Function at 0x4030e0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Get common file path
Resolve function by parsing pe exports
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437c89
mov eax, dword fs:[0]
push eax
sub esp, 0x6f0
mov eax, dword [0x44a728]
xor eax, esp
mov dword [esp + 0x6e8], eax
push ebx
push esi
push edi
mov eax, dword [0x44a728]
xor eax, esp
push eax
lea eax, [esp + 0x700]
mov dword fs:[0], eax
push 0x43f4a0
mov ebx, ecx
call fcn.00402210
add esp, 4
mov ecx, ebx
call fcn.00408ed8
push str.Initialize__OnInitDialog_
call fcn.00402210
add esp, 4
lea esi, [esp + 0x24]
call fcn.004029e0
xor edi, edi
mov dword [esp + 0x708], edi
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebx + 0x84]
mov ecx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push ecx
call esi
mov eax, dword [ebx + 0x84]
mov edx, dword [ebx + 0x20]
push eax
push edi
push 0x80
push edx
call esi
lea ecx, [ebx + 0x88]
push 0x43ed84
call fcn.0041081d
push 0x43ed84
lea ecx, [ebx + 0xdc]
call fcn.0041081d
push 0x43ed84
lea ecx, [ebx + 0x130]
call fcn.0041081d
push 0x43ed84
lea ecx, [ebx + 0x184]
call fcn.0041081d
push 6
push str.ck_WI
lea ecx, [ebx + 0x288]
call fcn.00406910
call fcn.00411f40
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4031f9
push 0x80004005
call fcn.00406390
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
push 0x42
push 0x43f53c
lea ecx, [esp + 0x34]
push str._s_v_d
push ecx
mov byte [esp + 0x718], 1
call fcn.00406c80
mov esi, dword [esp + 0x3c]
add esp, 0x10
push esi
mov ecx, ebx
call fcn.0041081d
push 0x43f568
push 0x3ee
mov ecx, ebx
call fcn.00410745
mov ecx, eax
call fcn.0041081d
push edi
mov ecx, ebx
call fcn.0040ca9b
push str.94C36BFB_3871_4e1d_8AE1_7EA729134726
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, edi
je 0x40329e
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x14]
push edx
push str.Error:__d__OnInitDialog_
call fcn.00402210
add esp, 8
mov edi, ebx
call fcn.00403fb0
push str.CPatchExpClientDlg::OnInitDialog___finished.
call fcn.00402210
add esp, 4
jmp 0x403b50
push str.94C36BFB_3871_4e1d_8AE1_7EA729134726
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, edi
mov dword [esp + 0x34], eax
je 0x403d5d
cmp dword [esp + 0x28], 3
jl 0x403d5d
mov eax, dword [eax + 4]
push eax
lea ecx, [esp + 0x24]
call fcn.00406bc0
mov byte [esp + 0x708], 2
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00405bf0
lea edx, [esp + 0x20]
lea ecx, [ebx + 0x280]
push edx
mov byte [esp + 0x70c], 3
call fcn.00406890
mov eax, 1
cmp dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
jle 0x403456
jmp 0x403330
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx*4]
test edx, edx
jne 0x403343
xor eax, eax
jmp 0x40335f
mov eax, edx
lea esi, [eax + 2]
jmp 0x403350
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403350
sub eax, esi
sar eax, 1
push eax
lea edi, [ebx + 0x80]
push edx
mov ecx, edi
call fcn.00405fb0
mov eax, dword [edi]
mov edx, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
lea esi, [edx + 1]
sub eax, esi
or eax, ecx
mov dword [esp + 0x10], edx
jge 0x403397
push esi
mov ecx, edi
call fcn.004064a0
mov edx, dword [esp + 0x10]
test esi, esi
mov eax, dword [edi]
mov word [eax + edx*2], 0x20
jl 0x403494
mov edi, dword [edi]
cmp esi, dword [edi - 8]
jg 0x403494
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov dword [edi - 0xc], esi
mov edx, dword [ebx + 0x80]
mov word [edx + esi*2], 0
mov ecx, dword [eax + ecx*4]
test ecx, ecx
lea edi, [ebx + 0x7c]
jne 0x4033d7
xor eax, eax
jmp 0x4033ef
mov eax, ecx
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4033e0
sub eax, esi
sar eax, 1
push eax
push ecx
mov ecx, edi
call fcn.00405fb0
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov dword [esp + 0x10], esi
add esi, 1
sub eax, esi
or eax, ecx
jge 0x40341d
push esi
mov ecx, edi
call fcn.004064a0
test esi, esi
mov eax, dword [edi]
mov edx, dword [esp + 0x10]
mov word [eax + edx*2], 0x20
jl 0x403494
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x403494
mov dword [eax - 0xc], esi
mov eax, dword [edi]
mov word [eax + esi*2], 0
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
jl 0x403330
xor edi, edi
mov edx, dword [ebx + 0x80]
mov eax, dword [edx - 0xc]
cmp eax, edi
lea ecx, [ebx + 0x80]
jle 0x403472
add eax, 0xffffffff
push ecx
call fcn.004058f0
mov eax, dword [ebx + 0x7c]
mov eax, dword [eax - 0xc]
cmp eax, edi
lea esi, [ebx + 0x7c]
jle 0x403488
add eax, 0xffffffff
push esi
call fcn.004058f0
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
jge 0x40349e
or eax, 0xffffffff
jmp 0x4034b9
push 0x80070057
call fcn.00406390
push str._debug
push eax
call fcn.0042266d
add esp, 8
cmp eax, edi
jne 0x4034b5
or eax, 0xffffffff
jmp 0x4034b9
sub eax, dword [esi]
sar eax, 1
xor ecx, ecx
cmp eax, edi
setge cl
push 0x104
lea edx, [esp + 0xbc]
push edi
push edx
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov esi, ecx
mov dword [esp + 0xc0], edi
call fcn.004233a0
add esp, 0xc
push 0x104
lea eax, [esp + 0x1c0]
push edi
push eax
call fcn.004233a0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x2c4]
push edi
push ecx
call fcn.004233a0
add esp, 0xc
push 0x104
lea edx, [esp + 0x3c8]
push edi
push edx
call fcn.004233a0
add esp, 0xc
push 0x103
lea eax, [esp + 0x5f1]
push edi
push eax
mov dword [esp + 0x4d4], edi
mov dword [esp + 0x4d8], edi
mov dword [esp + 0x4dc], edi
mov byte [esp + 0x5f8], 0
call fcn.004233a0
add esp, 0xc
lea ecx, [esp + 0x5ec]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x5f0]
call fcn.00405b40
cmp esi, edi
mov eax, 4
mov byte [esp + 0x708], al
mov ecx, dword [ebx + 0x20]
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 0x7e8
mov dword [esp + 0xb4], 0x7e9
mov dword [esp + 0x4c8], eax
je 0x4035c8
mov dword [esp + 0x4c8], 7
mov edx, dword [esp + 0x1c]
mov esi, 1
mov dword [esp + 0x4d0], esi
mov dword [esp + 0x4cc], esi
mov ecx, dword [edx - 8]
mov eax, esi
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4035f9
push edi
lea ecx, [esp + 0x20]
call fcn.00405f60
mov edx, dword [esp + 0x1c]
push edx
lea edx, [esp + 0x1c0]
push 0x104
push edx
call fcn.00422559
mov edx, dword [esp + 0x24]
mov ecx, dword [edx - 8]
mov eax, esi
sub eax, dword [edx - 4]
add esp, 0xc
or ecx, eax
jge 0x40362d
push edi
lea ecx, [esp + 0x1c]
call fcn.00405f60
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0xbc]
push 0x104
push eax
call fcn.00422559
add esp, 0xc
push 0x43f644
lea ecx, [esp + 0x2c4]
push 0x104
push ecx
call fcn.00422559
add esp, 0xc
push str.DOWNLOAD
lea edx, [esp + 0x3c8]
push 0x104
push edx
call fcn.00422559
add esp, 0xc
lea eax, [esp + 0xb8]
push str.version_
push eax
mov dword [ebx + 0x368], edi
call fcn.004225c0
mov esi, eax
add esp, 8
cmp esi, edi
je 0x4036bf
push esi
call fcn.00422657
add esp, 4
test eax, eax
jg 0x4036ac
add esi, 1
jne 0x403698
jmp 0x4036bf
cmp esi, edi
je 0x4036bf
push esi
call fcn.00422657
add esp, 4
mov dword [ebx + 0x368], eax
lea eax, [ebx + 0x2e4]
push eax
lea ecx, [esp + 0x4d8]
push ecx
sub esp, 0x428
mov edi, esp
mov ecx, 0x10a
lea esi, [esp + 0x4dc]
rep movsd dword es:[edi], dword [esi]
call sub.PatchExpLib.dll__PLV5_Init_1072
mov edx, dword [ebx + 0x368]
push edx
push str.PLV5_Init__OnInitDialog_._VersionAreaNumber___d
mov dword [esp + 0x1c], eax
call fcn.00402210
mov eax, dword [ebx + 0x7c]
add esp, 8
cmp dword [eax - 0xc], 0
jl 0x4037c8
push 0x43f6cc
push eax
call fcn.0042266d
add esp, 8
test eax, eax
je 0x4037c8
sub eax, dword [ebx + 0x7c]
lea edi, [ebx + 0x7c]
sar eax, 1
js 0x4037c8
mov ecx, dword [edi]
cmp eax, dword [ecx - 0xc]
jg 0x4037c8
lea eax, [ecx + eax*2]
push 0x43f6d4
push eax
call fcn.0042266d
add esp, 8
test eax, eax
je 0x4037c8
sub eax, dword [edi]
sar eax, 1
test eax, eax
jl 0x4037c8
lea esi, [eax + 1]
test esi, esi
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
jl 0x4037c8
cmp esi, ecx
jg 0x4037c8
lea ecx, [eax + esi*2]
push 0x43f6d4
push ecx
call fcn.0042266d
add esp, 8
test eax, eax
je 0x4037c8
sub eax, dword [edi]
sar eax, 1
test eax, eax
jl 0x4037c8
sub eax, esi
push eax
push esi
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.004059b0
mov eax, dword [eax]
push eax
call fcn.0042265c
mov dword [ebx + 0x2e4], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4037c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x4e0]
mov dword [ebx + 0x2fc], ecx
xor eax, eax
mov ecx, 7
mov dword [esp + 0x8c], vtable.CIniManagerW.0
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xa4], eax
mov word [esp + 0x94], ax
mov byte [esp + 0x708], 5
push 0xb
push 0x43f6d8
lea esi, [esp + 0x40]
mov dword [esp + 0x18], 1
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], eax
mov word [esp + 0x44], ax
call fcn.004017b0
lea edx, [esp + 0x10]
push edx
mov edi, esi
lea ecx, [esp + 0x90]
mov byte [esp + 0x70c], 6
call fcn.004012e0
mov byte [esp + 0x708], 5
cmp dword [esp + 0x50], 8
jb 0x403861
mov eax, dword [esp + 0x3c]
push eax
call fcn.00406d00
add esp, 4
push 3
xor edi, edi
push 0x43f6f0
lea esi, [esp + 0x40]
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], edi
mov word [esp + 0x44], di
call fcn.004017b0
mov byte [esp + 0x708], 7
push 6
push str.SERVER
lea esi, [esp + 0x5c]
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], edi
mov word [esp + 0x60], di
call fcn.004017b0
lea ecx, [esp + 0x38]
push ecx
mov edx, esi
push edx
lea edx, [esp + 0x78]
lea ecx, [esp + 0x94]
mov byte [esp + 0x710], 8
call fcn.004011d0
mov byte [esp + 0x708], 9
cmp dword [eax + 0x18], 8
jb 0x4038e0
mov eax, dword [eax + 4]
jmp 0x4038e3
add eax, 4
push eax
lea ecx, [esp + 0x34]
call fcn.00405bf0
mov esi, 8
cmp dword [esp + 0x88], esi
jb 0x403908
mov eax, dword [esp + 0x74]
push eax
call fcn.00406d00
add esp, 4
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], edi
mov word [esp + 0x74], di
cmp dword [esp + 0x6c], esi
jb 0x403932
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00406d00
add esp, 4
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], edi
mov word [esp + 0x58], di
mov byte [esp + 0x708], 0xd
cmp dword [esp + 0x50], esi
jb 0x40395e
mov edx, dword [esp + 0x3c]
push edx
call fcn.00406d00
add esp, 4
mov eax, dword [esp + 0x30]
push eax
lea ecx, [ebx + 0x318]
push 0x50
push ecx
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], edi
mov word [esp + 0x48], di
call fcn.00422559
mov esi, dword [esp + 0x20]
add esp, 0xc
cmp esi, edi
je 0x403996
cmp esi, 7
jne 0x403bad
cmp dword [esp + 0x4dc], 0x42
jbe 0x403bad
push str.SelfUpdate__OnInitDialog_
call fcn.00402210
add esp, 4
mov dword [ebx + 0x2f4], 9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Tencentdl.exe
mov dword [ebx + 0x370], eax
mov dword [ebx + 0x374], 1
call fcn.00406bc0
call fcn.004023d0
mov esi, eax
add esp, 4
cmp esi, 3
ja case.default.0x4039f1
jmp dword [esi*4 + 0x403df8]
push 0x15
lea ecx, [ebx + 0x2e0]
push str.TENCENTDL_was_stopped
call fcn.00406910
jmp 0x403a64
push 0x18
lea ecx, [ebx + 0x2e0]
push str.failed_to_stop_TENCENTDL
call fcn.00406910
jmp 0x403a64
push 0x13
lea ecx, [ebx + 0x2e0]
push str.not_found_TENCENTDL
call fcn.00406910
jmp 0x403a64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebx + 0x2e0]
push str.system_error_:_error___d_
push edx
call fcn.00406c80
add esp, 0xc
push esi
push str.Kill_TENCENTDL_Result___d_
add ebx, 0x2e0
push ebx
call fcn.00406c80
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call sub.PatchExpLib.dll__PLV5_StartSelfUpdate_0
mov byte [esp + 0x708], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403a99
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xa8], 8
mov dword [esp + 0x8c], vtable.CIniManagerW.0
jb 0x403abe
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00406d00
add esp, 4
mov byte [esp + 0x708], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], edi
mov word [esp + 0x94], di
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403b00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x708], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x708], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x708], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b78
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x708], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403ba3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x403dd2
mov byte [esp + 0x708], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403bd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xa8], 8
mov dword [esp + 0x8c], vtable.CIniManagerW.0
jb 0x403bfa
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00406d00
add esp, 4
mov byte [esp + 0x708], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], edi
mov word [esp + 0x94], di
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403c3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x708], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x708], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, edi
jne 0x403d16
push 3
lea esi, [ebx + 0x78]
push 0x43fe34
mov ecx, esi
call fcn.00406910
mov esi, dword [esi]
push esi
lea ecx, [ebx + 0x88]
call fcn.0041081d
mov ecx, dword [ebx + 0x1f8]
push edi
push edi
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov ecx, ebx
call fcn.0040ca9b
mov edx, dword [ebx + 0x20]
push edi
push 0x1f4
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x304], 9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.CPatchExpClientDlg::OnInitDialog___finished.
mov dword [ebx + 0x37c], eax
mov dword [ebx + 0x380], 1
call fcn.00402210
add esp, 4
jmp 0x403b50
cmp esi, 7
jne 0x403273
push str.CPatchExpClientDlg::OnInitDialog___No_need_to_patch
call fcn.00402210
add esp, 4
push ebx
call fcn.00404f00
test eax, eax
jne 0x403d42
mov edx, 9
mov edi, ebx
call fcn.00403fb0
push 1
mov ecx, ebx
call fcn.00408b8d
push str.CPatchExpClientDlg::OnInitDialog___finished.
call fcn.00402210
add esp, 4
jmp 0x403b50
push str.Wrong_parameters____OnInitDialog_
call fcn.00402210
add esp, 4
push edi
push edi
push str.Wrong_parameters__
mov ecx, ebx
call fcn.0040c053
push 2
mov ecx, ebx
call fcn.00408b8d
lea eax, [esi - 0x10]
mov byte [esp + 0x708], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403da5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x708], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403dd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x700]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6e8]
xor ecx, esp
call fcn.004217b9
mov esp, ebp
pop ebp
ret