Function at 0x140044840
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov edx, 0x47b
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
lea rcx, str.EnableWarnings
cmp eax, 1
mov edx, edi
sete dl
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
lea rcx, str.EnableKph
call sym.SHOPMuntukmed.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x47d
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebp, 1
lea rcx, str.EnableKph
cmp eax, 1
movzx eax, byte [0x14015c5b9]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c5b9], al
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
mov edx, 0x45e
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, edi
lea rcx, str.HideUnnamedHandles
cmp eax, ebp
sete dl
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
lea rcx, str.EnableStage2
call sym.SHOPMuntukmed.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x4e5
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableStage2
movzx eax, byte [0x14015c5b9]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c5b9], al
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
lea rcx, str.EnableNetworkResolve
call sym.SHOPMuntukmed.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x4f7
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov edx, 0xf0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableNetworkResolve
movzx eax, byte [0x14015c5b9]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c5b9], al
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
mov edx, 0x4fa
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, edi
lea rcx, str.PropagateCpuUsage
cmp eax, ebp
sete dl
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
mov edx, 0x50c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableInstantTooltips
sete dil
mov edx, edi
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
cmp dword [sym.SHOPMuntukmed.exe_WindowsVersion], 0x3d
jb 0x140044a9a
lea rcx, str.EnableCycleCpuUsage
call sym.SHOPMuntukmed.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x50d
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableCycleCpuUsage
movzx eax, byte [0x14015c5b9]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c5b9], al
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
xor r9d, r9d
xor r8d, r8d
mov edx, 0x500
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItemInt]
lea rcx, str.SampleCountAutomatic
mov edi, eax
call sym.SHOPMuntukmed.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x551
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.SampleCountAutomatic
movzx eax, byte [0x14015c5b9]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c5b9], al
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
test edi, edi
lea rcx, str.SampleCount
cmove edi, ebp
call sym.SHOPMuntukmed.exe_PhGetIntegerSetting
movzx r8d, byte [0x14015c5b9]
lea rcx, str.SampleCount
cmp edi, eax
mov edx, edi
cmovne r8d, ebp
mov byte [0x14015c5b9], r8b
call sym.SHOPMuntukmed.exe_PhSetIntegerSetting
mov edx, 0x4bb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140044cc3
mov edx, 0x4bb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
sete bl
cmp byte [0x14015c5bb], bl
je 0x140044cc3
mov rcx, qword [0x140153778]
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x48], rax
cmp rcx, 0xfffe
ja 0x140044cc3
xor r8d, r8d
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea rcx, [r8 - 3]
call fcn.1400beed0
test eax, eax
js 0x140044cc3
lea r8, [rsp + 0x50]
mov edx, 0x20006
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0xb0]
mov edi, eax
test rcx, rcx
je 0x140044c11
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x140044cc3
mov dword [rsp + 0x30], 0x120010
lea rax, str.Debugger
mov qword [rsp + 0x38], rax
test bl, bl
je 0x140044c89
mov r8, qword [0x14015f348]
lea r9, [0x14012d794]
lea rdx, [0x14012d794]
mov ecx, 3
mov r8, qword [r8 + 8]
call sym.SHOPMuntukmed.exe_PhConcatStrings
mov rcx, rax
call sym.SHOPMuntukmed.exe_PhAutoDereferenceObject
mov r9d, ebp
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov ecx, dword [rax]
mov rax, qword [rax + 8]
add ecx, 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
jmp 0x140044c9c
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
test eax, eax
jns 0x140044cb5
xor r9d, r9d
lea rdx, str.Unable_to_replace_Task_Manager
mov r8d, eax
mov rcx, rsi
call sym.SHOPMuntukmed.exe_PhShowStatus
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret