Function at 0x42b540
Capabilities:
Delete registry key
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2a4
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push esi
push edi
call sym.ProcessHacker.exe_PhGetApplicationDirectory
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x42ba8f
push str.KphServiceName
call sym.ProcessHacker.exe_PhGetStringSetting
mov ebx, eax
test ebx, ebx
je 0x42b5a5
cmp dword [ebx], 0
jne 0x42b5a5
mov ecx, ebx
or eax, 0xffffffff
xor ebx, ebx
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x42b5a5
jmp 0x42b5a0
call fcn.004c1f60
mov esi, dword [edi]
push dword [0x5cd4f8]
add esi, 0x24
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [eax + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov word [ecx + esi], dx
push dword [edi]
push dword [edi + 4]
push dword [eax + 4]
call fcn.00537fe0
mov edi, dword [esp + 0x1c]
mov ecx, 9
mov eax, dword [esp + 0x2c]
mov esi, 0x5889e4
add esp, 0xc
mov edi, dword [edi + 4]
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
push dword [0x5cd4f8]
add esi, 0x22
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [esp + 0x24], edi
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
mov esi, dword [esp + 0x20]
push dword [esi]
push dword [esi + 4]
push dword [edi + 4]
call fcn.00537fe0
mov edi, dword [edi + 4]
mov ecx, 8
add edi, dword [esi]
add esp, 0xc
mov esi, str.processhacker.sig
rep movsd dword es:[edi], dword [esi]
push str.KphBuildNumber
movsw word es:[edi], word [esi]
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x42b77e
jmp 0x42b660
cmp eax, dword [0x5cd56c]
je 0x42b78e
test ebx, ebx
je 0x42b675
mov esi, dword [ebx + 4]
jmp 0x42b67a
mov esi, str.KProcessHacker3
test esi, esi
mov dword [esp + 0x18], 0
mov edx, str.KProcessHacker3
mov dword [esp + 0x58], 1
cmovne edx, esi
mov dword [esp + 0x68], 0x44
mov ecx, edx
mov dword [esp + 0x6c], str.SystemCurrentControlSetServices_
mov dword [esp + 0x70], 1
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42b6b1
sub ecx, edi
mov dword [esp + 0x84], edx
sar ecx, 1
mov dword [esp + 0x88], 1
mov dword [esp + 0x98], 0x16
mov dword [esp + 0x9c], str.Parameters
lea eax, [ecx + ecx]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x14]
push eax
push 0x208
lea eax, [esp + 0xa8]
push eax
push 3
lea eax, [esp + 0x68]
push eax
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x42b78e
lea eax, [esp + 0xa0]
mov ecx, esi
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffffe
mov dword [esp + 0x48], eax
call fcn.004dcfa0
push 0
lea eax, [esp + 0x4c]
push eax
push 0xfffffffffffffffd
push 0x10000
lea eax, [esp + 0x28]
push eax
call sym.ProcessHacker.exe_PhOpenKey
mov esi, eax
test esi, esi
js 0x42b760
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42b77a
push eax
call dword [sym.imp.ntdll.dll_NtDeleteKey]
mov esi, eax
xor eax, eax
cmp esi, 0xc0000034
cmove esi, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42b77a
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x42b78e
push dword [0x5cd56c]
push str.KphBuildNumber
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x58]
mov ecx, dword [esi + 4]
call fcn.004dae40
mov edi, edi
test eax, eax
jns 0x42b7fd
cmp eax, 0xc0000043
je 0x42b7fd
cmp eax, 0xc0000022
je 0x42b7fd
push str.EnableKphWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
lea esp, [esp]
test eax, eax
je 0x42ba35
test dword [0x5d03a0], 0x100
jne 0x42ba35
push str.You_will_be_unable_to_use_more_advanced_features__view_details_about_system_processes_or_terminate_malicious_software.
push 0x5634d8
push str.The_kernel_driver_was_not_found.
push 0xfffe
push 0x20
push 0
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
jmp 0x42ba35
mov dword [esp + 0x48], 3
mov byte [esp + 0x4c], 1
test ebx, ebx
je 0x42b813
mov ecx, dword [ebx + 4]
jmp 0x42b818
mov ecx, str.KProcessHacker3
lea eax, [esp + 0x48]
push eax
push dword [esi + 4]
call fcn.004dc940
mov esi, eax
test esi, esi
js 0x42b9f2
push 0
push 0
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, eax
test edi, edi
js 0x42b9cf
push 0
push 0
push 0x60
push 1
push 1
push 0x80
lea eax, [esp + 0x40]
mov dword [esp + 0x70], 0x18
mov dword [esp + 0x78], eax
lea eax, [esp + 0x58]
push 0
push eax
lea eax, [esp + 0x78]
mov dword [esp + 0x7c], 0
push eax
push 0x120089
lea eax, [esp + 0x3c]
mov dword [esp + 0x8c], 0x40
push eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov edi, eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test edi, edi
js 0x42b9cf
mov esi, dword ds:[esp + 0x14]
push 0x400
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0
push 0
push 0x400
push eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x60]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtReadFile]
push esi
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x42b9b9
mov eax, dword [esp + 0x54]
push 0
push 0
lfence
mov esi, dword [esp + 0x20]
push 0xc
mov dword [esp + 0x44], eax
lea eax, [esp + 0x3c]
push eax
push 0x99992007
lea eax, [esp + 0x2c]
mov dword [esp + 0x44], 0x4dd440
push eax
push 0
push 0
push 0
push dword [0x5cd6d4]
mov dword [esp + 0x5c], esi
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov edi, eax
test edi, edi
js 0x42b97a
push esi
push 0
push dword [0x5cd55c]
mov byte [0x5cd02b], 1
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42ba31
push str.EnableKphWarnings
nop
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x42b9a5
test dword [0x5d03a0], 0x100
jne 0x42b9a5
mov edx, edi
mov ecx, str.Unable_to_verify_the_kernel_driver_signature.
lfence
call fcn.0042b460
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42ba31
lfence
mov esi, dword [esp + 0x18]
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push str.EnableKphWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x42ba31
test dword [0x5d03a0], 0x100
jne 0x42ba31
mov edx, edi
mov ecx, str.Unable_to_read_the_kernel_driver_signature.
jmp 0x42ba29
push str.EnableKphWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
lea esp, [esp]
test eax, eax
je 0x42ba31
lea eax, [esp + 0x30]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
je 0x42ba31
test dword [0x5d03a0], 0x100
mov edi, edi
jne 0x42ba31
mov edx, esi
mov ecx, str.Unable_to_load_the_kernel_driver_service.
lfence
call fcn.0042b460
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x42ba50
lea ecx, [ebx - 8]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x42ba53
call fcn.004c1f60
jmp 0x42ba53
or ebx, 0xffffffff
mov ecx, dword [esp + 0x24]
mov eax, ebx
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x42ba69
call fcn.004c1f60
lea ecx, [esi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x42ba7b
call fcn.004c1f60
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x42ba8f
call fcn.004c1f60
mov ecx, dword ds:[esp + 0x2ac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret