Function at 0x409b7f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
cmp ax, word [0x5d94d0]
jne 0x409ba9
call fcn.0040a542
mov esi, eax
jmp 0x409bae
mov esi, 0x5d94d0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
push esi
push str.__s_____1_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00532a01
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
mov ecx, str.http_shell
call fcn.0040a41c
lea eax, [ebp - 0x20c]
push eax
mov ecx, str.https_shell
call fcn.0040a41c
lea eax, [ebp - 0x20c]
push eax
mov ecx, str.ftp_shell
call fcn.0040a41c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00537010
mov ecx, str.htmlfile
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x409c36
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ecx
push 1
mov ebx, 0x577458
push ebx
push str..htm
mov edi, 0x80000000
push edi
call esi
mov ecx, str.htmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409c73
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..html
push edi
call esi
mov ecx, str.htmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409ca4
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..shtm
push edi
call esi
mov ecx, str.htmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409cd5
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..shtml
push edi
call esi
mov ecx, str.mhtmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409d06
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..mht
push edi
call esi
mov ecx, str.mhtmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409d37
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..mhtm
push edi
call esi
mov ecx, str.mhtmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409d68
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..mhtml
push edi
call esi
mov ecx, str.xhtmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409d99
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..xht
push edi
call esi
mov ecx, str.xhtmlfile
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x210], edx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x409dca
sub eax, dword [ebp - 0x210]
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push ebx
push str..xhtml
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret