Function at 0x44fcc0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x5b4b40], 0x80
push ebx
push esi
push edi
mov ebx, ecx
je 0x44fe6c
call fcn.00451060
test al, al
mov ecx, str.Do_you_want_to_make_Process_Hacker_the_default_Windows_Task_Manager_
mov edx, str.Do_you_want_to_restore_the_default_Windows_Task_Manager_
cmove edx, ecx
push edx
push 0x54a060
push 0xfffd
push 6
push ebx
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
cmp eax, 6
jne 0x44fee6
push 0
push 0
push 0x80
push 0x5ae858
push 0xfffffffffffffffd
push 0x2001f
lea eax, [ebp - 8]
push eax
call sym.ProcessHacker.exe_PhCreateKey
mov esi, eax
test esi, esi
js 0x44fe35
call fcn.00451060
test al, al
je 0x44fd9f
mov ecx, dword [0x5aeac0]
mov word [ebp - 0x10], cx
lea eax, [ecx + 2]
mov word [ebp - 0xe], ax
mov eax, dword [str.Debugger]
mov dword [ebp - 0xc], eax
cmp ecx, 0xfffe
jbe 0x44fd8b
push dword ds:[ebp - 8]
mov esi, 0xc0000106
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x44fe35
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov esi, eax
jmp 0x44fe28
nop
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov edi, eax
test edi, edi
je 0x44fe28
push 0x56afa0
push dword ds:[edi + 4]
push 0x56afa0
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, dword [0x5aeac0]
mov word [ebp - 0x10], cx
mov edx, dword [eax]
mov esi, dword [eax + 4]
add edx, 2
lea eax, [ecx + 2]
mov word [ebp - 0xe], ax
mov eax, dword [str.Debugger]
mov dword [ebp - 0xc], eax
cmp ecx, 0xfffe
jbe 0x44fdfe
mov esi, 0xc0000106
jmp 0x44fe13
push edx
push esi
push 1
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
lea ecx, ds:[edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44fe28
call fcn.004b3960
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x44fe46
push 0
push esi
push str.Unable_to_replace_Task_Manager
push ebx
lfence
call sym.ProcessHacker.exe_PhShowStatus
mov eax, dword [0x5b1800]
test eax, eax
je 0x44fee6
push dword [eax + 4]
call sym.ProcessHacker.exe_PhSaveSettings
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b251c]
test eax, eax
jne 0x44feab
push eax
push 0x450040
push eax
push 0xe3
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push eax
mov dword [0x5b251c], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5b251c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5b251c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x44fed7
push 9
push dword [0x5b251c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b251c]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret