Function at 0x406100
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub esp, 8
mov ebx, ecx
mov edx, 0xf013f
push 0
push 0x452a38
push ecx
lea ecx, [ebp - 0xc]
call fcn.004092a0
mov edi, eax
test edi, edi
js 0x406331
mov ecx, dword ds:[ebx + 0x18]
mov edx, str.processhacker.exe_0
call fcn.004073e0
mov esi, eax
mov dword [ebp - 0x14], 0x180016
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], str.DisplayIcon
mov ecx, dword [esi]
add ecx, 2
push ecx
push dword [esi + 4]
push 1
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x406185
lea ecx, [ecx]
call fcn.00409ce0
push 0x1e
push str.Process_Hacker
push 1
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x180016
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], str.DisplayName
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 8
push 0x433dc0
push 1
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1e001c
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], str.DisplayVersion
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x4c
push str.https:__processhacker.sourceforge.io_
push 1
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x120010
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], str.HelpLink
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x406203
mov edx, dword [edx + 4]
jmp 0x406205
xor edx, edx
mov ecx, edx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406210
sub ecx, esi
mov dword [ebp - 0x14], 0x20001e
sar ecx, 1
mov dword [ebp - 0x10], str.InstallLocation
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x1e
push str.Process_Hacker
push 1
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x140012
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], str.Publisher
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x406279
mov eax, dword [eax + 4]
jmp 0x40627b
xor eax, eax
push eax
push str.__sprocesshacker_setup.exe___uninstall
call fcn.0040a950
mov esi, eax
mov dword [ebp - 0x14], 0x20001e
add esp, 8
mov dword [ebp - 0x10], str.UninstallString
lea eax, [ebp - 0x14]
mov ecx, dword [esi]
add ecx, 2
push ecx
push dword [esi + 4]
push 1
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4062c8
call fcn.00409ce0
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x120010
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], str.NoModify
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x120010
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], str.NoRepair
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413aae
mov esp, ebp
pop ebp
ret