Function at 0x4b6d74
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x4b6d7d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4010ac]
call fcn.004071ec
xor eax, eax
push ebp
push 0x4b7b32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b7b50
call fcn.004b2bc8
lea eax, [ebp - 0xa4]
call fcn.0047f740
mov eax, dword [ebp - 0xa4]
call fcn.0040dd04
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x7a], 0
xor eax, eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x4b7ac5
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x80], eax
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x78], 0
je 0x4b6e7f
mov dl, 1
mov eax, dword [0x4ada74]
call fcn.00404068
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x84], eax
mov ecx, eax
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x4b7238
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b7238
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x80
jne 0x4b721d
xor eax, eax
push ebp
push 0x4b71ca
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b6d20
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x4b6f03
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.004b1094
inc eax
jne 0x4b718b
mov bl, 1
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 1
je 0x4b6f1a
xor ebx, ebx
jmp 0x4b6f24
test esi, 2
je 0x4b6f24
mov bl, 2
mov dword [ebp - 0xa0], 1
test esi, 8
je 0x4b6f42
mov dword [ebp - 0xa0], 7
jmp 0x4b6f66
test esi, 0x10
je 0x4b6f56
mov dword [ebp - 0xa0], 3
jmp 0x4b6f66
test esi, 0x40
je 0x4b6f66
xor eax, eax
mov dword [ebp - 0xa0], eax
test esi, 4
jne 0x4b7081
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7ba8
call fcn.00406914
mov eax, dword [ebp - 0xa8]
call fcn.004b2bc8
cmp dword [ebp - 0x24], 0
je 0x4b6fb4
lea eax, [ebp - 0xac]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b7be4
call fcn.00406914
mov eax, dword [ebp - 0xac]
call fcn.004b2bc8
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b6fdd
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ad5d8
test al, al
je 0x4b7072
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b5e88
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.004afa3c
test al, al
jne 0x4b703f
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7c24
call fcn.004b2e4c
mov byte [ebp - 0x79], 0
jmp 0x4b7178
cmp bl, 1
jne 0x4b7178
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7c68
call fcn.004b2e4c
jmp 0x4b7178
mov eax, 0x4b7ca0
call fcn.004b2bc8
jmp 0x4b7178
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7ce8
call fcn.00406914
mov eax, dword [ebp - 0xb8]
call fcn.004b2bc8
cmp dword [ebp - 0x24], 0
je 0x4b70c3
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b7d30
call fcn.00406914
mov eax, dword [ebp - 0xbc]
call fcn.004b2bc8
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b70df
mov eax, dword [ebp - 0x28]
call fcn.0047eb7c
test al, al
je 0x4b716e
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
jne 0x4b70ed
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b5e88
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.004afd08
test al, al
jne 0x4b7142
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7d7c
call fcn.004b2e4c
mov byte [ebp - 0x79], 0
jmp 0x4b7178
cmp bl, 1
jne 0x4b7178
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7c68
call fcn.004b2e4c
jmp 0x4b7178
mov eax, 0x4b7dc0
call fcn.004b2bc8
cmp dword [ebp - 0x1c], 0
je 0x4b71c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.004b0f9c
jmp 0x4b71c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0x11
lea edx, [ebp - 0xcc]
mov ecx, 1
mov eax, 0x4b7e1c
call fcn.004b2e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b71f3
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b5d04
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b722b
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b6ebe
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b746d
mov byte [ebp - 0x89], 0
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x82
jne 0x4b741f
mov byte [ebp - 0x89], 1
xor eax, eax
push ebp
push 0x4b73f6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b6d20
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x4b72a2
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b73e5
cmp byte [ebp - 0x29], 0
jne 0x4b72ae
cmp dword [ebp - 0x24], 0
jne 0x4b72b2
xor eax, eax
jmp 0x4b72b4
mov al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x4b72e9
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b6578
mov byte [ebp - 0x8b], al
jmp 0x4b72f0
mov byte [ebp - 0x8b], 0
test bl, bl
je 0x4b7342
cmp byte [ebp - 0x8b], 0
je 0x4b73ec
cmp byte [ebp - 0x8a], 0
jne 0x4b7342
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ad5d8
test al, al
je 0x4b7342
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 2
jne 0x4b7342
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x4b73ec
mov byte [ebp - 0x89], 0
cmp byte [ebp - 0x8a], 0
jne 0x4b7396
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je 0x4b7375
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b6680
pop ecx
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x40
je 0x4b7396
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b6910
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 4
je 0x4b73cf
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0x11
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7e74
call fcn.004b2e4c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.004b0a08
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 0x10
je 0x4b73ec
mov eax, dword [ebp - 0x18]
call fcn.004b6b24
jmp 0x4b73ec
mov byte [ebp - 0x89], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b741f
cmp byte [ebp - 0x89], 0
je 0x4b7452
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b5d04
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b7460
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b7251
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b79ed
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b6d20
pop ecx
xor eax, eax
push ebp
push 0x4b798f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x88]
movzx esi, word [eax + 0x10]
movzx eax, si
cmp eax, 0x85
jg 0x4b750c
je 0x4b7759
cmp eax, 0x81
jg 0x4b74ee
je 0x4b757f
dec eax
je 0x4b753d
add eax, 0xfffffff1
sub eax, 2
jb case.0x4b751a.140
sub eax, 0xe
je case.0x4b751a.140
sub eax, 0x60
je case.0x4b751a.140
jmp case.default.0x4b751a
sub eax, 0x82
je 0x4b7628
dec eax
je case.0x4b751a.140
dec eax
je 0x4b7746
jmp case.default.0x4b751a
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x4b751a
jmp dword [eax*4 + 0x4b7521]
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7eb0
call fcn.00406914
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd0]
mov al, 0xc2
call fcn.004abb3c
mov ecx, dword [ebp - 0xd0]
mov dl, 1
mov eax, dword [0x40aafc]
call fcn.00411930
call fcn.00404a74
jmp case.0x4b751a.140
cmp byte [ebp - 0x29], 0
jne 0x4b7595
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne case.0x4b751a.140
mov eax, dword [ebp - 0x88]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0
push 0x4b5d84
push 0x4b5d90
lea eax, [ebp - 0x48]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.004aea0c
test al, al
je case.0x4b751a.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
je case.0x4b751a.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je case.0x4b751a.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x28]
call fcn.0047e76c
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x3c]
call fcn.004b0ff0
jmp case.0x4b751a.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b763f
cmp dword [ebp - 0x74], 0
jne 0x4b764a
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b765c
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b76c3
cmp byte [ebp - 0x29], 0
jne 0x4b7672
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
jne case.0x4b751a.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b6018
pop ecx
test al, al
jne case.0x4b751a.140
mov byte [ebp - 0x79], 0
jmp case.0x4b751a.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 8
je 0x4b76e4
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b6578
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00406be4
je case.0x4b751a.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b6018
pop ecx
test al, al
jne case.0x4b751a.140
mov byte [ebp - 0x79], 0
jmp case.0x4b751a.140
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0047efb8
jmp case.0x4b751a.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
je 0x4b7778
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047ee5c
test al, al
je case.0x4b751a.140
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047f004
jmp case.0x4b751a.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5a6c
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fde0
test eax, eax
je case.0x4b751a.140
sub eax, 2
je case.0x4b751a.140
mov byte [ebp - 0x79], 0
jmp case.0x4b751a.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5a6c
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fd20
test eax, eax
jne case.0x4b751a.140
push 2
push 0x5043a4
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4b7836
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b751a.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5a6c
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047ff64
test eax, eax
je case.0x4b751a.140
sub eax, 2
je case.0x4b751a.140
sub eax, 0x8f
je case.0x4b751a.140
mov byte [ebp - 0x79], 0
jmp case.0x4b751a.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5a6c
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fd20
test eax, eax
jne case.0x4b751a.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0047fc60
test al, al
je 0x4b7907
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
je 0x4b7907
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b751a.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b6578
jmp case.0x4b751a.140
mov byte [ebp - 0x7a], 1
jmp case.0x4b751a.140
lea eax, [ebp - 0xe0]
push eax
movzx eax, si
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7edc
call fcn.0040e258
mov edx, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov al, 0xc2
call fcn.004abb3c
mov ecx, dword [ebp - 0xdc]
mov dl, 1
mov eax, dword [0x40aafc]
call fcn.00411930
call fcn.00404a74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b79b8
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b5d04
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x88], 0
jne 0x4b7486
cmp byte [ebp - 0x7a], 0
je 0x4b7a03
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x4b7a11
call fcn.004b0cd4
cmp dword [ebp - 0x78], 0
je 0x4b7a21
call dword [ebp - 0x78]
push ebp
call fcn.004b6c8c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7acf
mov eax, dword [ebp - 0x48]
call fcn.00404098
mov eax, dword [ebp - 0x34]
call fcn.00404098
mov eax, dword [ebp - 0x38]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4b7aa4
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.004b1078
mov eax, dword [ebp - 0xe4]
call fcn.0047eb68
test al, al
je 0x4b7aa0
push 0
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.004b1078
mov eax, dword [ebp - 0xe8]
call fcn.004064d4
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x4b7a54
mov eax, dword [ebp - 0x40]
call fcn.00404098
mov eax, dword [ebp - 0x44]
call fcn.00404098
mov eax, dword [ebp - 0x80]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
call fcn.00404098
ret