Function at 0x456000
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x64ebc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push edi
push eax
push 0x20019
push 0
push str.SOFTWAREProcessHacker2
push reloc.WS2_32.dll_bind
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x456045
push dword [ebp - 8]
call edi
mov byte [ebp - 9], 1
jmp 0x45606f
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREProcessHacker2
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x45606b
push dword [ebp - 8]
call edi
mov byte [ebp - 9], 1
jmp 0x45606f
mov byte [ebp - 9], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREProcessHacker2
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x456095
push dword [ebp - 8]
call edi
mov byte [ebp - 0xa], 1
jmp 0x4560bf
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREProcessHacker2
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x4560bb
push dword [ebp - 8]
call edi
mov byte [ebp - 0xa], 1
jmp 0x4560bf
mov byte [ebp - 0xa], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREx32debug
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4560e5
push dword [ebp - 8]
call edi
mov byte [ebp - 0xb], 1
jmp 0x45610f
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREx32debug
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x45610b
push dword [ebp - 8]
call edi
mov byte [ebp - 0xb], 1
jmp 0x45610f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREx32dbg
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x456135
push dword [ebp - 8]
call edi
mov byte [ebp - 0xc], 1
jmp 0x45615f
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREx32dbg
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x45615b
push dword [ebp - 8]
call edi
mov byte [ebp - 0xc], 1
jmp 0x45615f
mov byte [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWARECheat_Engine
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x456185
push dword [ebp - 8]
call edi
mov byte [ebp - 0xd], 1
jmp 0x4561af
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWARECheat_Engine
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x4561ab
push dword [ebp - 8]
call edi
mov byte [ebp - 0xd], 1
jmp 0x4561af
mov byte [ebp - 0xd], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREx64dbg
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4561d3
push dword [ebp - 8]
call edi
mov bh, 1
jmp 0x4561f9
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREx64dbg
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x4561f7
push dword [ebp - 8]
call edi
mov bh, 1
jmp 0x4561f9
xor bh, bh
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREWow6432NodeFiddler2
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x45621d
push dword [ebp - 8]
call edi
mov bl, 1
jmp 0x456243
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREFiddler2
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x456241
push dword [ebp - 8]
call edi
mov bl, 1
jmp 0x456243
xor bl, bl
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREHex_RaysIDA
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x456267
push dword [ebp - 8]
call edi
mov al, 1
jmp 0x45628d
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREHex_RaysIDA
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x45628b
push dword [ebp - 8]
call edi
mov al, 1
jmp 0x45628d
xor al, al
cmp byte [ebp - 9], 0
jne 0x4563a6
cmp byte [ebp - 0xa], 0
jne 0x4563a6
cmp byte [ebp - 0xb], 0
je 0x4562cd
push 0x30
push str.Detection_Alert
push str.X32Dbg_installed_on_this_device_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x6567c8
call fcn.0044f340
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp byte [ebp - 0xc], 0
jne 0x456380
cmp byte [ebp - 0xd], 0
jne 0x456380
test bh, bh
je 0x45630b
push 0x30
push str.Detection_Alert
push str.x32dbg_is_installed_on_this_device_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x6567c8
call fcn.0044f340
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
test bl, bl
je 0x456343
push 0x30
push str.Detection_Alert
push str.Fiddler_is_installed_on_this_device_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.DARK_SHADOW.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
mov ecx, 0x6567c8
call fcn.0044f340
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
test al, al
je 0x45636d
push 0x30
push str.Detection_Alert
push str.IDA_is_installed_on_this_device_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x6567c8
call fcn.0044f340
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c1e17
mov esp, ebp
pop ebp
ret
push 0x30
push str.Detection_Alert
push str.Cheat_Engine_is_installed_on_this_device_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x6567c8
call fcn.0044f340
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x30
push str.Detection_Alert
push str.ProcessHacker_installed_on_this_device__UnINstall_it_and_run_me_agin
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x6567c8
call fcn.0044f340
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3