Function at 0x451dc0
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x577
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
push edi
mov dword [esp + 0x18], eax
call sym.ProcessHacker.exe_PhGetDialogItemValue
push str.SampleCountAutomatic
mov esi, eax
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0
push 0
push 0xf0
test eax, eax
push 0x551
push edi
setne bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov edx, 1
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edx
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhSetIntegerSetting
test esi, esi
mov ebx, 1
push str.SampleCount
cmove esi, ebx
call sym.ProcessHacker.exe_PhGetIntegerSetting
movzx ecx, byte [0x5b24ab]
cmp esi, eax
push esi
cmovne ecx, ebx
push str.SampleCount
mov byte [0x5b24ab], cl
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x477
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.SearchEngine
call sym.ProcessHacker.exe_PhSetStringSetting2
push 0x47f
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.ProgramInspectExecutables
call sym.ProcessHacker.exe_PhSetStringSetting2
push 0
push 0
push 0x147
push 0x478
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push str.MaxSizeUnit
mov dword [0x5b0a08], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x4e0
push edi
call sym.ProcessHacker.exe_PhGetDialogItemValue
push eax
push str.IconProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x4c2
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push str.DbgHelpSearchPath
call sym.ProcessHacker.exe_PhGetStringSetting
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [esp + 0x18]
mov esi, eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push ebx
push esi
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x451f9f
push 0x4c2
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, ds:[esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.DbgHelpSearchPath
call sym.ProcessHacker.exe_PhSetStringSetting2
mov byte [0x5b24ab], bl
mov esi, dword [esp + 0x10]
push 0xf000
push 0
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.AllowOnlyOneInstance
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 1
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.HideOnClose
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 2
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.HideOnMinimize
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 4
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.StartHidden
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 5
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov edi, 1
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableKph
lea ecx, [ecx]
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 6
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableKph
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 7
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableWarnings
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnablePlugins
jmp 0x452140
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 8
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnablePlugins
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 9
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.DbgHelpUndecorate
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableCycleCpuUsage
jmp 0x4521c0
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xa
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableThemeSupport
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xb
test eax, eax
push 0x102c
setne bl
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableThemeSupport
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0xc
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableStartAsAdmin
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xd
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableNetworkResolveDoH
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xe
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableNetworkResolveDoH
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0xf
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableInstantTooltips
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
push 0xf000
setne bl
push 0x10
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableServiceStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0x11
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5b24ab]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5b24ab], al
movzx eax, cl
push eax
push str.EnableServiceStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x12
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.IconSingleClick
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x13
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.IconTogglesVisibility
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x14
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.PropagateCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x15
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableAdvancedOptions
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableThemeSupport
call sym.ProcessHacker.exe_PhGetIntegerSetting
lea esp, [esp]
test eax, eax
je 0x4524cf
push edi
push str.GraphColorMode
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 4
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
push 3
push 0x102c
mov edi, eax
push esi
shr edi, 0xc
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
shr esi, 0xc
cmp esi, 2
sete cl
cmp byte [0x5b2694], cl
je 0x452626
push 0
push 0x5aea10
push 0xfffffffffffffff7
push 0x20006
lea eax, [esp + 0x28]
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x452626
cmp esi, 2
jne 0x4525e2
mov edi, edi
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov esi, eax
test esi, esi
je 0x452617
push 0x56afa0
push dword ds:[esi + 4]
push 0x56afa0
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp edi, 2
jne 0x45258b
push str.__hide
push dword ds:[eax + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, dword [0x5aea18]
mov edx, dword [eax]
mov edi, dword [eax + 4]
add edx, 2
mov word [esp + 0x10], cx
lea eax, [ecx + 2]
mov word [esp + 0x12], ax
mov eax, dword [0x5aea1c]
mov dword [esp + 0x14], eax
cmp ecx, 0xfffe
ja 0x4525cc
push edx
push edi
push 1
push 0
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x452617
call fcn.004b3960
nop
jmp 0x452617
mov ecx, dword [0x5aea18]
mov word ds:[esp + 0x10], cx
lea eax, [ecx + 2]
mov word [esp + 0x12], ax
mov eax, dword [0x5aea1c]
mov dword [esp + 0x14], eax
cmp ecx, 0xfffe
ja 0x452617
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword ds:[esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x451c80
push 0
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret