Function at 0x4574a0
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x577
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
push edi
mov dword [esp + 0x18], eax
call sym.ProcessHacker.exe_PhGetDialogItemValue
push str.SampleCountAutomatic
mov esi, eax
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0
push 0
push 0xf0
test eax, eax
push 0x551
push edi
setne bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov edx, 1
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edx
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhSetIntegerSetting
test esi, esi
mov ebx, 1
push str.SampleCount
cmove esi, ebx
call sym.ProcessHacker.exe_PhGetIntegerSetting
movzx ecx, byte [0x5cdc63]
cmp esi, eax
push esi
cmovne ecx, ebx
push str.SampleCount
mov byte [0x5cdc63], cl
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x477
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.SearchEngine
call sym.ProcessHacker.exe_PhSetStringSetting2
push 0x47f
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.ProgramInspectExecutables
call sym.ProcessHacker.exe_PhSetStringSetting2
push 0
push 0
push 0x147
push 0x478
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push str.MaxSizeUnit
mov dword [0x5cc1a4], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x4e0
push edi
call sym.ProcessHacker.exe_PhGetDialogItemValue
push eax
push str.IconProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x4c2
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push str.DbgHelpSearchPath
call sym.ProcessHacker.exe_PhGetStringSetting
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [esp + 0x18]
mov esi, eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push ebx
push esi
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x45767f
push 0x4c2
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, ds:[esp + 0x18]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhGetWindowTextEx
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.DbgHelpSearchPath
call sym.ProcessHacker.exe_PhSetStringSetting2
mov byte [0x5cdc63], bl
mov esi, dword [esp + 0x10]
push 0xf000
push 0
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.AllowOnlyOneInstance
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 1
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.HideOnClose
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 2
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.HideOnMinimize
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 4
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.StartHidden
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xb
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov edi, 1
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0xc
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.MainWindowTabRestoreEnabled
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 6
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableKph
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 5
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableWarnings
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 8
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnablePlugins
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 9
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.DbgHelpUndecorate
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xa
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableThemeSupport
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xd
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableThemeSupport
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0xe
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableStartAsAdmin
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xf
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableNetworkResolveDoH
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0x10
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableNetworkResolveDoH
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x11
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableInstantTooltips
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0x12
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableServiceStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0x13
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x5cdc63]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x5cdc63], al
movzx eax, cl
push eax
push str.EnableServiceStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x14
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.IconSingleClick
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x15
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.IconTogglesVisibility
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x16
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.PropagateCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x17
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableAdvancedOptions
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableThemeSupport
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x457bde
push edi
push str.GraphColorMode
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 4
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
push 3
push 0x102c
mov edi, eax
push esi
shr edi, 0xc
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
shr esi, 0xc
cmp esi, 2
sete cl
cmp byte [0x5cde50], cl
je 0x457d30
push 0
push 0x5c9e40
push 0xfffffffffffffff7
push 0x20006
lea eax, [esp + 0x28]
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x457d30
cmp esi, 2
jne 0x457cf3
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov esi, eax
test esi, esi
je 0x457d26
push 0x5838c0
push dword [esi + 4]
push 0x5838c0
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp edi, 2
jne 0x457c9d
push str.__hide
push dword [eax + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, dword [0x5c9f28]
mov edx, dword [eax]
mov edi, dword [eax + 4]
add edx, 2
mov word [esp + 0x10], cx
lea eax, [ecx + 2]
mov word [esp + 0x12], ax
mov eax, dword [0x5c9f2c]
mov dword [esp + 0x14], eax
cmp ecx, 0xfffe
ja 0x457cde
push edx
push edi
push 1
push 0
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x457d26
call fcn.004c1f60
jmp 0x457d26
mov ecx, dword [0x5c9f28]
mov word [esp + 0x10], cx
lea eax, [ecx + 2]
mov word [esp + 0x12], ax
mov eax, dword [0x5c9f2c]
mov dword [esp + 0x14], eax
cmp ecx, 0xfffe
ja 0x457d26
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x457360
push 0
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret