Function at 0x4b6548
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x4b6551
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4010ac]
call fcn.004071ec
xor eax, eax
push ebp
push 0x4b7306
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b7324
call fcn.004b239c
lea eax, [ebp - 0xa4]
call fcn.004804f4
mov eax, dword [ebp - 0xa4]
call fcn.0040e218
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x7a], 0
xor eax, eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x4b7299
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x80], eax
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x78], 0
je 0x4b6653
mov dl, 1
mov eax, dword [0x48583c]
call fcn.00404068
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x84], eax
mov ecx, eax
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x4b6a0c
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b6a0c
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x80
jne 0x4b69f1
xor eax, eax
push ebp
push 0x4b699e
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b64f4
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x4b66d7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.00488e5c
inc eax
jne 0x4b695f
mov bl, 1
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 1
je 0x4b66ee
xor ebx, ebx
jmp 0x4b66f8
test esi, 2
je 0x4b66f8
mov bl, 2
mov dword [ebp - 0xa0], 1
test esi, 8
je 0x4b6716
mov dword [ebp - 0xa0], 7
jmp 0x4b673a
test esi, 0x10
je 0x4b672a
mov dword [ebp - 0xa0], 3
jmp 0x4b673a
test esi, 0x40
je 0x4b673a
xor eax, eax
mov dword [ebp - 0xa0], eax
test esi, 4
jne 0x4b6855
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b737c
call fcn.00406914
mov eax, dword [ebp - 0xa8]
call fcn.004b239c
cmp dword [ebp - 0x24], 0
je 0x4b6788
lea eax, [ebp - 0xac]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b73b8
call fcn.00406914
mov eax, dword [ebp - 0xac]
call fcn.004b239c
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b67b1
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.004853a0
test al, al
je 0x4b6846
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b565c
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.00487804
test al, al
jne 0x4b6813
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b73f8
call fcn.004b2620
mov byte [ebp - 0x79], 0
jmp 0x4b694c
cmp bl, 1
jne 0x4b694c
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b743c
call fcn.004b2620
jmp 0x4b694c
mov eax, 0x4b7474
call fcn.004b239c
jmp 0x4b694c
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b74bc
call fcn.00406914
mov eax, dword [ebp - 0xb8]
call fcn.004b239c
cmp dword [ebp - 0x24], 0
je 0x4b6897
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b7504
call fcn.00406914
mov eax, dword [ebp - 0xbc]
call fcn.004b239c
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b68b3
mov eax, dword [ebp - 0x28]
call fcn.0047f930
test al, al
je 0x4b6942
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
jne 0x4b68c1
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b565c
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.00487ad0
test al, al
jne 0x4b6916
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7550
call fcn.004b2620
mov byte [ebp - 0x79], 0
jmp 0x4b694c
cmp bl, 1
jne 0x4b694c
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b743c
call fcn.004b2620
jmp 0x4b694c
mov eax, 0x4b7594
call fcn.004b239c
cmp dword [ebp - 0x1c], 0
je 0x4b6994
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.00488d64
jmp 0x4b6994
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0x11
lea edx, [ebp - 0xcc]
mov ecx, 1
mov eax, 0x4b75f0
call fcn.004b2620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b69c7
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b54d8
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b69ff
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b6692
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b6c41
mov byte [ebp - 0x89], 0
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x82
jne 0x4b6bf3
mov byte [ebp - 0x89], 1
xor eax, eax
push ebp
push 0x4b6bca
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b64f4
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x4b6a76
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b6bb9
cmp byte [ebp - 0x29], 0
jne 0x4b6a82
cmp dword [ebp - 0x24], 0
jne 0x4b6a86
xor eax, eax
jmp 0x4b6a88
mov al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x4b6abd
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b5d4c
mov byte [ebp - 0x8b], al
jmp 0x4b6ac4
mov byte [ebp - 0x8b], 0
test bl, bl
je 0x4b6b16
cmp byte [ebp - 0x8b], 0
je 0x4b6bc0
cmp byte [ebp - 0x8a], 0
jne 0x4b6b16
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004853a0
test al, al
je 0x4b6b16
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 2
jne 0x4b6b16
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x4b6bc0
mov byte [ebp - 0x89], 0
cmp byte [ebp - 0x8a], 0
jne 0x4b6b6a
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je 0x4b6b49
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b5e54
pop ecx
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x40
je 0x4b6b6a
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b60e4
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 4
je 0x4b6ba3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0x11
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7648
call fcn.004b2620
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.004887d0
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 0x10
je 0x4b6bc0
mov eax, dword [ebp - 0x18]
call fcn.004b62f8
jmp 0x4b6bc0
mov byte [ebp - 0x89], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6bf3
cmp byte [ebp - 0x89], 0
je 0x4b6c26
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b54d8
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b6c34
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b6a25
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b71c1
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b64f4
pop ecx
xor eax, eax
push ebp
push 0x4b7163
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x88]
movzx esi, word [eax + 0x10]
movzx eax, si
cmp eax, 0x85
jg 0x4b6ce0
je 0x4b6f2d
cmp eax, 0x81
jg 0x4b6cc2
je 0x4b6d53
dec eax
je 0x4b6d11
add eax, 0xfffffff1
sub eax, 2
jb case.0x4b6cee.140
sub eax, 0xe
je case.0x4b6cee.140
sub eax, 0x60
je case.0x4b6cee.140
jmp case.default.0x4b6cee
sub eax, 0x82
je 0x4b6dfc
dec eax
je case.0x4b6cee.140
dec eax
je 0x4b6f1a
jmp case.default.0x4b6cee
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x4b6cee
jmp dword [eax*4 + 0x4b6cf5]
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7684
call fcn.00406914
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd0]
mov al, 0xc2
call fcn.00483130
mov ecx, dword [ebp - 0xd0]
mov dl, 1
mov eax, dword [0x40b010]
call fcn.00411e44
call fcn.00404a74
jmp case.0x4b6cee.140
cmp byte [ebp - 0x29], 0
jne 0x4b6d69
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne case.0x4b6cee.140
mov eax, dword [ebp - 0x88]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0
push 0x4b5558
push 0x4b5564
lea eax, [ebp - 0x48]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.004867d4
test al, al
je case.0x4b6cee.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
je case.0x4b6cee.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je case.0x4b6cee.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x28]
call fcn.0047f520
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x3c]
call fcn.00488db8
jmp case.0x4b6cee.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b6e13
cmp dword [ebp - 0x74], 0
jne 0x4b6e1e
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b6e30
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b6e97
cmp byte [ebp - 0x29], 0
jne 0x4b6e46
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
jne case.0x4b6cee.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b57ec
pop ecx
test al, al
jne case.0x4b6cee.140
mov byte [ebp - 0x79], 0
jmp case.0x4b6cee.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 8
je 0x4b6eb8
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b5d4c
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00406be4
je case.0x4b6cee.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b57ec
pop ecx
test al, al
jne case.0x4b6cee.140
mov byte [ebp - 0x79], 0
jmp case.0x4b6cee.140
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0047fd6c
jmp case.0x4b6cee.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
je 0x4b6f4c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047fc10
test al, al
je case.0x4b6cee.140
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047fdb8
jmp case.0x4b6cee.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5240
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00480b94
test eax, eax
je case.0x4b6cee.140
sub eax, 2
je case.0x4b6cee.140
mov byte [ebp - 0x79], 0
jmp case.0x4b6cee.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5240
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00480ad4
test eax, eax
jne case.0x4b6cee.140
push 2
push 0x506340
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4b700a
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b6cee.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5240
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00480d18
test eax, eax
je case.0x4b6cee.140
sub eax, 2
je case.0x4b6cee.140
sub eax, 0x8f
je case.0x4b6cee.140
mov byte [ebp - 0x79], 0
jmp case.0x4b6cee.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5240
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.00480ad4
test eax, eax
jne case.0x4b6cee.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.00480a14
test al, al
je 0x4b70db
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
je 0x4b70db
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b6cee.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b5d4c
jmp case.0x4b6cee.140
mov byte [ebp - 0x7a], 1
jmp case.0x4b6cee.140
lea eax, [ebp - 0xe0]
push eax
movzx eax, si
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b76b0
call fcn.0040e76c
mov edx, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov al, 0xc2
call fcn.00483130
mov ecx, dword [ebp - 0xdc]
mov dl, 1
mov eax, dword [0x40b010]
call fcn.00411e44
call fcn.00404a74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b718c
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b54d8
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x88], 0
jne 0x4b6c5a
cmp byte [ebp - 0x7a], 0
je 0x4b71d7
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x4b71e5
call fcn.00488a9c
cmp dword [ebp - 0x78], 0
je 0x4b71f5
call dword [ebp - 0x78]
push ebp
call fcn.004b6460
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b72a3
mov eax, dword [ebp - 0x48]
call fcn.00404098
mov eax, dword [ebp - 0x34]
call fcn.00404098
mov eax, dword [ebp - 0x38]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4b7278
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.00488e40
mov eax, dword [ebp - 0xe4]
call fcn.0047f91c
test al, al
je 0x4b7274
push 0
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.00488e40
mov eax, dword [ebp - 0xe8]
call fcn.004064d4
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x4b7228
mov eax, dword [ebp - 0x40]
call fcn.00404098
mov eax, dword [ebp - 0x44]
call fcn.00404098
mov eax, dword [ebp - 0x80]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
call fcn.00404098
ret