Function at 0x140050900
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
sub rsp, 0x98
test dword [0x1401978c0], 0x100
je 0x14004f0bf
add rsp, 0x98
jmp 0x140050900
mov qword [rsp + 0xb0], rbp
lea r9, [0x14004f580]
mov qword [rsp + 0xb8], rsi
mov r8, rcx
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
mov edx, 0xe3
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r14
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.USER32.dll_DialogBoxParamW]
call sym.ProcessHacker.exe_PhUpdateCachedSettings
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x807a
call qword [sym.imp.USER32.dll_SendMessageW]
call sym.ProcessHacker.exe_PhInvalidateAllProcessNodes
lea rax, str.EnableInstantTooltips
mov qword [rsp + 0x40], 0x2a
mov qword [rsp + 0x48], rax
mov r15d, 5
xor eax, eax
lock cmpxchg qword [0x140193950], r15
je 0x14004f161
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x40]
mov rsi, qword [0x1401965a8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xa0], rbx
movups xmmword [rsp + 0x58], xmm0
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov ebp, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, rbp
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14004f1cb
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], ebp
jne 0x14004f1c3
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rsp + 0x50]
call qword [rsi + VariantCopy]
test al, al
jne 0x14004f1ce
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14004f1a0
mov rdi, r14
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
test rdi, rdi
je 0x14004f1ed
cmp dword [rdi], 1
jne 0x14004f1ed
mov ebx, dword [rdi + 0x28]
jmp 0x14004f1f7
mov ebx, dword [rsp + 0xa8]
mov rdi, r14
mov rax, r15
lock cmpxchg qword [0x140193950], r14
je 0x14004f211
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
mov rdi, qword [rsp + 0x90]
jne 0x14004f22a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rcx, qword [0x140195420]
neg ebx
mov edx, 0x41b
sbb rbx, rbx
xor r9d, r9d
xor r8d, r8d
neg rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rbx - 1]
mov edx, 0x403
mov rcx, rax
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x14019715c]
test eax, eax
je 0x14004f284
cmp eax, 1
jne 0x14004f28f
mov dword [0x140195e08], r14d
mov dword [0x140195e0c], 0xffffff
jmp 0x14004f28f
mov qword [0x140195e08], 0xefefef
mov rcx, qword [0x1401937d0]
test rcx, rcx
je 0x14004f2ac
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8098
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [0x1401925aa], r14b
je 0x14004f347
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea rax, str.Do_you_want_to_restart_Process_Hacker_now_
lea r9, str.One_or_more_options_you_have_changed_requires_a_restart_of_Process_Hacker.
mov qword [rsp + 0x20], rax
mov edx, 6
mov r8d, 0xfffd
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x14004f347
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x807b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea r8, [0x14015e600]
mov qword [rsp + 0x38], r14
mov r9d, r15d
mov dword [rsp + 0x30], r14d
xor edx, edx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
call fcn.14000c230
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8079
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
add rsp, 0x98
ret
push rdi
sub rsp, 0x90
mov rdi, rcx
call fcn.140050770
test al, al
lea rcx, str.Do_you_want_to_make_Process_Hacker_the_default_Windows_Task_Manager_
lea rdx, str.Do_you_want_to_restore_the_default_Windows_Task_Manager_
mov r8d, 0xfffd
cmove rdx, rcx
lea r9, [0x14013ca58]
mov qword [rsp + 0x20], rdx
mov rcx, rdi
mov edx, 6
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x140050b64
mov rcx, qword [0x14018bac0]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb8], rsi
mov esi, 0x10
mov word [rsp + 0x50], cx
lea eax, [rcx + 2]
mov word [rsp + 0x52], ax
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
mov qword [rsp + 0x58], rax
cmp rcx, 0xfffe
jbe 0x140050995
mov ebx, 0xc0000106
jmp 0x140050abf
lea rax, [rsp + 0xa8]
mov r8d, 0x80
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xfffffffffffffffd
call fcn.1400da6c0
mov ebx, eax
test eax, eax
js 0x140050a04
xor eax, eax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0xa8]
mov ebx, eax
test rcx, rcx
je 0x140050a04
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140050aaf
lea rax, str.Debugger
mov dword [rsp + 0x40], 0x120010
mov qword [rsp + 0x48], rax
call fcn.140050770
test al, al
je 0x140050a3e
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
jmp 0x140050a97
mov r8, qword [0x140192530]
lea r9, [0x140159074]
lea rdx, [0x140159074]
mov ecx, 3
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r9d, 1
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov ecx, dword [rax]
mov rax, qword [rax + 8]
add ecx, 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rsp + 0xb0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140050b3f
cmp ebx, 0xc0000022
je 0x140050ad2
cmp ebx, 0xc0000005
je 0x140050ad2
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140050ade
movzx eax, bx
jmp 0x140050ada
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140050ae7
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140050aee
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_replace_Task_Manager
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x140050b10
lea r8, [0x1401689f8]
mov edx, esi
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x140050b3f
mov rax, qword [rbx + 8]
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140050b3f
call fcn.1400c8bc0
mov rcx, qword [0x140192538]
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140050b64
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhSaveSettings
add rsp, 0x90
pop rdi
ret