Function at 0x140068710
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
sub rsp, 0x38
test dword [0x140218960], 0x100
je 0x140068729
add rsp, 0x38
jmp 0x140069fe0
mov rcx, qword [0x140214780]
test rcx, rcx
jne 0x14006877e
mov qword [rsp + 0x20], rcx
lea r9, [0x140068980]
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor r8d, r8d
mov edx, 0xe3
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, rax
mov qword [0x140214780], rax
call sym.ProcessHacker.exe_PhRegisterDialog
mov rcx, qword [0x140214780]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140214780]
call qword [sym.imp.USER32.dll_IsIconic]
mov rcx, qword [0x140214780]
test eax, eax
je 0x14006879f
mov edx, 9
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]
push rbp
sub rsp, 0xb0
mov rbp, rcx
call fcn.140069dc0
test al, al
lea rcx, str.Do_you_want_to_make_Process_Hacker_the_default_Windows_Task_Manager_
lea rdx, str.Do_you_want_to_restore_the_default_Windows_Task_Manager_
mov r8d, 0xfffd
cmove rdx, rcx
lea r9, [0x140192200]
mov qword [rsp + 0x20], rdx
mov rcx, rbp
mov edx, 6
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x14006a338
mov rcx, qword [0x14020dd10]
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xa8], rsi
mov esi, 0xffffffff
mov qword [rsp + 0xa0], rdi
mov word [rsp + 0x40], cx
lea eax, [rcx + 2]
mov word [rsp + 0x42], ax
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
mov qword [rsp + 0x48], rax
cmp rcx, 0xfffe
jbe 0x14006a08a
mov ebx, 0xc0000106
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14006a2a9
lea rax, [rsp + 0xd8]
mov r8d, 0x80
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xfffffffffffffffd
call fcn.140120390
mov ebx, eax
test eax, eax
js 0x14006a268
xor edi, edi
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov edx, 0x2001f
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0xd8]
mov ebx, eax
test rcx, rcx
je 0x14006a0fd
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
test ebx, ebx
js 0x14006a268
call fcn.140069dc0
test al, al
je 0x14006a16d
mov rcx, qword [0x14020e058]
mov word [rsp + 0x50], cx
cmp rcx, 0xfffe
lea eax, [rcx + 2]
mov rcx, qword [rsp + 0xd0]
mov word [rsp + 0x52], ax
mov rax, qword [str.Debugger]
mov qword [rsp + 0x58], rax
jbe 0x14006a159
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, 0xc0000106
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14006a2a9
lea rdx, ds:[rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov ebx, eax
jmp 0x14006a24c
xor eax, eax
lock cmpxchg qword [0x1402169a0], rdi
mov rdi, rax
je 0x14006a183
lock inc dword [rax - 8]
jmp 0x14006a1af
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rdi, rax
xor eax, eax
lock cmpxchg qword [0x1402169a0], rdi
jne 0x14006a1a6
lock inc dword [rdi - 8]
test rdi, rdi
je 0x14006a24c
mov r8, qword [rdi + 8]
lea r9, [0x1401b4408]
lea rdx, [0x1401b4408]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x14020e058]
mov word ds:[rsp + 0x60], cx
mov edx, dword [rax]
mov r8, qword [rax + 8]
add edx, 2
lea eax, [rcx + 2]
mov word [rsp + 0x62], ax
mov rax, qword [str.Debugger]
mov qword [rsp + 0x68], rax
cmp rcx, 0xfffe
jbe 0x14006a210
mov ebx, 0xc0000106
jmp 0x14006a237
mov rcx, qword [rsp + 0xd0]
mov r9d, 1
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006a24c
call fcn.140106290
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtClose]
nop word [rax + rax]
test ebx, ebx
jns 0x14006a30b
cmp ebx, 0xc0000022
je 0x14006a28c
cmp ebx, 0xc0000005
je 0x14006a28c
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006a298
movzx eax, bx
jmp 0x14006a294
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14006a2a2
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
nop
jmp 0x14006a2a9
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_replace_Task_Manager
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x14006a2fa
mov rax, qword ds:[rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14006a30b
call fcn.140106290
jmp 0x14006a30b
lea r8, [0x1401c7ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rcx, qword [0x1402130c0]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14006a338
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhSaveSettings
add rsp, 0xb0
pop rbp
ret