Function at 0x46e970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ebdf9
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x70], 0
mov word [ebp - 0x80], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], eax
mov word [ebp - 0x68], ax
push 0x3e
mov byte [ebp - 4], 1
push eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x4e]
push eax
call fcn.005bb1c0
mov ebx, dword [esi + 4]
add esp, 0xc
test ebx, ebx
je 0x46f76f
mov ebx, dword [ebx + 8]
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x46eaf9
mov eax, dword [edi + 4]
test eax, eax
je 0x46eaf9
push eax
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.WELCOMETITLE
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 6
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
add esi, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46ea53
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
jb 0x46ea8b
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
push 6
push 0x63f464
lea ecx, [ebp - 0x80]
call fcn.00406400
push dword [edi + 4]
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x98]
call fcn.00406dd0
add esp, 4
lea ecx, [ebp - 0x80]
push eax
call fcn.00405dd0
cmp dword [ebp - 0x84], 8
jb 0x46eace
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
push str.TASKBARTITLE
lea ecx, [ebp - 0x98]
call fcn.00405d00
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.00409f70
jmp 0x46ebf9
push str.Canon_Inkjet_Software_Installer
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.WELCOMETITLE
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
add esi, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46eb50
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
jb 0x46eb88
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
push str.Canon_Inkjet_Software_Installer
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.TASKBARTITLE
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 4
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46ebdc
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], 8
jb 0x46ec14
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x46ec4b
mov eax, dword [eax + 4]
test eax, eax
je 0x46ec4b
push eax
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.PRODUCTNAME
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xb
call fcn.00405d00
mov byte [ebp - 4], 0xc
jmp 0x46ec73
push str.Canon_Inkjet_Printer
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.PRODUCTNAME
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 9
call fcn.00405d00
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46ec9f
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
mov byte [ebp - 4], 1
xor eax, eax
cmp dword [ebp - 0x84], 8
mov word [ebp - 0xb0], ax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], 7
jb 0x46ecd3
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
mov edi, dword [ebx + 0x84]
test edi, edi
je 0x46f76f
mov eax, dword [edi + 4]
test eax, eax
je 0x46f76f
push eax
lea ecx, [ebp - 0x98]
call fcn.00405d00
push 0x6240dc
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0xd
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46ed3c
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
jb 0x46ed74
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
mov edx, dword [edi + 4]
cmp word [edx], 0
jne 0x46ed81
xor ecx, ecx
jmp 0x46eda3
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xb8], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46ed90
sub ecx, dword [ebp - 0xb8]
sar ecx, 1
push ecx
push edx
mov ecx, 0x74e360
call fcn.00406400
push dword [edi + 4]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0
call fcn.0040ba80
sub esp, 8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0xf
call fcn.00474e40
mov eax, dword [ebp - 0xb4]
cmp dword [eax - 4], 1
jle 0x46edf9
push dword [eax - 0xc]
lea ecx, [ebp - 0xb4]
call fcn.004078e0
mov eax, dword [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.DEVICEIDURL
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x10
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x11
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46ee49
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
jb 0x46ee7d
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xb4]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46eea1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xffffffffffffffff
push dword [edi + 4]
lea eax, [ebp - 0x50]
push 0x20
push eax
call fcn.005b9367
lea eax, [ebp - 0x50]
push str._series
push eax
call fcn.005b960d
add esp, 0x18
test eax, eax
je 0x46ef4e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.2KDRVID
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x12
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.MFPID
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x14
call fcn.00405d00
mov byte [ebp - 4], 0x15
jmp 0x46efcb
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.2KDRVID
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x16
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x17
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.MFPID
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x18
call fcn.00405d00
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x46f063
mov eax, dword [eax + 4]
test eax, eax
je 0x46f063
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.PrinterName
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x1c
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1d
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
jmp 0x46f0ef
push 0x624ff8
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.PrinterName
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1a
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1b
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46f0b7
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
jb 0x46f0ef
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
mov eax, dword [ebx + 0x90]
test eax, eax
je 0x46f158
mov eax, dword [eax + 4]
test eax, eax
je 0x46f158
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.FaxName
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x20
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x21
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
jmp 0x46f1e4
push 0x624ff8
lea ecx, [ebp - 0x98]
call fcn.00405d00
push str.FaxName
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1e
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1f
call fcn.00409f70
cmp dword [ebp - 0x9c], 8
jb 0x46f1ac
push dword [ebp - 0xb0]
call fcn.0049500b
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], 0
mov word [ebp - 0xb0], ax
jb 0x46f1e4
push dword [ebp - 0x98]
call fcn.0049500b
add esp, 4
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x46f76f
mov eax, dword [eax + 4]
test eax, eax
je 0x46f76f
mov edx, 0x63f518
mov ecx, eax
mov di, word [ecx]
cmp di, word [edx]
jne 0x46f22a
test di, di
je 0x46f226
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x46f22a
add ecx, 4
add edx, 4
test di, di
jne 0x46f204
xor ecx, ecx
jmp 0x46f22f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x46f326
push str.PRODUCTFLAG
lea ecx, [ebp - 0x98]
call fcn.00405d00
push 0
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x22
call fcn.0040a350
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x63f518
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.PRODUCTTYPE
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x23
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x24
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x6240dc
lea ecx, [ebp - 0x98]
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x25
call fcn.00409910
push eax
lea ecx, [ebp - 0x68]
call fcn.00405dd0
lea ecx, [ebp - 0xb0]
call fcn.00405e10
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push str.NAME
lea ecx, [ebp - 0x98]
call fcn.00405d00
mov byte [ebp - 4], 0x26
jmp 0x46f6ba
mov edx, 0x63f544
mov ecx, eax
lea ecx, [ecx]
mov di, word [ecx]
cmp di, word [edx]
jne 0x46f356
test di, di
je 0x46f352
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x46f356
add ecx, 4
add edx, 4
test di, di
jne 0x46f330
xor ecx, ecx
jmp 0x46f35b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x46f4fd
push str.PRODUCTFLAG
lea ecx, [ebp - 0x98]
call fcn.00405d00
push 2
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x27
call fcn.0040a350
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x63f544
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.PRODUCTTYPE
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x28
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x6240dc
lea ecx, [ebp - 0x98]
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2a
call fcn.00409910
push eax
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x2b
call fcn.004752a0
add esp, 4
lea ecx, [ebp - 0x68]
push eax
call fcn.00405dd0
lea ecx, [ebp - 0xb0]
call fcn.00405e10
lea ecx, [ebp - 0xd0]
call fcn.00405e10
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push str.NAME
lea ecx, [ebp - 0x98]
call fcn.00405d00
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2c
call fcn.00409f70
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push str.WELCOMETITLE
lea ecx, [ebp - 0xb0]
call fcn.00405d00
mov byte [ebp - 4], 0x2d
push str.MFPID
lea ecx, [ebp - 0x98]
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2e
call fcn.00409910
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2f
call fcn.00409f70
lea ecx, [ebp - 0xd0]
call fcn.00405e10
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
jmp 0x46f6d2
mov ecx, 0x63f554
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46f528
test dx, dx
je 0x46f524
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46f528
add eax, 4
add ecx, 4
test dx, dx
jne 0x46f502
xor eax, eax
jmp 0x46f52d
sbb eax, eax
or eax, 1
push str.PRODUCTFLAG
lea ecx, [ebp - 0x98]
test eax, eax
jne 0x46f5b7
call fcn.00405d00
push 3
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x30
call fcn.0040a350
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x63f554
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.PRODUCTTYPE
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x31
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x32
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
jmp 0x46f6d2
call fcn.00405d00
push 1
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x33
call fcn.0040a350
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x63f54c
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.PRODUCTTYPE
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x34
call fcn.00405d00
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x35
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 1
call fcn.00405e10
push 0x6240dc
lea ecx, [ebp - 0x98]
call fcn.00405d00
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x36
call fcn.00409910
push str._Printer
mov edx, eax
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x37
call fcn.00406b90
add esp, 4
lea ecx, [ebp - 0x68]
push eax
call fcn.00405dd0
lea ecx, [ebp - 0xd0]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
call fcn.00405e10
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
push str.NAME
lea ecx, [ebp - 0x98]
call fcn.00405d00
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.00409f70
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00405e10
mov eax, dword [ebx + 0xa0]
cmp eax, 1
je 0x46f715
cmp eax, 4
je 0x46f715
push 0x6266cc
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.LANFLAG
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x3b
call fcn.00405d00
mov byte [ebp - 4], 0x3c
jmp 0x46f73d
push 0x6240a4
lea ecx, [ebp - 0xb0]
call fcn.00405d00
push str.LANFLAG
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x39
call fcn.00405d00
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.00409f70
lea ecx, [ebp - 0x98]
call fcn.00405e10
lea ecx, [ebp - 0xb0]
call fcn.00405e10
mov esi, 1
jmp 0x46f771
xor esi, esi
cmp dword [ebp - 0x54], 8
jb 0x46f782
push dword [ebp - 0x68]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x6c], 8
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
jb 0x46f7a7
push dword [ebp - 0x80]
call fcn.0049500b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret