Function at 0x456480
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x5c9c58]
push edi
test cl, cl
je 0x45663a
test esi, esi
jne 0x4564b5
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov ebx, eax
jmp 0x4564eb
push dword [0x5cd4f8]
mov edi, dword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov word [eax + esi], cx
test edi, edi
je 0x4564eb
push esi
push edi
push dword [ebx + 4]
call fcn.00537fe0
add esp, 0xc
xor ecx, ecx
mov esi, 0x5cf00c
xor eax, eax
lock cmpxchg dword [esi], ecx
mov edi, eax
test edi, edi
jne 0x456518
push eax
push dword [0x5cd528]
call sym.ProcessHacker.exe_PhGetDllFileName
mov edi, eax
xor eax, eax
mov ecx, edi
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x45651c
lock inc dword [edi - 4]
push ebx
call sym.ProcessHacker.exe_PhGetBaseDirectory
or esi, 0xffffffff
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x456545
lea ecx, [ebx - 8]
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x456545
lea esp, [esp]
call fcn.004c1f60
push edi
call sym.ProcessHacker.exe_PhGetBaseName
mov ebx, eax
mov dword [ebp - 0xc], ebx
test edi, edi
je 0x456568
lea ecx, ds:[edi - 8]
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x456568
call fcn.004c1f60
push dword [ebx + 4]
mov edi, dword [ebp - 0x20]
push 0x562d24
push dword [edi + 4]
push 3
call sym.ProcessHacker.exe_PhConcatStrings
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov ebx, eax
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x456597
call fcn.004c1f60
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4565a9
call fcn.004c1f60
push 0
push 0
push 0x80
push ebx
push 0xfffffffffffffffd
push 0x20006
lea eax, [ebp - 0x14]
push eax
call sym.ProcessHacker.exe_PhCreateKey
mov edi, eax
test edi, edi
js 0x456626
mov ecx, dword [0x5c9e48]
mov dword [ebp - 0x10], 0x111000
mov dword [ebp - 0xc], 0x11110111
mov word [ebp - 0x1c], cx
lea eax, [ecx + 2]
mov word [ebp - 0x1a], ax
mov eax, dword [str.MitigationOptions]
mov dword [ebp - 0x18], eax
cmp ecx, 0xfffe
jbe 0x456602
mov edi, 0xc0000106
jmp 0x45661b
push 8
lea eax, [ebp - 0x10]
push eax
push 0xb
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov edi, eax
push dword ds:[ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x456788
jmp 0x456783
test esi, esi
jne 0x456649
mov edi, edi
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov ebx, eax
jmp 0x45667f
push dword [0x5cd4f8]
mov edi, dword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov word [eax + esi], cx
test edi, edi
je 0x45667f
push esi
push edi
push dword [ebx + 4]
call fcn.00537fe0
add esp, 0xc
xor ecx, ecx
mov esi, 0x5cf00c
xor eax, eax
lock cmpxchg dword [esi], ecx
mov edi, eax
test edi, edi
jne 0x4566ac
push eax
push dword [0x5cd528]
call sym.ProcessHacker.exe_PhGetDllFileName
mov edi, eax
xor eax, eax
mov ecx, edi
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x4566b0
lock inc dword [edi - 4]
push ebx
call sym.ProcessHacker.exe_PhGetBaseDirectory
or esi, 0xffffffff
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x4566d6
lea ecx, [ebx - 8]
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4566d6
call fcn.004c1f60
push edi
call sym.ProcessHacker.exe_PhGetBaseName
mov ebx, eax
test edi, edi
je 0x4566f6
lea ecx, [edi - 8]
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4566f6
call fcn.004c1f60
push dword [ebx + 4]
mov edi, dword [ebp - 0xc]
push 0x562d24
push dword [edi + 4]
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
mov dword [ebp - 0x20], eax
lea ecx, [ebx - 8]
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x456725
mov edi, edi
call fcn.004c1f60
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x456737
call fcn.004c1f60
push 0x80
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 0xfffffffffffffffd
push 0x10000
push eax
call sym.ProcessHacker.exe_PhOpenKey
mov ebx, eax
test ebx, ebx
js 0x456769
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [ebp - 0x14]
mov ebx, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword ds:[ebp - 0x20]
xor edi, edi
cmp ebx, 0xc0000034
cmovne edi, ebx
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x456793
call fcn.004c1f60
xor eax, eax
cmp edi, 0xc0000034
cmove edi, eax
mov ecx, dword ds:[ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret