Function at 0x479a6a
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x49a73a
call fcn.00497a30
sub esp, 0x1c0
push ebx
push edi
push str.UserList
push dword [ebp + 0x10]
mov ebx, str.SOFTWARECat_SoftServ_UDomains_
push ebx
lea eax, [ebp - 0x1cc]
push str._s_d_s
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
lea eax, [ebp - 0x1cc]
push eax
mov edi, reloc.WS2_32.dll_bind
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47a228
push 0x4a7b60
lea ecx, [ebp - 0x60]
call fcn.00483141
and dword [ebp - 4], 0
cmp byte [esi + 0xb4], 0
je 0x479af5
mov eax, dword [ebp - 0x60]
push 0x4a7b5c
lea ecx, [ebp - 0x60]
call dword [eax + 8]
mov eax, dword [ebp - 0x60]
add eax, 0x14
mov dword [ebp - 0x18], eax
push 0xa
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0xf0]
call dword [sym.imp.MSVCR71.dll__ultoa]
add esp, 0xc
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x60]
call dword [eax]
cmp byte [ebp + 0xc], 0
jne 0x479b40
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0x10
jb 0x479b33
mov eax, dword [eax + 8]
jmp 0x479b36
add eax, 8
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x44], 0x10
mov ecx, dword [ebp - 0x58]
jae 0x479b4c
lea ecx, [ebp - 0x58]
cmp dword [esi + 0x1c], 0x10
jb 0x479b57
mov eax, dword [esi + 8]
jmp 0x479b5a
lea eax, [esi + 8]
mov edx, dword [ebp - 0x48]
inc edx
push edx
push ecx
push 1
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0xc], 0
jne 0x479bba
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0x10
jb 0x479b8b
mov eax, dword [eax + 8]
jmp 0x479b8e
add eax, 8
push eax
push str.UserSettings
push dword [ebp + 0x10]
lea eax, [ebp - 0x1cc]
push ebx
push str._s_d_s_s
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
lea eax, [ebp - 0x1cc]
push eax
push edi
call fcn.00482993
add esp, 0x20
cmp dword [esi + 0x1c], 0x10
jb 0x479bc5
mov eax, dword [esi + 8]
jmp 0x479bc8
lea eax, [esi + 8]
push eax
push str.UserSettings
push dword [ebp + 0x10]
lea eax, [ebp - 0x1cc]
push ebx
push str._s_d_s_s
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
lea eax, [ebp - 0x1cc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47a21c
push 0x10
pop edi
cmp dword [esi + 0x1c], edi
jb 0x479c1d
mov eax, dword [esi + 8]
jmp 0x479c20
lea eax, [esi + 8]
push str.Anonymous
push eax
call dword [sym.imp.MSVCR71.dll__stricmp]
test eax, eax
pop ecx
pop ecx
je 0x479c3f
cmp dword [esi + 0x40], edi
jb 0x479c3c
mov eax, dword [esi + 0x2c]
jmp 0x479c3f
lea eax, [esi + 0x2c]
push eax
push str.Password
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
cmp dword [esi + 0x88], edi
jb 0x479c5d
mov eax, dword [esi + 0x74]
jmp 0x479c60
lea eax, [esi + 0x74]
push eax
push str.HomeDir
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
cmp dword [esi + 0xa8], 0
je 0x479c8f
lea eax, [esi + 0x94]
cmp dword [eax + 0x18], edi
jb 0x479c8a
mov eax, dword [eax + 4]
jmp 0x479c91
add eax, 4
jmp 0x479c91
xor eax, eax
push eax
push str.LoginMesFile
push dword [ebp - 0x10]
call fcn.00482a5b
mov al, byte [esi + 0xb4]
neg al
sbb eax, eax
and eax, 0x4a4924
push eax
push str.Enable
push dword [ebp - 0x10]
call fcn.00482a5b
mov al, byte [esi + 0xb5]
neg al
mov edi, str.1_la
sbb eax, eax
and eax, edi
push eax
push str.NeedSecure
push dword [ebp - 0x10]
call fcn.00482a5b
mov al, byte [esi + 0xb6]
neg al
sbb eax, eax
and eax, edi
push eax
push str.RelPaths
push dword [ebp - 0x10]
call fcn.00482a5b
mov al, byte [esi + 0xb7]
neg al
sbb eax, eax
and eax, edi
push eax
push str.HideHidden
push dword [ebp - 0x10]
call fcn.00482a5b
mov al, byte [esi + 0xb8]
neg al
sbb eax, eax
and eax, edi
push eax
push str.AlwaysAllowLogin
push dword [ebp - 0x10]
call fcn.00482a5b
mov al, byte [esi + 0xb9]
add esp, 0x48
neg al
sbb eax, eax
and eax, edi
push eax
push str.ChangePassword
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
cmp byte [esi + 0xba], 0
je 0x479d93
push dword [esi + 0xe4]
lea eax, [ebp - 0x104]
push dword [esi + 0xe0]
push dword [esi + 0xec]
push dword [esi + 0xe8]
push str.1_I64d_I64d
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
lea eax, [ebp - 0x104]
push eax
push str.DiskQuota
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x24
mov eax, dword [esi + 0xf0]
test eax, eax
push 0xa
pop ebx
jle 0x479dc0
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.MSVCR71.dll__ultoa]
push eax
push str.Expire
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xf4]
test eax, eax
jle 0x479dea
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.MSVCR71.dll__ultoa]
push eax
push str.PasswordLastChange
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xbc]
test eax, eax
mov edi, dword [sym.imp.MSVCR71.dll__itoa]
jle 0x479e16
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call edi
push eax
push str.MaxUsersLoginPerIP
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xc0]
test eax, eax
jle 0x479e3c
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call edi
push eax
push str.SpeedLimitUp
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xc4]
test eax, eax
jle 0x479e62
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call edi
push eax
push str.SpeedLimitDown
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xcc]
test eax, eax
jle 0x479e88
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call edi
push eax
push str.TimeOut
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xd0]
test eax, eax
jle 0x479eae
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call edi
push eax
push str.SessionTimeOut
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0xc8]
test eax, eax
jl 0x479ed4
push ebx
lea ecx, [ebp - 0x84]
push ecx
push eax
call edi
push eax
push str.MaxNrUsers
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x18
mov eax, dword [esi + 0x104]
test eax, eax
je 0x479f4c
dec eax
je 0x479f06
dec eax
je 0x479eff
dec eax
je 0x479ef8
dec eax
je 0x479ef1
mov eax, str.None
jmp 0x479f0b
mov eax, str.BytesOverall
jmp 0x479f0b
mov eax, str.FilesOverall
jmp 0x479f0b
mov eax, str.BytesPerSession
jmp 0x479f0b
mov eax, str.FilesPerSession
fld dword [esi + 0xdc]
push ecx
push ecx
fstp qword [esp]
push dword [esi + 0xd8]
push dword [esi + 0xd4]
push eax
lea eax, [ebp - 0x104]
push str._s_d_d_f
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
lea eax, [ebp - 0x104]
push eax
push str.Ratios
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0x28
mov eax, dword [esi + 0xfc]
test eax, eax
je 0x479f94
dec eax
je 0x479f7e
dec eax
je 0x479f77
dec eax
je 0x479f70
dec eax
je 0x479f69
mov eax, 0x4a4630
jmp 0x479f83
mov eax, str.ReadOnly
jmp 0x479f83
mov eax, str.Domain
jmp 0x479f83
mov eax, str.Group
jmp 0x479f83
mov eax, str.System
push eax
push str.Maintenance
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
mov eax, dword [esi + 0x100]
test eax, eax
je 0x479fc8
dec eax
je 0x479fb2
dec eax
je 0x479fab
mov eax, str.Regular_password
jmp 0x479fb7
mov eax, str.OTP_S_KEY_MD5
jmp 0x479fb7
mov eax, str.OTP_S_KEY_MD4
push eax
push str.PasswordType
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x479ff0
dec eax
mov eax, str.Delete
jne 0x479fdf
mov eax, str.Disable
push eax
push str.ExpirationType
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
xor ebx, ebx
inc ebx
lea ecx, [esi + 0x118]
mov dword [ebp + 0xc], ebx
call fcn.00402ee5
cmp eax, ebx
mov edi, str._s_d
jb 0x47a067
push 0x24
pop ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0xa0]
push str.IPAccess
push edi
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
mov eax, dword [esi + 0x11c]
lea eax, [eax + ebx - 0x24]
add esp, 0x10
cmp dword [eax + 0x1c], 0x10
jb 0x47a03b
mov eax, dword [eax + 8]
jmp 0x47a03e
add eax, 8
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
inc dword [ebp + 0xc]
lea ecx, [esi + 0x118]
add ebx, 0x24
call fcn.00402ee5
cmp dword [ebp + 0xc], eax
jbe 0x47a00d
xor ebx, ebx
inc ebx
lea ecx, [esi + 0x138]
mov dword [ebp + 0xc], ebx
call fcn.00402ee5
cmp eax, ebx
jb 0x47a115
push 0x24
pop ebx
lea ecx, [ebp - 0x3c]
call fcn.00483124
push dword [ebp + 0xc]
lea eax, [ebp - 0xa0]
push str.Note
push edi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCR71.dll_sprintf]
mov eax, dword [esi + 0x13c]
add esp, 0x10
cmp dword [eax + ebx - 0xc], 0
lea ecx, [ebp - 0x3c]
jne 0x47a0c5
mov eax, dword [ebp - 0x3c]
push 0x4a48ac
call dword [eax + 8]
jmp 0x47a0d0
lea eax, [eax + ebx - 0x24]
push eax
mov eax, dword [ebp - 0x3c]
call dword [eax + 0xc]
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x47a0dc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.004833a3
inc dword [ebp + 0xc]
lea ecx, [esi + 0x138]
add ebx, 0x24
call fcn.00402ee5
cmp dword [ebp + 0xc], eax
jbe 0x47a083
xor ebx, ebx
inc ebx
lea ecx, [esi + 0x108]
mov dword [ebp + 0xc], ebx
call fcn.00402ee5
cmp eax, ebx
jb 0x47a187
push 0x24
pop ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0xa0]
push str.Access
push edi
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
mov eax, dword [esi + 0x10c]
lea eax, [eax + ebx - 0x24]
add esp, 0x10
cmp dword [eax + 0x1c], 0x10
jb 0x47a15b
mov eax, dword [eax + 8]
jmp 0x47a15e
add eax, 8
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
inc dword [ebp + 0xc]
lea ecx, [esi + 0x108]
add ebx, 0x24
call fcn.00402ee5
cmp dword [ebp + 0xc], eax
jbe 0x47a12d
lea ebx, [esi + 0x128]
mov ecx, ebx
call fcn.00402ee5
test eax, eax
je 0x47a213
lea ecx, [ebp - 0x3c]
call fcn.00483124
xor edi, edi
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp + 0xc], edi
call fcn.00402ee5
test eax, eax
jbe 0x47a1ea
test edi, edi
je 0x47a1c6
mov eax, dword [ebp - 0x3c]
push 0x4a4770
lea ecx, [ebp - 0x3c]
call dword [eax + 0x14]
mov eax, dword [esi + 0x12c]
add eax, edi
push eax
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x3c]
call dword [eax + 0x18]
inc dword [ebp + 0xc]
mov ecx, ebx
add edi, 0x24
call fcn.00402ee5
cmp dword [ebp + 0xc], eax
jb 0x47a1b4
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x47a1f6
lea eax, [ebp - 0x34]
push eax
push str.Group
push dword [ebp - 0x10]
call fcn.00482a5b
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.004833a3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004833a3
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc