Function at 0x40695a
Capabilities:
Check os version

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x14
test eax, eax
jge 0x406976
mov ecx, dword [0x46ada8]
lea eax, [eax*4 + 0x20004]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x472dfa]
push ebp
lea ebp, [ecx + eax*2]
mov ecx, dword [ebp + 0x24]
sbb al, 0xb8
inc eax
and eax, 0xc83b0046
push esi
mov esi, eax
jb 0x4069a5
mov edx, ecx
sub edx, eax
sar edx, 1
cmp edx, 0x4008
jae 0x4069a5
and dword [esp + 0x22], 0
mov esi, ecx
movzx ecx, word [ebp]
test cx, cx
je 0x407bce
push ebx
push edi
mov edx, esi
sub edx, eax
add esp, edx
inc byte [ecx + 0x4008fa]
add byte [edi], cl
lodsd eax, dword [esi]
adc eax, 0x6e000002
add cl, byte [edi]
mov bh, 0xc9
pop edi
mov edx, 0x2000e000
add ebp, edi
test dx, bx
je 0x406ba8
cmp dx, cx
jbe 0x406bab
movzx eax, word [ebp]
mov ebx, eax
and ebx, 0xff
mov edi, eax
shr eax, 8
mov edx, ebx
or edx, 0x8000
and edi, 0x10007fff
mov dword [esp + 0x20], eax
or eax, 0x8000
inc ebp
inc ebp
cmp cx, 0xe002
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
or eax, dword [ebp + 0x11f]
push 2
pop edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x406a4f
cmp ax, 0x5a04
jbe 0x406a4f
cmp dword [esp + 0x20], 0x23
je 0x406a4f
cmp dword [esp + 0x20], 0x2e
jo 0x406a4f
and dword [esi + 0x24], 0x2c
add bl, ch
or bh, al
inc esp
and al, 0x2c
add byte [eax], al
add byte [eax], al
mov dword [esp + 0x2c], 0
cmp dword [0x472e84], 0
hlt
cmp cx, dx
jne 0x406bb6
mov cx, word [ebp]
mov word [esi], cx
add esi, edi
add ebp, ebp
jmp 0x406bbf
movzx ecx, word [ebp]
test cx, cx
jne 0x2069b4
pop edi
pop ebx
and word [esi], 0
cmp dword [esp + 0x20], 0
pop esi
pop ebp
je 0x406be5
push eax
push dword [esp + 0x1c]
call fcn.00406167
add esp, 0x14
ret 0x448
mov edx, dword [ebp + 0x74]
mov eax, dword [ebp - 0x10]
cmp eax, 0x1c
ja case.default.0x4073e2
jmp dword [eax*4 + 0x407d8c]
cmp dword [ebp + 0xc], 0
je 0x407d72
mov eax, dword [ebp + 8]
dec dword [ebp + 0xc]
mov al, byte [eax]
inc dword [ebp + 8]
cmp al, 0xe1
ja case.default.0x4073e2
movzx eax, al
cdq
push 0x2d
pop ecx
idiv ecx
push 9
pop ecx
mov esi, eax
movzx eax, dl
cdq
idiv ecx
mov ecx, esi
movzx edi, dl
xor edx, edx
inc edx
shl edx, cl
mov ecx, eax
mov dword [ebp + 0x3c], edi
dec edx
mov dword [ebp + 0x5c], edx
xor edx, edx
inc edx
shl edx, cl
lea ecx, [edi + esi]
mov esi, 0x300
shl esi, cl
dec edx
mov dword [ebp + 0x60], edx
add esi, 0x736
lea edi, [esi + esi]
cmp edi, dword [ebp]
je 0x407474
cmp dword [ebp + 0x74], 0
je 0x40745d
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp + 0x74], eax
je case.default.0x4073e2
mov dword [ebp], edi
test esi, esi
je 0x407484
mov eax, dword [ebp + 0x74]
dec esi
mov word [eax + esi*2], 0x400
jne 0x407478
and dword [ebp + 0x30], 0
and dword [ebp + 0x38], 0
jmp 0x4074b2
cmp dword [ebp + 0xc], 0
je 0x407d02
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x30]
movzx eax, byte [eax]
dec dword [ebp + 0xc]
shl ecx, 3
shl eax, cl
or dword [ebp + 0x38], eax
inc dword [ebp + 8]
inc dword [ebp + 0x30]
cmp dword [ebp + 0x30], 4
jl case.0x4073e2.1
mov eax, dword [ebp + 0x38]
cmp eax, dword [ebp + 4]
je 0x4074e8
cmp dword [ebp + 0x70], 0
mov dword [ebp + 4], eax
je 0x4074d2
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 0x38]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp + 0x70], eax
je case.default.0x4073e2
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 4]
mov byte [eax + ecx - 1], 0
mov dword [ebp + 0x30], 5
jmp 0x40751d
cmp dword [ebp + 0xc], 0
je 0x407d0b
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x30]
dec dword [ebp + 0x30]
test eax, eax
jne case.0x4073e2.3
mov edx, dword [ebp + 0x74]
mov eax, dword [ebp + 0x18]
and eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x40]
shl ecx, 4
add ecx, eax
mov dword [ebp + 0x2c], eax
lea esi, [edx + ecx*2]
mov dword [ebp - 0xc], 6
jmp 0x407b7d
xor eax, eax
cmp dword [ebp + 0x38], eax
jne 0x4075be
movzx esi, byte [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
and edi, dword [ebp + 0x60]
push 8
pop ecx
sub cl, byte [ebp + 0x3c]
shr esi, cl
mov ecx, dword [ebp + 0x3c]
shl edi, cl
add esi, edi
imul esi, esi, 0x600
cmp dword [ebp + 0x40], 4
lea ecx, [esi + edx + 0xe6c]
mov dword [ebp + 0x20], ecx
jge 0x407585
mov dword [ebp + 0x40], eax
jmp 0x407595
cmp dword [ebp + 0x40], 0xa
jge 0x407591
sub dword [ebp + 0x40], 3
jmp 0x407595
sub dword [ebp + 0x40], 6
cmp dword [ebp + 0x44], eax
je 0x4075b6
mov eax, dword [ebp + 0x64]
sub eax, dword [ebp + 0x4c]
cmp eax, dword [ebp + 4]
jb 0x4075a8
add eax, dword [ebp + 4]
mov ecx, dword [ebp + 0x70]
mov al, byte [eax + ecx]
xor ebx, ebx
mov byte [ebp + 0x1d], al
inc ebx
jmp 0x407618
xor ebx, ebx
inc ebx
jmp 0x407787
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0x44], 1
lea esi, [edx + eax*2 + 0x180]
mov dword [ebp - 0xc], 7
jmp 0x407b7d
cmp dword [ebp + 0xc], 0
je 0x407d14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x38]
cmp dword [ebp + 0x30], eax
jne 0x4076ba
cmp ebx, 0x100
jge 0x40771f
movzx eax, byte [ebp + 0x1d]
shl byte [ebp + 0x1d], 1
mov ecx, dword [ebp + 0x20]
shr eax, 7
mov dword [ebp + 0x30], eax
inc eax
shl eax, 8
add eax, ebx
lea esi, [ecx + eax*2]
movzx eax, word [esi]
mov ecx, dword [ebp + 0x68]
movzx edx, ax
shr ecx, 0xb
imul ecx, edx
cmp dword [ebp + 0x6c], ecx
mov dword [ebp + 0x24], esi
jae 0x407662
and dword [ebp + 0x38], 0
mov dword [ebp + 0x68], ecx
mov ecx, 0x800
sub ecx, edx
sar ecx, 5
add ecx, eax
mov word [esi], cx
add ebx, ebx
jmp 0x407680
sub dword [ebp + 0x68], ecx
sub dword [ebp + 0x6c], ecx
mov cx, ax
shr cx, 5
sub ax, cx
mov dword [ebp + 0x38], 1
mov word [esi], ax
lea ebx, [ebx + ebx + 1]
cmp dword [ebp + 0x68], 0x1000000
mov dword [ebp + 0x34], ebx
jae 0x407600
jmp case.0x4073e2.13
cmp dword [ebp + 0xc], 0
je 0x407d1d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
cmp ebx, 0x100
jge 0x40771f
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x68]
lea edx, [ebx + ebx]
lea esi, [edx + eax]
movzx eax, word [esi]
movzx edi, ax
shr ecx, 0xb
imul ecx, edi
cmp dword [ebp + 0x6c], ecx
mov dword [ebp + 0x24], esi
jae 0x4076f8
mov dword [ebp + 0x68], ecx
mov ecx, 0x800
sub ecx, edi
sar ecx, 5
add ecx, eax
mov word [esi], cx
add ebx, ebx
jmp 0x40770e
sub dword [ebp + 0x68], ecx
sub dword [ebp + 0x6c], ecx
mov cx, ax
shr cx, 5
sub ax, cx
mov word [esi], ax
lea ebx, [edx + 1]
cmp dword [ebp + 0x68], 0x1000000
mov dword [ebp + 0x34], ebx
jae 0x4076ba
jmp case.0x4073e2.14
and dword [ebp + 0x44], 0
mov al, byte [ebp + 0x34]
mov byte [ebp + 0x1c], al
cmp dword [ebp + 0x14], 0
je 0x407d2f
mov al, byte [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x70]
inc dword [ebp + 0x18]
inc dword [ebp + 0x10]
dec dword [ebp + 0x14]
mov byte [ecx], al
mov ecx, dword [ebp + 0x64]
mov byte [ecx + edx], al
lea eax, [ecx + 1]
xor edx, edx
div dword [ebp + 4]
jmp 0x4078d7
cmp dword [ebp + 0xc], 0
je 0x407d26
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
cmp ebx, 0x100
jge 0x407723
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x68]
lea edx, [ebx + ebx]
lea esi, [edx + eax]
movzx eax, word [esi]
movzx edi, ax
shr ecx, 0xb
imul ecx, edi
cmp dword [ebp + 0x6c], ecx
mov dword [ebp + 0x24], esi
jae 0x4077bd
mov dword [ebp + 0x68], ecx
mov ecx, 0x800
sub ecx, edi
sar ecx, 5
add ecx, eax
mov word [esi], cx
add ebx, ebx
jmp 0x4077d3
sub dword [ebp + 0x68], ecx
sub dword [ebp + 0x6c], ecx
mov cx, ax
shr cx, 5
sub ax, cx
mov word [esi], ax
lea ebx, [edx + 1]
cmp dword [ebp + 0x68], 0x1000000
mov dword [ebp + 0x34], ebx
jae 0x40777f
jmp case.0x4073e2.15
cmp dword [ebp + 0x38], 1
jne 0x407800
mov eax, dword [ebp + 0x40]
lea esi, [edx + eax*2 + 0x198]
mov dword [ebp - 0xc], 8
jmp 0x407b7d
mov eax, dword [ebp + 0x54]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x50], eax
xor eax, eax
cmp dword [ebp + 0x40], 7
mov dword [ebp - 8], 0x16
setge al
dec eax
and eax, 0xfffffffd
add eax, 0xa
mov dword [ebp + 0x40], eax
lea eax, [edx + 0x664]
mov dword [ebp + 0x20], eax
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0xc], 0x12
jmp 0x407b7d
cmp dword [ebp + 0x38], 0
mov eax, dword [ebp + 0x40]
jne 0x407865
add eax, 0xf
shl eax, 4
add eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], 9
lea esi, [edx + eax*2]
jmp 0x407b7d
lea esi, [edx + eax*2 + 0x1b0]
mov dword [ebp - 0xc], 0xa
jmp 0x407b7d
cmp dword [ebp + 0x38], 0
jne 0x40792a
cmp dword [ebp + 0x18], 0
je case.default.0x4073e2
xor eax, eax
cmp dword [ebp + 0x40], 7
setge al
lea eax, [eax + eax + 9]
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x14], 0
je 0x407d38
mov eax, dword [ebp + 0x64]
sub eax, dword [ebp + 0x4c]
cmp eax, dword [ebp + 4]
jb 0x4078b4
add eax, dword [ebp + 4]
mov edx, dword [ebp + 0x70]
mov cl, byte [eax + edx]
mov eax, dword [ebp + 0x64]
mov byte [eax + edx], cl
inc eax
xor edx, edx
div dword [ebp + 4]
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
inc dword [ebp + 0x10]
dec dword [ebp + 0x14]
mov byte [ebp + 0x1c], cl
mov byte [eax], cl
mov dword [ebp + 0x64], edx
mov dword [ebp - 0x10], 2
jmp 0x4073d3
cmp dword [ebp + 0x38], 0
jne 0x4078f1
mov eax, dword [ebp + 0x50]
jmp 0x407921
mov eax, dword [ebp + 0x40]
lea esi, [edx + eax*2 + 0x1c8]
mov dword [ebp - 0xc], 0xb
jmp 0x407b7d
cmp dword [ebp + 0x38], 0
jne 0x407912
mov eax, dword [ebp + 0x54]
jmp 0x40791b
mov ecx, dword [ebp + 0x54]
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x58], ecx
mov ecx, dword [ebp + 0x50]
mov dword [ebp + 0x54], ecx
mov ecx, dword [ebp + 0x4c]
mov dword [ebp + 0x50], ecx
mov dword [ebp + 0x4c], eax
lea eax, [edx + 0xa68]
mov dword [ebp + 0x20], eax
mov dword [ebp - 8], 0x15
jmp case.0x4073e2.17
xor eax, eax
cmp dword [ebp + 0x40], 7
setge al
dec eax
and eax, 0xfffffffd
add eax, 0xb
mov dword [ebp + 0x40], eax
jmp 0x407aed
mov eax, dword [ebp + 0x48]
cmp eax, 4
jl 0x407962
push 3
pop eax
shl eax, 7
lea eax, [eax + edx + 0x360]
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x38], 6
mov dword [ebp - 4], 0x19
jmp case.0x4073e2.23
cmp ebx, 4
jl 0x4079bc
mov ecx, ebx
mov eax, ebx
and eax, 1
sar ecx, 1
dec ecx
or eax, 2
shl eax, cl
cmp ebx, 0xe
mov dword [ebp + 0x4c], eax
jge 0x4079b2
sub eax, ebx
lea eax, [edx + eax*2 + 0x55e]
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x38], ecx
jmp 0x407a34
xor ebx, ebx
add ecx, 0xfffffffc
mov dword [ebp + 0x30], ecx
jmp 0x4079ef
mov dword [ebp + 0x4c], ebx
jmp 0x407aea
mov eax, dword [ebp + 0x4c]
cmp dword [ebp + 0xc], 0
je 0x407d41
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x6c]
movzx edi, byte [edi]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl ecx, 8
or ecx, edi
inc dword [ebp + 8]
mov dword [ebp + 0x6c], ecx
dec dword [ebp + 0x30]
cmp dword [ebp + 0x30], 0
jle 0x407a1c
mov ecx, dword [ebp + 0x6c]
shr dword [ebp + 0x68], 1
add ebx, ebx
cmp ecx, dword [ebp + 0x68]
mov dword [ebp + 0x34], ebx
jb 0x407a11
sub ecx, dword [ebp + 0x68]
or ebx, 1
mov dword [ebp + 0x6c], ecx
mov dword [ebp + 0x34], ebx
cmp dword [ebp + 0x68], 0x1000000
jae 0x4079ec
jmp 0x4079c7
shl ebx, 4
add eax, ebx
add edx, 0x644
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x38], 4
xor ebx, ebx
mov dword [ebp + 0x28], 1
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x30], ebx
jmp 0x407a6d
cmp dword [ebp + 0xc], 0
je 0x407d4a
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
inc dword [ebp + 0x30]
mov eax, dword [ebp + 0x38]
cmp dword [ebp + 0x30], eax
jge 0x407ae7
mov edi, dword [ebp + 0x28]
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x68]
add edi, edi
lea esi, [edi + eax]
movzx eax, word [esi]
movzx ecx, ax
shr edx, 0xb
imul edx, ecx
cmp dword [ebp + 0x6c], edx
mov dword [ebp + 0x24], esi
jae 0x407aae
mov dword [ebp + 0x68], edx
mov edx, 0x800
sub edx, ecx
sar edx, 5
add edx, eax
shl dword [ebp + 0x28], 1
mov word [esi], dx
jmp 0x407ad9
sub dword [ebp + 0x68], edx
sub dword [ebp + 0x6c], edx
xor ecx, ecx
inc ecx
mov ebx, ecx
mov ecx, dword [ebp + 0x30]
shl ebx, cl
mov ecx, ebx
mov ebx, dword [ebp + 0x34]
or ebx, ecx
mov cx, ax
shr cx, 5
sub ax, cx
inc edi
mov dword [ebp + 0x34], ebx
mov word [esi], ax
mov dword [ebp + 0x28], edi
cmp dword [ebp + 0x68], 0x1000000
jae 0x407a6a
jmp case.0x4073e2.16
add dword [ebp + 0x4c], ebx
inc dword [ebp + 0x4c]
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x407d53
cmp eax, dword [ebp + 0x18]
ja case.default.0x4073e2
add dword [ebp + 0x48], 2
mov eax, dword [ebp + 0x48]
add dword [ebp + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x407d59
mov eax, dword [ebp + 0x64]
sub eax, dword [ebp + 0x4c]
cmp eax, dword [ebp + 4]
jb 0x407b23
add eax, dword [ebp + 4]
mov edx, dword [ebp + 0x70]
mov cl, byte [eax + edx]
mov eax, dword [ebp + 0x64]
mov byte [eax + edx], cl
inc eax
xor edx, edx
div dword [ebp + 4]
mov eax, dword [ebp + 0x10]
inc dword [ebp + 0x10]
dec dword [ebp + 0x14]
dec dword [ebp + 0x48]
cmp dword [ebp + 0x48], 0
mov byte [ebp + 0x1c], cl
mov byte [eax], cl
mov dword [ebp + 0x64], edx
jg case.0x4073e2.28
jmp 0x4078da
cmp dword [ebp + 0x38], 0
jne 0x407b70
mov eax, dword [ebp + 0x2c]
and dword [ebp + 0x48], 0
mov ecx, dword [ebp + 0x20]
shl eax, 4
lea eax, [ecx + eax + 4]
jmp 0x407c19
mov esi, dword [ebp + 0x20]
add esi, 2
mov dword [ebp - 0xc], 0x13
mov dword [ebp + 0x24], esi
movzx eax, word [esi]
mov ecx, dword [ebp + 0x68]
movzx edi, ax
shr ecx, 0xb
imul ecx, edi
cmp dword [ebp + 0x6c], ecx
jae 0x407bac
mov dword [ebp + 0x68], ecx
mov ecx, 0x800
sub ecx, edi
sar ecx, 5
add ecx, eax
and dword [ebp + 0x38], 0
mov word [esi], cx
jmp 0x407bc6
sub dword [ebp + 0x68], ecx
sub dword [ebp + 0x6c], ecx
mov cx, ax
shr cx, 5
sub ax, cx
mov word [esi], ax
mov dword [ebp + 0x38], 1
cmp dword [ebp + 0x68], 0x1000000
jae 0x407bf4
and eax, 0xc7d83
cmp dword [ebp + 0xc], 0
je 0x407d62
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp - 0xc]
jmp 0x407cfa
cmp dword [ebp + 0x38], 0
jne 0x407c25
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x20]
shl eax, 4
mov dword [ebp + 0x48], 8
lea eax, [ecx + eax + 0x104]
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x38], 3
jmp 0x407c3a
add dword [ebp + 0x20], 0x204
mov dword [ebp + 0x48], 0x10
mov dword [ebp + 0x38], 8
mov dword [ebp - 4], 0x14
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x28], 1
mov dword [ebp + 0x30], eax
jmp 0x407c7b
cmp dword [ebp + 0xc], 0
je 0x407d6b
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x6c]
movzx ecx, byte [ecx]
shl dword [ebp + 0x68], 8
dec dword [ebp + 0xc]
shl eax, 8
or eax, ecx
inc dword [ebp + 8]
mov dword [ebp + 0x6c], eax
dec dword [ebp + 0x30]
mov edx, dword [ebp + 0x74]
cmp dword [ebp + 0x30], 0
jle 0x407cdf
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x68]
add edx, edx
lea esi, [edx + eax]
movzx eax, word [esi]
movzx edi, ax
shr ecx, 0xb
imul ecx, edi
cmp dword [ebp + 0x6c], ecx
mov dword [ebp + 0x24], esi
jae 0x407cba
mov dword [ebp + 0x68], ecx
mov ecx, 0x800
sub ecx, edi
sar ecx, 5
add ecx, eax
shl dword [ebp + 0x28], 1
mov word [esi], cx
jmp 0x407cd1
sub dword [ebp + 0x68], ecx
sub dword [ebp + 0x6c], ecx
mov cx, ax
shr cx, 5
sub ax, cx
inc edx
mov word [esi], ax
mov dword [ebp + 0x28], edx
cmp dword [ebp + 0x68], 0x1000000
jae 0x407c75
jmp case.0x4073e2.24
mov ecx, dword [ebp + 0x38]
mov ebx, dword [ebp + 0x28]
xor eax, eax
inc eax
shl eax, cl
sub ebx, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 0x34], ebx
jmp 0x407cfa
add dword [ebp + 0x48], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x4073d6
mov dword [ebp - 0x10], 1
jmp 0x407d72
mov dword [ebp - 0x10], 3
jmp 0x407d72
mov dword [ebp - 0x10], 0xd
jmp 0x407d72
mov dword [ebp - 0x10], 0xe
jmp 0x407d72
mov dword [ebp - 0x10], 0xf
jmp 0x407d72
mov dword [ebp - 0x10], 0x1a
jmp 0x407d72
mov dword [ebp - 0x10], 0x1b
jmp 0x407d72
mov dword [ebp - 0x10], 0xc
jmp 0x407d72
mov dword [ebp - 0x10], 0x10
jmp 0x407d72
or dword [ebp + 0x48], 0xffffffff
jmp 0x407d72
mov dword [ebp - 0x10], 0x1c
jmp 0x407d72
mov dword [ebp - 0x10], 5
jmp 0x407d72
mov dword [ebp - 0x10], 0x18
mov edi, dword [ebp - 0x18]
push 0x22
pop ecx
lea esi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x407d84
or eax, 0xffffffff
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret