al, al
je 0x438e38
lea esi, [esp + 0x7c]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, 0xa
mov edx, str.config.ini
lea ecx, [esp + 0x88]
push eax
push edx
push esi
call fcn.0043e830
cmp byte [esi + 0xb], 0
jns 0x4382f4
mov esi, dword [esp + 0x7c]
push esi
push 0x4e3882
push str.RollbackLaunch
push str.StartupInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea esi, [esp + 0x70]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, esi
call fcn.0043813d
lea eax, [esp + 0x64]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
push 0x4e6930
push esi
push eax
call fcn.004197cc
add esp, 0xc
mov eax, ebx
lea ebx, [esp + 0x58]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.0043d7e0
push ebx
push 0x70
call fcn.0045a860
add esp, 8
lea edi, [esp + 0x390]
mov ecx, ebx
push 0xc
push 0x4e69cc
push edi
call fcn.0043e830
lea esi, [esp + 0xac]
mov ecx, edi
mov eax, 0xa
push eax
mov eax, str.config.ini
push eax
push esi
call fcn.0043e830
mov ecx, ebx
push esi
call fcn.0043d930
mov ecx, esi
call fcn.0043d8f0
mov ecx, edi
call fcn.0043d8f0
xorps xmm0, xmm0
movaps xmmword [edi + 0x70], xmm0
movaps xmmword [edi + 0x60], xmm0
movaps xmmword [edi + 0x50], xmm0
movaps xmmword [edi + 0x40], xmm0
movaps xmmword [edi + 0x30], xmm0
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x10], xmm0
movaps xmmword [edi], xmm0
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4383cd
mov eax, dword [esp + 0x58]
push eax
push 0x40
push edi
push 0x4e38c0
push str.Version
push 0x4e6a0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp byte [esp + 0x63], 0
jns 0x4383f1
mov ebx, dword [esp + 0x58]
xor eax, eax
dec eax
mov dword [esp + 0x4c], eax
movzx eax, byte [esp + 0x6f]
test al, al
lea edx, [esp + 0x64]
jns 0x43840d
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov ecx, esi
push eax
push edx
call fcn.0043d840
lea edi, [esp + 0x4c]
push esi
push edi
call fcn.0045b410
add esp, 8
mov ecx, esi
call fcn.0043d8f0
mov ecx, dword [edi]
test ecx, ecx
je 0x438495
push esi
call fcn.0045baf0
movzx eax, byte [esp + 0xb7]
test al, al
jns 0x438451
mov esi, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
lea ecx, [esp + 0x310]
push eax
push esi
push ecx
call fcn.0044ca60
add esp, 0xc
cmp byte [esp + 0xb7], 0
jns 0x43847c
push dword [esp + 0xac]
call fcn.004a7ee0
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x4c], 0
test ecx, ecx
je 0x4384ac
push 1
call fcn.0045bf20
jmp 0x4384ac
xor eax, eax
mov dword [esp + 0x314], eax
mov dword [esp + 0x310], eax
mov dword [esp + 0x318], eax
cmp byte [esp + 0x31b], 0
jns 0x4384bf
mov eax, dword [esp + 0x310]
jmp 0x4384c6
lea eax, [esp + 0x310]
push ebx
push eax
push str.OldVersionForUpdate
push 0x4e6a0c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp byte [esp + 0x31b], 0
jns 0x4384f1
push dword [esp + 0x310]
call fcn.004a7ee0
add esp, 4
xorps xmm0, xmm0
movaps xmmword [esp + 0x380], xmm0
movaps xmmword [esp + 0x370], xmm0
movaps xmmword [esp + 0x360], xmm0
movaps xmmword [esp + 0x350], xmm0
movaps xmmword [esp + 0x340], xmm0
movaps xmmword [esp + 0x330], xmm0
movaps xmmword [esp + 0x320], xmm0
movaps xmmword [esp + 0x310], xmm0
cmp byte [esp + 0x63], 0
jns 0x438541
mov eax, dword [esp + 0x58]
jmp 0x438545
lea eax, [esp + 0x58]
lea ecx, [esp + 0x310]
push eax
push 0x40
push ecx
push 0x4e38c0
push 0x4e6aae
push 0x4e6a0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x438e00
cmp word [esp + 0x310], 0
je 0x438e00
lea esi, [esp + 0x58]
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x43858c
mov eax, dword [esp + 0x58]
mov edi, 0x4e6a0c
push eax
lea eax, [esp + 0x314]
push eax
push str.Version
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp byte [esp + 0x63], 0
jns 0x4385b1
mov esi, dword [esp + 0x58]
xor ebx, ebx
push esi
push ebx
push 0x4e6aae
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea esi, [esp + 0x50]
lea ecx, [esp + 0xac]
push str.2345Explorer_important.exe
call fcn.00413982
lea ecx, [esp + 0xb8]
push str.2345Recommender.exe
call fcn.00413982
lea ecx, [esp + 0xc4]
push str.capture.dll
call fcn.00413982
lea ecx, [esp + 0xd0]
push str.chrome.dll
call fcn.00413982
lea ecx, [esp + 0xdc]
push str.chrome_100_percent.pak
call fcn.00413982
lea ecx, [esp + 0xe8]
push str.chrome_200_percent.pak
call fcn.00413982
lea ecx, [esp + 0xf4]
push str.chrome_child.dll
call fcn.00413982
lea ecx, [esp + 0x100]
push 0x4e34f4
call fcn.00413982
lea ecx, [esp + 0x10c]
push str.chrome_initial.dll
call fcn.00413982
lea ecx, [esp + 0x118]
push str.chrome_watcher.dll
call fcn.00413982
lea ecx, [esp + 0x124]
push str.coral_extract.dll
call fcn.00413982
lea ecx, [esp + 0x130]
push str.courgette_dll.dll
call fcn.00413982
lea ecx, [esp + 0x13c]
push str.crashpad_helper.exe
call fcn.00413982
lea ecx, [esp + 0x148]
push str.d3dcompiler_47.dll
call fcn.00413982
lea ecx, [esp + 0x154]
push str.debug.log
call fcn.00413982
lea ecx, [esp + 0x160]
push str.ffmpegsumo.dll
call fcn.00413982
lea ecx, [esp + 0x16c]
push str.gesture_dll.dll
call fcn.00413982
lea ecx, [esp + 0x178]
push str.icudtl.dat
call fcn.00413982
lea ecx, [esp + 0x184]
push str.install.log
call fcn.00413982
lea ecx, [esp + 0x190]
push str.libcurl_x86.dll
call fcn.00413982
lea ecx, [esp + 0x19c]
push str.libegl.dll
call fcn.00413982
lea ecx, [esp + 0x1a8]
push str.libglesv2.dll
call fcn.00413982
lea ecx, [esp + 0x1b4]
push str.natives_blob.bin
call fcn.00413982
lea ecx, [esp + 0x1c0]
push str.resources.pak
call fcn.00413982
lea ecx, [esp + 0x1cc]
push str.snapshot_blob.bin
call fcn.00413982
lea ecx, [esp + 0x1d8]
push str.trident_core.dll
call fcn.00413982
lea ecx, [esp + 0x1e4]
push str.v8_context_snapshot.bin
call fcn.00413982
lea ecx, [esp + 0x1f0]
push str.welcome.ini
call fcn.00413982
lea ecx, [esp + 0x1fc]
push str.widevinecdmadapter.dll
call fcn.00413982
lea ecx, [esp + 0x208]
push str.prefs.dat
call fcn.00413982
lea ecx, [esp + 0x214]
push str.Upgrade_2345Explorer.exe
call fcn.00413982
lea ecx, [esp + 0x220]
push str.Upgrade_2345Explorer.dll
call fcn.00413982
lea ecx, [esp + 0x22c]
push str.Explorer_2345DLAgent.exe
call fcn.00413982
lea ecx, [esp + 0x238]
push str.xinput1_3.dll
call fcn.00413982
lea ecx, [esp + 0x244]
push str.2345DLAgent.dll
call fcn.00413982
lea ecx, [esp + 0x250]
push str.2345ExplorerRegister.exe
call fcn.00413982
lea ecx, [esp + 0x25c]
push str.2345ExplorerRegister.dll
call fcn.00413982
lea ecx, [esp + 0x268]
push str.2345.txt
call fcn.00413982
lea ecx, [esp + 0x274]
push str.multimedia_dll.dll
call fcn.00413982
lea ecx, [esp + 0x280]
push str.d3dcompiler_46.dll
call fcn.00413982
lea ecx, [esp + 0x28c]
push str.gdiplus_encapsulation.dll
call fcn.00413982
lea ecx, [esp + 0x298]
push str.libpeerconnection.dll
call fcn.00413982
lea ecx, [esp + 0x2a4]
push str.pdf.dll
call fcn.00413982
lea ecx, [esp + 0x2b0]
push str.content_resources.pak
call fcn.00413982
lea ecx, [esp + 0x2bc]
push str.upgrade_notify.exe
call fcn.00413982
lea ecx, [esp + 0x2c8]
push str.delegate_execute.exe
call fcn.00413982
lea ecx, [esp + 0x2d4]
push str.libexif.dll
call fcn.00413982
lea ecx, [esp + 0x2e0]
push str.wow_helper.exe
call fcn.00413982
lea ecx, [esp + 0x2ec]
push str.breakpad.dll
call fcn.00413982
lea ecx, [esp + 0x2f8]
push str.metro_driver.dll
call fcn.00413982
lea ecx, [esp + 0x304]
push str.dian_hua.exe
call fcn.00413982
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi - 4], esi
lea edi, [esp + 0x40]
lea esi, [esp + 0x4c]
lea eax, [esp + ebx]
add eax, 0xac
mov ecx, esi
push eax
push eax
lea eax, [esp + 0x58]
push eax
push edi
call fcn.0043966a
add ebx, 0xc
cmp ebx, 0x264
jne 0x438938
mov esi, 0x264
xor ebx, ebx
dec ebx
cmp byte [esp + esi + 0xab], 0
jns 0x43897b
push dword [esp + esi + 0xa0]
call fcn.004a7ee0
add esp, 4
add esi, 0xfffffff4
jne 0x438962
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
lea esi, [esp + 0x310]
push esi
call fcn.004c3f8c
add esp, 4
push eax
push esi
push edi
call fcn.0044ca20
add esp, 0xc
movzx eax, byte [esp + 0x4b]
test al, al
jns 0x4389c1
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xac]
push eax
push edi
call fcn.0045b060
cmp byte [esp + 0x4b], 0
jns 0x4389e2
push dword [esp + 0x40]
call fcn.004a7ee0
add esp, 4
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
cmp byte [esp + 0x7b], 0
js 0x438a0b
mov eax, dword [esp + 0x78]
mov dword [esp + 0x48], eax
movsd xmm0, qword [esp + 0x70]
movsd qword [esp + 0x40], xmm0
jmp 0x438a1c
lea ecx, [esp + 0x40]
push dword [esp + 0x74]
push dword [esp + 0x74]
call fcn.00435230
lea edi, [esp + 0x310]
push edi
call fcn.004c3f8c
add esp, 4
lea esi, [esp + 0x40]
mov ecx, esi
push eax
push edi
call fcn.00435670
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov ecx, esi
push 1
push 0x4e34f0
call fcn.00435670
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x438a60
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea edi, [esp + 0x70]
lea esi, [esp + 0x34]
mov ecx, esi
push edx
push eax
call fcn.0043d840
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
movzx eax, byte [esp + 0x7b]
test al, al
jns 0x438a8e
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x28]
push eax
push edi
call fcn.0043d840
lea ebx, [esp + 0x1c]
mov ecx, ebx
push 4
push str.11.0
call fcn.0045b060
lea ecx, [esp + 0xac]
push ebx
call fcn.0045b2b0
test eax, eax
js 0x438aca
lea ecx, [esp + 0x1c]
call fcn.004151d0
jmp 0x438d97
push esi
call fcn.00450290
add esp, 4
mov ebx, eax
lea edi, [esp + 0x1c]
mov ecx, edi
call fcn.004151d0
test bl, bl
lea ebx, [esp + 0x1c]
je 0x438d97
mov esi, dword [esp + 0x4c]
mov dword [esp + 4], esi
lea eax, [esp + 0x50]
cmp esi, eax
je 0x438b60
lea ebx, [esi + 0x10]
movzx eax, byte [esi + 0x1b]
mov edx, ebx
test al, al
jns 0x438b0f
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x28]
push eax
push edx
push edi
call fcn.0043e830
movzx eax, byte [esi + 0x1b]
test al, al
jns 0x438b29
mov ebx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x34]
push eax
push ebx
lea esi, [esp + 0x18]
push esi
call fcn.0043e830
push edi
push esi
call fcn.00450b30
add esp, 8
mov ecx, esi
call fcn.0043d8f0
mov ecx, edi
call fcn.0043d8f0
lea ecx, [esp + 4]
call fcn.00438eee
mov esi, dword [esp + 4]
jmp 0x438af4
xor eax, eax
dec eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, edi
lea eax, [esp + 0x310]
push eax
call fcn.00413982
mov ecx, edi
push 9
push str..manifest
call fcn.00435670
movzx eax, byte [esp + 0x27]
mov edx, edi
test al, al
jns 0x438b9f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
lea ebx, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push edx
push ebx
call fcn.0043e830
movzx eax, byte [esp + 0x27]
test al, al
jns 0x438bc0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
lea esi, [esp + 4]
lea ecx, [esp + 0x34]
push eax
push edi
mov edi, esi
push esi
call fcn.0043e830
push ebx
push esi
call fcn.00450b30
add esp, 8
mov ecx, esi
call fcn.0043d8f0
mov ecx, ebx
call fcn.0043d8f0
mov edx, 7
mov esi, str.Locales
lea ecx, [esp + 0x28]
push edx
push esi
push ebx
call fcn.0043e830
lea ecx, [esp + 0x34]
mov eax, 7
push eax
push esi
push edi
call fcn.0043e830
xor eax, eax
inc eax
push eax
push ebx
push edi
call fcn.0044fd60
add esp, 0xc
mov ecx, edi
call fcn.0043d8f0
mov ecx, ebx
call fcn.0043d8f0
mov esi, 8
mov edx, str.Resource
lea ecx, [esp + 0x28]
push esi
push edx
push ebx
call fcn.0043e830
lea ecx, [esp + 0x34]
push esi
mov eax, str.Resource
push eax
push edi
call fcn.0043e830
xor eax, eax
inc eax
push eax
push ebx
push edi
call fcn.0044fd60
add esp, 0xc
mov ecx, edi
call fcn.0043d8f0
mov ecx, ebx
call fcn.0043d8f0
mov eax, str.Plugins
lea ecx, [esp + 0x28]
mov esi, 7
push esi
push eax
push ebx
call fcn.0043e830
lea ecx, [esp + 0x34]
push esi
mov eax, str.Plugins
push eax
push edi
call fcn.0043e830
xor eax, eax
inc eax
push eax
push ebx
push edi
call fcn.0044fd60
add esp, 0xc
mov ecx, edi
call fcn.0043d8f0
mov ecx, ebx
call fcn.0043d8f0
mov esi, 0xb
mov eax, str.Swiftshader
lea ecx, [esp + 0x28]
push esi
push eax
push ebx
call fcn.0043e830
lea ecx, [esp + 0x34]
push esi
mov eax, str.Swiftshader
push eax
push edi
call fcn.0043e830
xor eax, eax
inc eax
push eax
push ebx
push edi
call fcn.0044fd60
add esp, 0xc
mov ecx, edi
call fcn.0043d8f0
mov ecx, ebx
call fcn.0043d8f0
mov edi, 6
mov esi, str.Doctor
lea ecx, [esp + 0x28]
push edi
push esi
push ebx
call fcn.0043e830
push ebx
call fcn.0044fd40
add esp, 4
mov ecx, ebx
call fcn.0043d8f0
lea ecx, [esp + 0x28]
push edi
push esi
push ebx
call fcn.0043e830
lea ecx, [esp + 0x34]
push edi
push esi
lea esi, [esp + 0xc]
push esi
call fcn.0043e830
xor eax, eax
inc eax
push eax
push ebx
push esi
call fcn.0044fd60
add esp, 0xc
mov ecx, esi
call fcn.0043d8f0
mov ecx, ebx
call fcn.0043d8f0
lea esi, [esp + 0x310]
push esi
call fcn.004c3f8c
add esp, 4
lea ecx, [esp + 0x28]
push eax
push esi
push ebx
call fcn.0043e830
push ebx
call fcn.0044fd40
add esp, 4
mov ecx, ebx
call fcn.0043d8f0
cmp byte [esp + 0x27], 0
jns 0x438d93
push dword [esp + 0x1c]
call fcn.004a7ee0
add esp, 4
lea ebx, [esp + 0x1c]
lea edi, [esp + 0x390]
push edi
call fcn.004c3f8c
add esp, 4
lea esi, [esp + 0x28]
mov ecx, esi
push eax
push edi
push ebx
call fcn.0043e830
push ebx
call fcn.0044fd40
add esp, 4
mov ecx, ebx
call fcn.0043d8f0
mov ecx, esi
call fcn.0043d8f0
lea ecx, [esp + 0x34]
call fcn.0043d8f0
cmp byte [esp + 0x4b], 0
jns 0x438de8
push dword [esp + 0x40]
call fcn.004a7ee0
add esp, 4
lea ecx, [esp + 0xac]
call fcn.004151d0
lea ecx, [esp + 0x4c]
push dword [ecx + 4]
call fcn.004398f8
lea ecx, [esp + 0x58]
call fcn.0043d8f0
cmp byte [esp + 0x6f], 0
jns 0x438e1c
push dword [esp + 0x64]
call fcn.004a7ee0
add esp, 4
cmp byte [esp + 0x7b], 0
jns 0x438e2f
push dword [esp + 0x70]
call fcn.004a7ee0
add esp, 4
lea ecx, [esp + 0x7c]
call fcn.0043d8f0
lea ecx, [esp + 0x88]
call fcn.0043d8f0
lea ecx, [esp + 0x94]
call fcn.0043d8f0
lea ecx, [esp + 0xa0]
call fcn.0043d8f0
mov ecx, dword [esp + 0x618]
xor ecx, ebp
call fcn.004a8de3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret