Function at 0x4b9eac
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x4b9eb5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
mov ecx, 0xa
lea eax, [ebp - 0x48]
mov edx, dword [0x401094]
call fcn.004059c8
xor eax, eax
push ebp
push 0x4bac68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4bac84
call fcn.004b6478
lea eax, [ebp - 0xa4]
call fcn.00470284
mov eax, dword [ebp - 0xa4]
call fcn.0040a80c
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x7a], 0
xor eax, eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4babfb
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0x80], eax
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x78], 0
je 0x4b9fb7
mov dl, 1
mov eax, dword [0x4b23e0]
call fcn.00404010
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x84], eax
mov ecx, eax
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 1], 0
je 0x4ba370
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4ba370
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x80
jne 0x4ba355
xor eax, eax
push ebp
push 0x4ba302
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b9e58
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x4ba03b
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x80]
call fcn.004b508c
inc eax
jne 0x4ba2c3
mov bl, 1
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 1
je 0x4ba052
xor ebx, ebx
jmp 0x4ba05c
test esi, 2
je 0x4ba05c
mov bl, 2
mov dword [ebp - 0xa0], 1
test esi, 8
je 0x4ba07a
mov dword [ebp - 0xa0], 7
jmp 0x4ba09e
test esi, 0x10
je 0x4ba08e
mov dword [ebp - 0xa0], 3
jmp 0x4ba09e
test esi, 0x40
je 0x4ba09e
xor eax, eax
mov dword [ebp - 0xa0], eax
test esi, 4
jne 0x4ba1b9
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x48]
mov edx, 0x4bacb4
call fcn.00405188
mov eax, dword [ebp - 0xa8]
call fcn.004b6478
cmp dword [ebp - 0x44], 0
je 0x4ba0ec
lea eax, [ebp - 0xac]
mov ecx, dword [ebp - 0x44]
mov edx, 0x4bacd4
call fcn.00405188
mov eax, dword [ebp - 0xac]
call fcn.004b6478
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4ba115
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x48]
call fcn.004b1f44
test al, al
je 0x4ba1aa
mov eax, dword [ebp - 0x40]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b9294
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
call fcn.004b3f44
test al, al
jne 0x4ba177
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4bacf8
call fcn.004b66a4
mov byte [ebp - 0x79], 0
jmp 0x4ba2b0
cmp bl, 1
jne 0x4ba2b0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4bad1c
call fcn.004b66a4
jmp 0x4ba2b0
mov eax, 0x4bad3c
call fcn.004b6478
jmp 0x4ba2b0
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x48]
mov edx, 0x4bad64
call fcn.00405188
mov eax, dword [ebp - 0xb8]
call fcn.004b6478
cmp dword [ebp - 0x44], 0
je 0x4ba1fb
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x44]
mov edx, 0x4bad8c
call fcn.00405188
mov eax, dword [ebp - 0xbc]
call fcn.004b6478
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4ba217
mov eax, dword [ebp - 0x48]
call fcn.0046f6cc
test al, al
je 0x4ba2a6
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
jne 0x4ba225
xor ebx, ebx
mov eax, dword [ebp - 0x40]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b9294
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
call fcn.004b41d0
test al, al
jne 0x4ba27a
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4badb4
call fcn.004b66a4
mov byte [ebp - 0x79], 0
jmp 0x4ba2b0
cmp bl, 1
jne 0x4ba2b0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4bad1c
call fcn.004b66a4
jmp 0x4ba2b0
mov eax, 0x4badd8
call fcn.004b6478
cmp dword [ebp - 0x3c], 0
je 0x4ba2f8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x80]
call fcn.004b4f94
jmp 0x4ba2f8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0xb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0xb
lea edx, [ebp - 0xcc]
mov ecx, 1
mov eax, 0x4bae08
call fcn.004b66a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ba32b
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 8]
call fcn.004b915c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4ba363
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b9ff6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4ba5a5
mov byte [ebp - 0x89], 0
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x82
jne 0x4ba557
mov byte [ebp - 0x89], 1
xor eax, eax
push ebp
push 0x4ba52e
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b9e58
pop ecx
cmp byte [ebp - 1], 0
jne 0x4ba3da
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4ba51d
cmp byte [ebp - 1], 0
jne 0x4ba3e6
cmp dword [ebp - 0x44], 0
jne 0x4ba3ea
xor eax, eax
jmp 0x4ba3ec
mov al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x4ba421
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x48]
call fcn.004b9870
mov byte [ebp - 0x8b], al
jmp 0x4ba428
mov byte [ebp - 0x8b], 0
test bl, bl
je 0x4ba47a
cmp byte [ebp - 0x8b], 0
je 0x4ba524
cmp byte [ebp - 0x8a], 0
jne 0x4ba47a
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.004b1f44
test al, al
je 0x4ba47a
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 2
jne 0x4ba47a
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x4ba524
mov byte [ebp - 0x89], 0
cmp byte [ebp - 0x8a], 0
jne 0x4ba4ce
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je 0x4ba4ad
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.004b992c
pop ecx
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x40
je 0x4ba4ce
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.004b9b10
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 4
je 0x4ba507
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0xb
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4bae38
call fcn.004b66a4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
call fcn.004b4ce8
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 0x10
je 0x4ba524
mov eax, dword [ebp - 0x38]
call fcn.004b9c98
jmp 0x4ba524
mov byte [ebp - 0x89], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ba557
cmp byte [ebp - 0x89], 0
je 0x4ba58a
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 8]
call fcn.004b915c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4ba598
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4ba389
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4bab23
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b9e58
pop ecx
xor eax, eax
push ebp
push 0x4baac5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x88]
movzx esi, word [eax + 0x10]
movzx eax, si
cmp eax, 0x85
jg 0x4ba644
je 0x4ba88f
cmp eax, 0x81
jg 0x4ba626
je 0x4ba6b7
dec eax
je 0x4ba675
add eax, 0xfffffff1
sub eax, 2
jb case.0x4ba652.140
sub eax, 0xe
je case.0x4ba652.140
sub eax, 0x60
je case.0x4ba652.140
jmp case.default.0x4ba652
sub eax, 0x82
je 0x4ba75e
dec eax
je case.0x4ba652.140
dec eax
je 0x4ba87c
jmp case.default.0x4ba652
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x4ba652
jmp dword [eax*4 + 0x4ba659]
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x48]
mov edx, 0x4bae58
call fcn.00405188
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd0]
mov al, 0xb6
call fcn.004b10a8
mov ecx, dword [ebp - 0xd0]
mov dl, 1
mov eax, dword [0x4087b8]
call fcn.0040dac4
call fcn.0040489c
jmp case.0x4ba652.140
cmp byte [ebp - 1], 0
jne 0x4ba6cd
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne case.0x4ba652.140
mov eax, dword [ebp - 0x88]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0x4b91d8
push 0x4b91e4
lea eax, [ebp - 0x20]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x48]
call fcn.004b3100
test al, al
je case.0x4ba652.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
je case.0x4ba652.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je case.0x4ba652.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 1
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x48]
call fcn.0046f26c
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x14]
call fcn.004b4fe8
jmp case.0x4ba652.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x44]
call fcn.00404f08
cmp byte [ebp - 1], 0
jne 0x4ba775
cmp dword [ebp - 0x74], 0
jne 0x4ba780
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x48]
call fcn.00404f08
cmp byte [ebp - 1], 0
jne 0x4ba792
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4ba7f9
cmp byte [ebp - 1], 0
jne 0x4ba7a8
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
jne case.0x4ba652.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b9458
pop ecx
test al, al
jne case.0x4ba652.140
mov byte [ebp - 0x79], 0
jmp case.0x4ba652.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 8
je 0x4ba81a
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.004b9870
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x48]
call fcn.00405298
je case.0x4ba652.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b9458
pop ecx
test al, al
jne case.0x4ba652.140
mov byte [ebp - 0x79], 0
jmp case.0x4ba652.140
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0046faf0
jmp case.0x4ba652.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
je 0x4ba8ae
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0046f998
test al, al
je case.0x4ba652.140
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0046fb3c
jmp case.0x4ba652.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b8e78
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00470814
test eax, eax
je case.0x4ba652.140
sub eax, 2
je case.0x4ba652.140
mov byte [ebp - 0x79], 0
jmp case.0x4ba652.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b8e78
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00470770
test eax, eax
jne case.0x4ba652.140
push 1
push 0x4ff680
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4ba96c
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4ba652.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b8e78
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00470980
test eax, eax
je case.0x4ba652.140
sub eax, 2
je case.0x4ba652.140
sub eax, 0x8f
je case.0x4ba652.140
mov byte [ebp - 0x79], 0
jmp case.0x4ba652.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b8e78
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00470770
test eax, eax
jne case.0x4ba652.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.004706b4
test al, al
je 0x4baa3d
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x4baa3d
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4ba652.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x48]
call fcn.004b9870
jmp case.0x4ba652.140
mov byte [ebp - 0x7a], 1
jmp case.0x4ba652.140
lea eax, [ebp - 0xe0]
push eax
movzx eax, si
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4bae70
call fcn.0040af98
mov edx, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov al, 0xb6
call fcn.004b10a8
mov ecx, dword [ebp - 0xdc]
mov dl, 1
mov eax, dword [0x4087b8]
call fcn.0040dac4
call fcn.0040489c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4baaee
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 8]
call fcn.004b915c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x88], 0
jne 0x4ba5be
cmp byte [ebp - 0x7a], 0
je 0x4bab39
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 8]
test byte [eax + 0x1d], 0x10
je 0x4bab47
call fcn.004b4ecc
cmp dword [ebp - 0x78], 0
je 0x4bab57
call dword [ebp - 0x78]
push ebp
call fcn.004b9dc8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bac05
mov eax, dword [ebp - 0x20]
call fcn.00404040
mov eax, dword [ebp - 0xc]
call fcn.00404040
mov eax, dword [ebp - 0x10]
call fcn.00404040
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4babda
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004b5070
mov eax, dword [ebp - 0xe4]
call fcn.0046f6b8
test al, al
je 0x4babd6
push 0
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004b5070
mov eax, dword [ebp - 0xe8]
call fcn.00405300
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x4bab8a
mov eax, dword [ebp - 0x18]
call fcn.00404040
mov eax, dword [ebp - 0x1c]
call fcn.00404040
mov eax, dword [ebp - 0x80]
call fcn.00404040
mov eax, dword [ebp - 0x14]
call fcn.00404040
ret