Function at 0x140072b00
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
sub rsp, 0x38
test byte [0x140246920], 0x80
je 0x140071276
add rsp, 0x38
jmp 0x140072b00
mov rcx, qword [0x140242590]
nop dword [rax]
test rcx, rcx
jne 0x1400712cd
mov qword [rsp + 0x20], rcx
lea r9, [0x1400713a0]
mov rcx, qword [0x140241948]
xor r8d, r8d
mov edx, 0xe3
call sym.ProcessHacker.exe_PhCreateDialog
mov rcx, rax
mov qword [0x140242590], rax
call sym.ProcessHacker.exe_PhRegisterDialog
mov rcx, qword [0x140242590]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140242590]
call qword [sym.imp.USER32.dll_IsIconic]
mov rcx, qword [0x140242590]
test eax, eax
je 0x1400712ee
mov edx, 9
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]
push rbp
sub rsp, 0xc0
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rbp, rcx
call fcn.1400728c0
lea rdx, str.Do_you_want_to_make_Process_Hacker_the_default_Windows_Task_Manager_
test al, al
lea rcx, str.Do_you_want_to_restore_the_default_Windows_Task_Manager_
mov r8d, 0xfffd
cmove rcx, rdx
lea r9, [0x1401b790c]
mov qword [rsp + 0x20], rcx
mov edx, 6
mov rcx, rbp
call sym.ProcessHacker.exe_PhShowMessage2
nop dword [rax + rax]
cmp eax, 6
jne 0x140072e53
mov rcx, qword [0x14023b0d0]
mov qword ss:[rsp + 0xd8], rbx
mov qword [rsp + 0xe8], rdi
mov edi, 0xffffffff
mov word [rsp + 0x50], cx
lea eax, [rcx + 2]
mov word [rsp + 0x52], ax
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
mov qword [rsp + 0x58], rax
cmp rcx, 0xfffe
jbe 0x140072bbd
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140072dc8
lea rax, [rsp + 0x48]
mov r8d, 0x80
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xfffffffffffffffd
call fcn.14011ab40
mov ebx, eax
test eax, eax
js 0x140072d7b
xor eax, eax
lea r8, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov edx, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x140072c30
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140072d7b
call fcn.1400728c0
nop dword [rax]
test al, al
je 0x140072ca5
mov rcx, qword [0x14023b608]
mov word [rsp + 0x60], cx
cmp rcx, 0xfffe
lea eax, [rcx + 2]
mov rcx, qword [rsp + 0xb0]
mov word [rsp + 0x62], ax
mov rax, qword [str.Debugger]
mov qword [rsp + 0x68], rax
jbe 0x140072c8f
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, 0xc0000106
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140072dc8
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov ebx, eax
jmp 0x140072d65
mov qword [rsp + 0xe0], rsi
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov rsi, rax
test rax, rax
je 0x140072d5d
mov r8, qword [rax + 8]
lea r9, [0x1401da1d8]
lea rdx, [0x1401da1d8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x14023b608]
mov word [rsp + 0x70], cx
mov edx, dword [rax]
mov r8, qword [rax + 8]
add edx, 2
lea eax, [rcx + 2]
mov word [rsp + 0x72], ax
mov rax, qword [str.Debugger]
mov qword [rsp + 0x78], rax
cmp rcx, 0xfffe
jbe 0x140072d1e
mov ebx, 0xc0000106
jmp 0x140072d48
mov rcx, qword ds:[rsp + 0xb0]
mov r9d, 1
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
lea rcx, [rsi - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140072d5d
call fcn.1400fbcc0
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140072e2e
nop dword [rax + rax]
cmp ebx, 0xc0000022
je 0x140072da3
cmp ebx, 0xc0000005
je 0x140072da3
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140072db2
movzx eax, bx
jmp 0x140072dae
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140072dbe
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140072dc8
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_replace_Task_Manager
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x140072e1d
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b8d58]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x140072e2e
lfence
call fcn.1400fbcc0
jmp 0x140072e2e
lea r8, [0x1401efb68]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rcx, qword [0x140240e10]
mov rdi, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xd8]
test rcx, rcx
je 0x140072e53
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhSaveSettings
mov rcx, qword ds:[rsp + 0xb8]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0xc0
pop rbp
ret