Function at 0x7ff7c0028710
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
sub rsp, 0x38
test dword [0x7ff7c01d8960], 0x100
je 0x7ff7c0028729
add rsp, 0x38
jmp 0x7ff7c0029fe0
mov rcx, qword [0x7ff7c01d4780]
test rcx, rcx
jne 0x7ff7c002877e
mov qword [rsp + 0x20], rcx
lea r9, [0x7ff7c0028980]
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor r8d, r8d
mov edx, 0xe3
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, rax
mov qword [0x7ff7c01d4780], rax
call sym.ProcessHacker.exe_PhRegisterDialog
mov rcx, qword [0x7ff7c01d4780]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x7ff7c01d4780]
call qword [sym.imp.USER32.dll_IsIconic]
mov rcx, qword [0x7ff7c01d4780]
test eax, eax
je 0x7ff7c002879f
mov edx, 9
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_SetForegroundWindow]
push rbp
sub rsp, 0xb0
mov rbp, rcx
call fcn.7ff7c0029dc0
test al, al
lea rcx, [0x7ff7c017e610]
lea rdx, [0x7ff7c017e590]
mov r8d, 0xfffd
cmove rdx, rcx
lea r9, [0x7ff7c0152200]
mov qword [rsp + 0x20], rdx
mov rcx, rbp
mov edx, 6
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x7ff7c002a338
mov rcx, qword [0x7ff7c01cdd10]
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xa8], rsi
mov esi, 0xffffffff
mov qword [rsp + 0xa0], rdi
mov word [rsp + 0x40], cx
lea eax, [rcx + 2]
mov word [rsp + 0x42], ax
mov rax, qword [0x7ff7c01cdd18]
mov qword [rsp + 0x48], rax
cmp rcx, 0xfffe
jbe 0x7ff7c002a08a
mov ebx, 0xc0000106
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7c002a2a9
lea rax, [rsp + 0xd8]
mov r8d, 0x80
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xfffffffffffffffd
call fcn.7ff7c00e0390
mov ebx, eax
test eax, eax
js 0x7ff7c002a268
xor edi, edi
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov edx, 0x2001f
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0xd8]
mov ebx, eax
test rcx, rcx
je 0x7ff7c002a0fd
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
test ebx, ebx
js 0x7ff7c002a268
call fcn.7ff7c0029dc0
test al, al
je 0x7ff7c002a16d
mov rcx, qword [0x7ff7c01ce058]
mov word [rsp + 0x50], cx
cmp rcx, 0xfffe
lea eax, [rcx + 2]
mov rcx, qword [rsp + 0xd0]
mov word [rsp + 0x52], ax
mov rax, qword [0x7ff7c01ce060]
mov qword [rsp + 0x58], rax
jbe 0x7ff7c002a159
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, 0xc0000106
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7c002a2a9
lea rdx, ds:[rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov ebx, eax
jmp 0x7ff7c002a24c
xor eax, eax
lock cmpxchg qword [0x7ff7c01d69a0], rdi
mov rdi, rax
je 0x7ff7c002a183
lock inc dword [rax - 8]
jmp 0x7ff7c002a1af
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rdi, rax
xor eax, eax
lock cmpxchg qword [0x7ff7c01d69a0], rdi
jne 0x7ff7c002a1a6
lock inc dword [rdi - 8]
test rdi, rdi
je 0x7ff7c002a24c
mov r8, qword [rdi + 8]
lea r9, [0x7ff7c0174408]
lea rdx, [0x7ff7c0174408]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01ce058]
mov word ds:[rsp + 0x60], cx
mov edx, dword [rax]
mov r8, qword [rax + 8]
add edx, 2
lea eax, [rcx + 2]
mov word [rsp + 0x62], ax
mov rax, qword [0x7ff7c01ce060]
mov qword [rsp + 0x68], rax
cmp rcx, 0xfffe
jbe 0x7ff7c002a210
mov ebx, 0xc0000106
jmp 0x7ff7c002a237
mov rcx, qword [rsp + 0xd0]
mov r9d, 1
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c002a24c
call fcn.7ff7c00c6290
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtClose]
nop word [rax + rax]
test ebx, ebx
jns 0x7ff7c002a30b
cmp ebx, 0xc0000022
je 0x7ff7c002a28c
cmp ebx, 0xc0000005
je 0x7ff7c002a28c
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x7ff7c002a298
movzx eax, bx
jmp 0x7ff7c002a294
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x7ff7c002a2a2
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
nop
jmp 0x7ff7c002a2a9
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, [0x7ff7c017e6a0]
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x7ff7c002a2fa
mov rax, qword ds:[rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x7ff7c017439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x7ff7c002a30b
call fcn.7ff7c00c6290
jmp 0x7ff7c002a30b
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
mov rcx, qword [0x7ff7c01d30c0]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xc0]
test rcx, rcx
je 0x7ff7c002a338
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhSaveSettings
add rsp, 0xb0
pop rbp
ret