Function at 0x429e70
Capabilities:
Check os version
Create directory
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574ddd
mov eax, dword fs:[0]
push eax
sub esp, 0x714
mov eax, dword [0x5f0bf8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x620], ecx
mov dword [ebp - 0x628], edi
mov dword [ebp - 0x610], esi
cmp edi, esi
je 0x429fc8
mov eax, dword [edi + 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
call fcn.00401e80
add eax, 0x10
mov dword [ebp - 0x648], eax
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x24]
sub eax, 0x10
push eax
call fcn.00401e80
add eax, 0x10
add esp, 8
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 3
mov ecx, dword [edi + 0x2c]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push esi
push 1
push 0x40e
push ecx
mov dword [ebp - 0x63c], esi
call ebx
push 0x104
lea edx, [ebp - 0x420]
push esi
push edx
call fcn.00543b50
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea ecx, [ebp - 0x218]
push esi
push ecx
call fcn.00543b50
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push esi
push str.foxfzip
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x429fcf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429f9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x648]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429fc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x42a35f
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x618]
call fcn.00404420
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x638]
call fcn.0042ec60
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x62c]
push edx
lea ecx, [ebp - 0x638]
call fcn.0042ef90
test eax, eax
jg 0x42a144
cmp dword [ebp + 0x10], esi
jne 0x42a0d3
push 0x30
lea eax, [ebp - 0x64c]
push eax
mov ecx, 0x5f60b0
call fcn.004085d0
mov byte [ebp - 4], 8
mov eax, dword [eax]
cmp eax, esi
je 0x42a05b
add eax, 0xc
jmp 0x42a060
mov eax, 0x587f8c
push eax
push 0x29e5
push ecx
mov ecx, esp
mov dword [ebp - 0x640], esp
push 0xffffffffffffffff
push str.FoxitUpdater_DLL
call fcn.00567811
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x644]
push ecx
mov byte [ebp - 4], 8
call fcn.004337e0
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
cmp eax, esi
je 0x42a0a1
add eax, 0xc
jmp 0x42a0a6
mov eax, 0x587f8c
mov edx, dword [edi + 0x2c]
push eax
push edx
mov ecx, 0x5f60b0
call fcn.0040aed0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x644]
call fcn.005685da
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x64c]
call fcn.005685da
mov eax, dword [edi + 0x2c]
push esi
push esi
push 0x417
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x638]
call fcn.0042ec70
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x618]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a119
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a13f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429f9f
mov ecx, dword [edi + 0x2c]
push 0
push 2
push 0x40e
push ecx
call ebx
lea ecx, [ebp - 0x6c0]
call fcn.0044fe8a
mov byte [ebp - 4], 0xe
mov dword [ebp - method.CTypedPtrArray_class_CPtrArray__struct__UpdaterInfo__.virtual_0], 0x58c948
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x618]
lea edx, [ebp - 0x6c0]
push edx
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x640], esp
push eax
mov dword [ebp - 0x678], esi
call fcn.00401e80
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x620]
call fcn.004273e0
mov ecx, dword [ebp - 0x6b8]
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x664], 0
test ecx, ecx
jg 0x42a386
mov ecx, dword [edi + 0x2c]
push 0
push 3
push 0x40e
push ecx
call ebx
mov edx, dword [ebp - 0x618]
mov ecx, dword [ebp - 0x620]
push edx
call fcn.00422920
cmp dword [ebp + 0xc], 0
jne 0x42a202
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [edi + 0x2c]
push 0
push 4
push 0x40e
push ecx
call ebx
xor edi, edi
cmp dword [ebp - 0x674], edi
jle 0x42a2ad
mov bl, 0x5f
test edi, edi
js 0x42b6cf
cmp edi, dword [ebp - 0x6b8]
jge 0x42b6cf
mov edx, dword [ebp - 0x6bc]
mov esi, dword [edx + edi*4]
test esi, esi
je 0x42a2a0
mov dword [ebp - 0x660], esi
mov byte [ebp - 4], bl
lea eax, [esi + 4]
mov dword [ebp - 0x640], eax
mov byte [ebp - 4], bl
mov eax, dword [eax]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a275
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a297
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.00440737
add esp, 4
inc edi
cmp edi, dword [ebp - 0x674]
jl 0x42a221
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6c0]
call fcn.0044fea1
mov esi, dword [ebp - 0x610]
cmp esi, 8
je 0x42a2d4
cmp esi, 9
je 0x42a2d4
cmp esi, 0xbc2
jne 0x42a2d9
mov esi, 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x638]
call fcn.0042ec70
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x618]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a30e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a334
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x648]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a35d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005437e5
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x664]
test eax, eax
js 0x42b6cf
cmp eax, ecx
jge 0x42b6cf
mov ecx, dword [ebp - 0x6bc]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x624], eax
test eax, eax
je 0x42b56a
push 0x587f8c
lea ecx, [ebp - 0x608]
call fcn.00404420
mov byte [ebp - 4], 0x12
cmp dword [ebp + 0xc], 0
mov edi, dword [ebp - 0x624]
mov esi, dword [ebp - 0x628]
jne 0x42a3df
cmp dword [esi + 0x44], 0
jmp 0x42a3e3
cmp dword [edi + 8], 0
je 0x42a61c
mov eax, dword [edi + 4]
push str.patch
push eax
call fcn.00543f07
add esp, 8
test eax, eax
je 0x42a61c
mov eax, dword [edi + 4]
push str.updater
push eax
call fcn.00543f07
add esp, 8
test eax, eax
je 0x42a61c
mov eax, dword [esi + 0x50]
cmp dword [eax - 0xc], 0
jl 0x42a441
push str.TRUE
push eax
call fcn.00543063
add esp, 8
test eax, eax
je 0x42a441
sub eax, dword [esi + 0x50]
sar eax, 1
je 0x42a5f4
push str.__Dir
lea ecx, [ebp - 0x608]
call fcn.00403dd0
push 0x587f8c
lea ecx, [ebp - 0x60c]
call fcn.00404420
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x60c]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x42a495
push 0x104
lea ecx, [ebp - 0x60c]
call fcn.00401e20
mov edx, dword [ebp - 0x60c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x60c]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00543dc3
add esp, 8
test eax, eax
js 0x42b594
mov ecx, dword [ebp - 0x60c]
cmp eax, dword [ecx - 8]
jg 0x42b594
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x60c]
xor edx, edx
mov word [ecx + eax*2], dx
push 0x5c
lea ecx, [ebp - 0x60c]
call fcn.00405d50
push eax
lea edx, [ebp - 0x688]
push edx
lea ecx, [ebp - 0x60c]
call fcn.00405f30
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x60c]
call fcn.00403760
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x688]
call fcn.004023c0
push 0x5894a0
lea ecx, [ebp - 0x608]
call fcn.00409c50
cmp dword [esi + 0x44], 0
je 0x42a5bf
push 0x5c
lea ecx, [ebp - 0x60c]
call fcn.00405d50
inc eax
push eax
lea eax, [ebp - 0x67c]
push eax
lea ecx, [ebp - 0x60c]
call fcn.00405f30
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x60c]
call fcn.00403760
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x67c]
call fcn.004023c0
mov eax, dword [esi + 4]
cmp dword [eax - 0xc], 0
jl 0x42a5ac
push str.Phantom
push eax
call fcn.00543063
add esp, 8
test eax, eax
je 0x42a5ac
sub eax, dword [esi + 4]
sar eax, 1
cmp eax, 0xffffffff
je 0x42a5ac
push 0x588314
lea ecx, [ebp - 0x60c]
call fcn.00409c50
jmp 0x42a5bf
mov eax, dword [esi + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x60c]
call fcn.00409220
mov eax, dword [ebp - 0x60c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
push 0x5894a0
lea ecx, [ebp - 0x608]
call fcn.00409c50
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x60c]
call fcn.004023c0
push 0x5894a4
lea ecx, [ebp - 0x608]
call fcn.00409c50
mov eax, dword [edi + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
jmp 0x42a87a
push 8
push str.__Appid
lea ecx, [ebp - 0x608]
call fcn.00402e30
push 1
push 0x5894a0
lea ecx, [ebp - 0x608]
call fcn.00409220
push 0xc
push 0x58b448
lea ecx, [ebp - 0x608]
call fcn.00409220
push 1
push 0x5894a0
lea ecx, [ebp - 0x608]
call fcn.00409220
mov eax, dword [esi + 0x50]
cmp dword [eax - 0xc], 0
jl 0x42a686
push str.TRUE
push eax
call fcn.00543063
add esp, 8
test eax, eax
je 0x42a686
sub eax, dword [esi + 0x50]
sar eax, 1
je 0x42a6d2
push str.__Dir
lea ecx, [ebp - 0x608]
call fcn.00409c50
push 0x5894a0
lea ecx, [ebp - 0x608]
call fcn.00409c50
mov ecx, dword [ebp - 0x620]
mov eax, dword [ecx + 0x9c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
push 0x5894a0
lea ecx, [ebp - 0x608]
call fcn.00409c50
mov eax, dword [esi + 0x54]
push str.TRUE
push eax
call fcn.00543f07
add esp, 8
test eax, eax
jne 0x42a711
mov eax, dword [esi + 4]
push str.Reader_Updater_exe
push eax
call fcn.00543f07
add esp, 8
test eax, eax
jne 0x42a711
cmp dword [esi + 0x58], eax
je 0x42a711
push str.__InstallPhantom
lea ecx, [ebp - 0x608]
call fcn.0041a460
mov dword [ebp - 0x654], 0
mov byte [ebp - 4], 0x13
push ecx
mov dword [ebp - 0x610], esp
mov ecx, esp
push 0xffffffffffffffff
push str.langid
call fcn.005685f4
mov byte [ebp - 4], 0x14
push ecx
mov dword [ebp - 0x660], esp
mov ecx, esp
push 0xffffffffffffffff
push str.SoftwareFoxit_SoftwareFoxit_Reader_7.0PreferencesLanguages
call fcn.005685f4
mov byte [ebp - 4], 0x15
push SysReAllocString
lea edx, [ebp - 0x690]
push edx
mov byte [ebp - 4], 0x13
call fcn.0042fc70
add esp, 0x10
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x654]
call fcn.00568d3d
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x690]
call fcn.005685da
mov eax, dword [ebp - 0x654]
test eax, eax
je 0x42a797
add eax, 0xc
jmp 0x42a79c
mov eax, 0x587f8c
push eax
call fcn.00543df9
movzx eax, ax
mov ecx, 0xbf6f
add esp, 4
cmp ax, cx
jne 0x42a7bc
push str.__Langchs__verysilent_TYPEupdater
jmp 0x42a860
mov edx, 0xbf78
cmp ax, dx
jne 0x42a7d0
push str.__Langde__verysilent_TYPEupdater
jmp 0x42a860
mov ecx, 0xbf8f
cmp ax, cx
jne 0x42a7e4
push str.__Langes__verysilent_TYPEupdater
jmp 0x42a860
mov edx, 0xbf76
cmp ax, dx
jne 0x42a7f5
push str.__Langfr__verysilent_TYPEupdater
jmp 0x42a860
mov ecx, 0xbf81
cmp ax, cx
jne 0x42a806
push str.__Langpt__verysilent_TYPEupdater
jmp 0x42a860
mov edx, 0xbf83
cmp ax, dx
jne 0x42a817
push str.__Langru__verysilent_TYPEupdater
jmp 0x42a860
mov ecx, 0xbf89
cmp ax, cx
jne 0x42a828
push str.__Langjp__verysilent_TYPEupdater
jmp 0x42a860
mov edx, 0xbf7b
cmp ax, dx
jne 0x42a839
push str.__Langko__verysilent_TYPEupdater
jmp 0x42a860
mov ecx, 0xbf70
cmp ax, cx
jne 0x42a84a
push str.__Langtw__verysilent_TYPEupdater
jmp 0x42a860
mov edx, 0xbf8d
cmp ax, dx
jne 0x42a85b
push str.__Langhk__verysilent_TYPEupdater
jmp 0x42a860
push str.__Langen__verysilent_TYPEupdater
lea ecx, [ebp - 0x608]
call fcn.00409c50
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x654]
call fcn.005685da
lea eax, [edi + 4]
mov dword [ebp - 0x610], eax
mov eax, dword [eax]
push str.updater
push eax
call fcn.00543f07
add esp, 8
test eax, eax
jne 0x42a8ca
push 3
lea eax, [ebp - 0x698]
push eax
mov ecx, edi
call fcn.00406b40
mov byte [ebp - 4], 0x1a
mov eax, dword [eax]
or dword [ebp - 0x614], 1
push 0x58d340
push eax
call fcn.00543f07
add esp, 8
test eax, eax
jne 0x42a8ca
mov bl, 1
jmp 0x42a8cc
xor bl, bl
mov dword [ebp - 4], 0x12
test byte [ebp - 0x614], 1
je 0x42a909
and dword [ebp - 0x614], 0xfffffffe
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a909
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42ad6f
push 0x587f8c
lea ecx, [ebp - 0x634]
call fcn.00404420
mov byte [ebp - 4], 0x1c
mov eax, dword [esi + 0x4c]
push 0x5c
push eax
call fcn.00543d95
add esp, 8
test eax, eax
jne 0x42a93c
or eax, 0xffffffff
jmp 0x42a941
sub eax, dword [esi + 0x4c]
sar eax, 1
push eax
lea ecx, [ebp - 0x6cc]
push ecx
lea ecx, [esi + 0x4c]
call fcn.00405f30
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x608]
call fcn.00401db0
push 3
push 0x58d338
lea ecx, [ebp - 0x608]
call fcn.00409220
push edi
lea edx, [ebp - 0x6d0]
push 0x5894a0
push edx
call fcn.0040cf70
mov byte [ebp - 4], 0x1e
push 0x58d330
push eax
lea eax, [ebp - 0x6c8]
push eax
call fcn.00406d70
add esp, 0x18
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x6c8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a9d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x6d0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a9ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
push str._qn
lea ecx, [ebp - 0x608]
call fcn.00409220
push 0xb
push str._norestart
lea ecx, [ebp - 0x608]
call fcn.00409220
push 0xd
push str.TYPEupdater
lea ecx, [ebp - 0x608]
call fcn.00409220
push 0x10
push 0x58d2cc
lea ecx, [ebp - 0x608]
call fcn.00409220
mov esi, dword [ebp - 0x620]
mov eax, dword [esi + 0x9c]
sub eax, 0x10
push eax
call fcn.00401e80
lea edi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x61c], edi
mov byte [ebp - 4], 0x23
push 1
lea ecx, [ebp - 0x6d8]
push ecx
lea ecx, [esi + 0x9c]
call fcn.00406b40
mov byte [ebp - 4], 0x24
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x42aaa0
test ecx, ecx
js 0x42b594
cmp word [eax], 0x5c
jne 0x42aaa0
mov bl, cl
jmp 0x42aaa2
xor bl, bl
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x6d8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42aac8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42ab08
mov edi, dword [edi - 0xc]
dec edi
push edi
lea ecx, [ebp - 0x6a4]
push ecx
lea ecx, [ebp - 0x61c]
call fcn.00405f30
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x61c]
call fcn.00403760
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x6a4]
call fcn.004023c0
mov edi, dword [ebp - 0x61c]
push 0x5c
push edi
call fcn.00543d95
add esp, 8
test eax, eax
jne 0x42ab1c
or eax, 0xffffffff
jmp 0x42ab20
sub eax, edi
sar eax, 1
push eax
lea edx, [ebp - 0x684]
push edx
lea ecx, [ebp - 0x61c]
call fcn.00405f30
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x61c]
call fcn.00403760
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x684]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ab69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x58d2c8
lea ecx, [ebp - 0x64c]
call fcn.00403d20
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x68c]
push 0x5894a0
push edx
call fcn.0040cf70
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x64c]
push ecx
push eax
lea edx, [ebp - 0x6ac]
push edx
call fcn.00409b60
add esp, 0x18
mov byte [ebp - 4], 0x2b
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x6ac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42abec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x68c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ac12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ac38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x634]
push ecx
mov ecx, dword [ebp - 0x620]
call fcn.00424c90
push 0x588d00
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x65c]
push eax
call fcn.00406d70
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x634]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x65c]
call fcn.00409220
mov ecx, dword [ebp - 0x634]
cmp dword [ecx - 0xc], 1
jle 0x42acc7
mov edx, dword [ebp - 0x65c]
push 0
push edx
call fcn.00544011
add esp, 8
cmp eax, 0xffffffff
je 0x42acc7
push str._Transforms
lea ecx, [ebp - 0x608]
call fcn.00409c50
mov eax, dword [ebp - 0x634]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
mov ecx, dword [ebp - 0x624]
push str.msiexec
call fcn.00403dd0
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x65c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42acfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x61c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ad23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x6cc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ad49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ad6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x624]
push 3
lea ecx, [ebp - 0x694]
push ecx
mov ecx, esi
call fcn.00406b40
mov byte [ebp - 4], 0x34
mov eax, dword [eax]
push 0x58d294
push eax
call fcn.00543f07
add esp, 8
test eax, eax
sete bl
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x694]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42adc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42ae94
lea ecx, [ebp - 0x608]
call fcn.00401db0
push 8
push str._update
lea ecx, [ebp - 0x608]
call fcn.00409220
push esi
lea ecx, [ebp - 0x69c]
push 0x5894a0
push ecx
call fcn.0040cf70
mov byte [ebp - 4], 0x36
push 0x58d330
push eax
lea edx, [ebp - 0x6c4]
push edx
call fcn.00406d70
add esp, 0x18
mov byte [ebp - 4], 0x37
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x608]
call fcn.00409220
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x6c4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ae50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x69c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ae76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
push str._qn
lea ecx, [ebp - 0x608]
call fcn.00409220
push str.msiexec
mov ecx, esi
call fcn.00403dd0
mov eax, dword [esi]
xor edi, edi
cmp dword [eax - 0xc], edi
jl 0x42af32
push str.Eastern_Asian_Language
push eax
call fcn.00543063
add esp, 8
test eax, eax
je 0x42af32
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x42af32
mov ebx, dword [ebp - 0x620]
push str.fpdfcjk.bin
lea ecx, [ebx + 0x9c]
push ecx
lea edx, [ebp - 0x66c]
push edx
call fcn.00406d70
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x66c]
push edi
push eax
call fcn.00544011
add esp, 0x14
test eax, eax
jne 0x42af0a
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42af0a
lea edi, [eax + 1]
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x66c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42af38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42af38
mov ebx, dword [ebp - 0x620]
mov esi, dword [ebp - 0x610]
mov eax, dword [esi]
push str.updater
push eax
call fcn.00543f07
add esp, 8
test eax, eax
je 0x42af77
test edi, edi
jne 0x42af77
mov eax, dword [esi]
push str.patch
push eax
call fcn.00543f07
add esp, 8
test eax, eax
jne 0x42b19b
cmp dword [ebp + 0x10], eax
jne 0x42b19b
mov ecx, ebx
call fcn.00427210
test eax, eax
je 0x42b19b
mov edi, dword [ebp - 0x628]
push 0x29d6
push ecx
mov ecx, esp
mov dword [ebp - 0x660], esp
push 0xffffffffffffffff
push str.FoxitUpdater_DLL
call fcn.00567811
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6a0]
push ecx
mov byte [ebp - 4], 0x12
call fcn.004337e0
add esp, 0xc
mov byte [ebp - 4], 0x3d
mov eax, dword [eax]
test eax, eax
je 0x42afcc
add eax, 0xc
jmp 0x42afd1
mov eax, 0x587f8c
push eax
lea ecx, [ebp - 0x670]
call fcn.00404420
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x6a0]
call fcn.005685da
lea edx, [ebp - 0x6a8]
push edx
mov ecx, 0x5f60b0
call fcn.004085d0
mov byte [ebp - 4], 0x40
mov eax, dword [eax]
test eax, eax
je 0x42b00c
add eax, 0xc
jmp 0x42b011
mov eax, 0x587f8c
push eax
lea ecx, [ebp - 0x668]
call fcn.00404420
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x6a8]
call fcn.005685da
call fcn.0044184e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42b59e
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x644], eax
mov byte [ebp - 4], 0x44
push 0x2a3e
push ecx
mov ecx, esp
mov dword [ebp - 0x660], esp
push 0xffffffffffffffff
push str.FoxitUpdater_DLL
call fcn.00567811
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x6d4]
push ecx
mov byte [ebp - 4], 0x44
call fcn.004337e0
add esp, 0xc
mov byte [ebp - 4], 0x46
mov eax, dword [eax]
test eax, eax
je 0x42b096
add eax, 0xc
jmp 0x42b09b
mov eax, 0x587f8c
push eax
lea ecx, [ebp - 0x658]
call fcn.00404420
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x6d4]
call fcn.005685da
mov edx, dword [ebp - 0x670]
mov eax, dword [ebp - 0x658]
push edx
push eax
lea ecx, [ebp - 0x644]
push ecx
call fcn.00403cd0
mov edx, dword [ebp - 0x668]
mov esi, dword [ebp - 0x644]
mov eax, dword [edi + 0x2c]
add esp, 0xc
push 5
push edx
push esi
push eax
mov ecx, 0x5f60b0
call fcn.0040aed0
cmp eax, 2
je 0x42b5a8
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x658]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b120
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x42
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b140
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x668]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b166
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x670]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b18c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, ebx
call fcn.00427210
test eax, eax
jne 0x42af8c
push 0x587f8c
lea ecx, [ebp - 0x650]
call fcn.00404420
mov byte [ebp - 4], 0x56
push 0x114
lea ecx, [ebp - 0x534]
push 0
push ecx
call fcn.00543b50
add esp, 0xc
lea edx, [ebp - 0x534]
push edx
mov dword [ebp - 0x534], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x530], 5
jbe 0x42b1f5
push str.runas
lea ecx, [ebp - 0x650]
call fcn.00403dd0
mov esi, dword [ebp - 0x624]
push 3
lea eax, [ebp - 0x680]
push eax
mov ecx, esi
call fcn.00406b40
mov byte [ebp - 4], 0x57
mov eax, dword [eax]
push 0x58d294
push eax
call fcn.00543f07
xor edi, edi
add esp, 8
cmp eax, edi
sete bl
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0x680]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b24c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42b260
push str.runas
lea ecx, [ebp - 0x650]
call fcn.00403dd0
push 0x38
lea ecx, [ebp - 0x71c]
push edi
push ecx
call fcn.00543b50
mov edx, dword [ebp - 0x650]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x608]
mov dword [ebp - 0x714], edx
add esp, 0xc
lea edx, [ebp - 0x720]
push edx
mov dword [ebp - 0x720], 0x3c
mov dword [ebp - 0x71c], 0x40
mov dword [ebp - 0x718], edi
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x708], edi
mov dword [ebp - 0x704], 5
mov dword [ebp - 0x700], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x610], eax
cmp eax, edi
je 0x42b51e
mov eax, dword [ebp - 0x6e8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x6e8]
lea ecx, [ebp - 0x63c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x63c]
mov eax, ecx
sub eax, edi
je 0x42b322
dec eax
jne 0x42b42e
mov dword [ebp - 0x610], 0xa
jmp 0x42b43a
call fcn.0044e83a
mov eax, dword [eax + 4]
add eax, 0xb8
cmp eax, edi
je 0x42b41e
mov eax, dword [0x5f61d0]
xor ebx, ebx
cmp eax, edi
jle 0x42b41e
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
js 0x42b6cf
cmp ebx, eax
jge 0x42b6cf
mov eax, dword [0x5f61cc]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x42b408
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42b408
push 0x587f8c
lea ecx, [ebp - 0x630]
call fcn.00404420
mov byte [ebp - 4], 0x59
push 0x58bc68
lea ecx, [ebp - 0x630]
call fcn.00403dd0
mov ecx, dword [ebp - 0x628]
mov eax, dword [ecx + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x630]
call fcn.00409220
push 0x58bc64
lea ecx, [ebp - 0x630]
call fcn.00409c50
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x6e4], 0
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x6dc], eax
lea eax, [ebp - 0x6e4]
push eax
push 0
push 0x4a
lea edx, [ecx + ecx + 2]
push esi
mov dword [ebp - 0x6e0], edx
call edi
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x630]
call fcn.004023c0
mov eax, dword [0x5f61d0]
inc ebx
cmp ebx, eax
jl 0x42b34c
mov esi, dword [ebp - 0x624]
xor edi, edi
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x610], 1
cmp ecx, edi
je 0x42b49a
cmp ecx, 0xbc2
je 0x42b49a
push str.updater
lea ecx, [esi + 4]
call fcn.00406800
test eax, eax
jne 0x42b49a
mov ecx, dword [0x5f60f8]
push ecx
lea ecx, [ebp - 0x678]
call fcn.00404420
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x604]
call fcn.00435f10
mov byte [ebp - 4], 0x5b
push edi
lea ecx, [ebp - 0x604]
call fcn.00439300
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x604]
call fcn.00409400
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x678]
call fcn.004023c0
mov eax, dword [esi]
push str.patch
push eax
call fcn.00543f07
add esp, 8
cmp eax, edi
je 0x42b4dd
push 3
lea edx, [ebp - 0x640]
push edx
mov ecx, esi
call fcn.00406b40
mov byte [ebp - 4], 0x5c
or dword [ebp - 0x614], 2
push 0x58d294
mov ecx, eax
call fcn.00406800
test eax, eax
je 0x42b4dd
xor bl, bl
jmp 0x42b4df
mov bl, 1
mov dword [ebp - 4], 0x56
test byte [ebp - 0x614], 2
je 0x42b501
and dword [ebp - 0x614], 0xfffffffd
lea ecx, [ebp - 0x640]
call fcn.004023c0
test bl, bl
je 0x42b511
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x6e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x650]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b544
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x608]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b56a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp eax, dword [ebp - 0x674]
jl 0x42a380
mov edi, dword [ebp - 0x628]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x42a1ce
push 0x80070057
call fcn.00401090
push 0x80004005
call fcn.00401090
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x658]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b5ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x42
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b5ee
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x668]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b614
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x670]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b63a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x608]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b660
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6c0]
call fcn.0044fea1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x638]
call fcn.0042ec70
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x618]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b6a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x62c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b6ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429f9f
call fcn.00440855
int3