Function at 0x140058b30
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov edx, 0x47b
mov r12, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
xor r13d, r13d
cmp eax, 1
mov r15d, r13d
sete r15b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x140058b98
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.EnableWarnings
lea rcx, [rbp - 0x39]
mov qword [rsp + 0xf8], rdi
mov qword [rbp - 0x31], 0x1c
mov qword [rbp - 0x29], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140058c12
nop
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140058c08
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x39]
call qword [rsi + 8]
test al, al
jne 0x140058df4
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140058be0
mov rbx, r13
mov r13, 0xffffffffffffffff
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140058c50
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x140058c50
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
xor eax, eax
mov r15d, 5
lock cmpxchg qword [0x14018d8b0], r15
je 0x140058c78
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rcx, [rbp - 9]
mov eax, 0x12
mov qword [rbp - 1], rax
lea rax, str.EnableKph
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140058cf2
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140058ce8
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140058e12
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140058cc0
mov ebx, dword [rbp + 0x6f]
xor eax, eax
mov edi, eax
mov rax, r15
xor ecx, ecx
lock cmpxchg qword [0x14018d8b0], rcx
je 0x140058d15
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x140059dcd
test ebx, ebx
mov edx, 0x47d
mov rcx, r12
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete r15b
cmp r15b, bl
je 0x140058d58
mov byte [0x14018dace], 1
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x140058d75
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.EnableKph
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x12
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140058dee
nop dword [rax]
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140058de4
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140058e2c
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140058dc0
xor edi, edi
mov ebx, edi
jmp 0x140058e42
mov rbx, rdi
test rdi, rdi
je 0x140058c15
cmp dword [rdi], 1
jne 0x140058c15
mov dword [rdi + 0x28], r15d
jmp 0x140058c15
test rdi, rdi
je 0x140058cf2
cmp dword [rdi], 1
jne 0x140058cf2
mov ebx, dword [rdi + 0x28]
jmp 0x140058cf9
mov rbx, rdi
test rdi, rdi
je 0x140058e40
cmp dword [rdi], 1
jne 0x140058e40
movzx eax, r15b
mov dword [rdi + 0x28], eax
xor edi, edi
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140058e76
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x140058e76
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
mov edx, 0x45e
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov r15d, edi
sete r15b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x140058ec8
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.HideUnnamedHandles
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x24
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140058f3e
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140058f34
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140058f46
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140058f10
xor r15d, r15d
mov ebx, r15d
jmp 0x140058f5a
mov rbx, rdi
test rdi, rdi
je 0x140058f57
cmp dword [rdi], 1
jne 0x140058f57
mov dword [rdi + 0x28], r15d
xor r15d, r15d
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140058f8e
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x140058f8e
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
xor eax, eax
mov ecx, 5
lock cmpxchg qword [0x14018d8b0], rcx
je 0x140058fb5
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.EnableStage2
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x31], 0x18
mov qword [rbp - 0x29], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059032
nop dword [rax]
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059028
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x39]
call qword [rsi + 8]
test al, al
jne 0x140059136
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059000
mov ebx, dword [rbp + 0x6f]
mov rdi, r15
mov eax, 5
lock cmpxchg qword [0x14018d8b0], r15
je 0x140059054
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x140059dcd
test ebx, ebx
mov edx, 0x4e5
mov rcx, r12
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete r15b
cmp r15b, bl
je 0x140059097
mov byte [0x14018dace], 1
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x1400590b4
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.EnableStage2
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x18
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x14005912e
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059124
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059150
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059100
xor r15d, r15d
mov ebx, r15d
jmp 0x140059167
test rdi, rdi
je 0x140059032
cmp dword [rdi], 1
jne 0x140059032
mov ebx, dword [rdi + 0x28]
jmp 0x140059038
mov rbx, rdi
test rdi, rdi
je 0x140059164
cmp dword [rdi], 1
jne 0x140059164
movzx eax, r15b
mov dword [rdi + 0x28], eax
xor r15d, r15d
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x14005919b
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14005919b
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
xor eax, eax
mov ecx, 5
lock cmpxchg qword [0x14018d8b0], rcx
je 0x1400591c2
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.EnableNetworkResolve
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x31], 0x28
mov qword [rbp - 0x29], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059242
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059238
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x39]
call qword [rsi + 8]
test al, al
jne 0x140059344
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059210
mov ebx, dword [rbp + 0x6f]
mov rdi, r15
mov eax, 5
lock cmpxchg qword [0x14018d8b0], r15
je 0x140059264
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x140059dcd
test ebx, ebx
mov edx, 0x4f7
mov rcx, r12
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete r15b
cmp r15b, bl
je 0x1400592a7
mov byte [0x14018dace], 1
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x1400592c4
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.EnableNetworkResolve
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x28
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x14005933e
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059334
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x14005935e
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059310
xor edi, edi
mov ebx, edi
jmp 0x140059374
test rdi, rdi
je 0x140059242
cmp dword [rdi], 1
jne 0x140059242
mov ebx, dword [rdi + 0x28]
jmp 0x140059248
mov rbx, rdi
test rdi, rdi
je 0x140059372
cmp dword [rdi], 1
jne 0x140059372
movzx eax, r15b
mov dword [rdi + 0x28], eax
xor edi, edi
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x1400593a8
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x1400593a8
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
mov edx, 0x4fa
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov r15d, edi
sete r15b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x1400593fa
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.PropagateCpuUsage
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x22
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059470
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059464
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059475
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059440
xor edi, edi
mov rbx, rdi
jmp 0x140059488
mov rbx, rdi
test rdi, rdi
je 0x140059486
cmp dword [rdi], 1
jne 0x140059486
mov dword [rdi + 0x28], r15d
xor edi, edi
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x1400594bc
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x1400594bc
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
mov edx, 0x50c
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov r15d, edi
sete r15b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14005950e
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.EnableInstantTooltips
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x2a
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059584
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059578
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059c3b
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059550
xor edi, edi
mov rbx, rdi
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x1400595bb
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x1400595bb
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3d
jb 0x1400597a3
xor eax, eax
mov r15d, 5
lock cmpxchg qword [0x14018d8b0], r15
je 0x1400595f0
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.EnableCycleCpuUsage
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x31], 0x26
mov qword [rbp - 0x29], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059662
nop
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059658
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x39]
call qword [rsi + 8]
test al, al
jne 0x140059c59
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059630
mov ebx, dword [rbp + 0x6f]
xor eax, eax
mov edi, eax
mov rax, r15
xor ecx, ecx
lock cmpxchg qword [0x14018d8b0], rcx
je 0x140059685
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x140059dcd
test ebx, ebx
mov edx, 0x50d
mov rcx, r12
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete r15b
cmp r15b, bl
je 0x1400596c8
mov byte [0x14018dace], 1
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x1400596e5
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.EnableCycleCpuUsage
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x26
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059762
nop dword [rax]
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059758
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059c73
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059730
xor eax, eax
mov ebx, eax
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x14005979a
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14005979a
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
xor r9d, r9d
xor r8d, r8d
mov edx, 0x500
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItemInt]
mov r12d, eax
mov r15d, 5
xor eax, eax
lock cmpxchg qword [0x14018d8b0], r15
je 0x1400597d9
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.SampleCountAutomatic
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x28
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059852
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059848
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059c94
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059820
mov ebx, dword [rbp + 0x6f]
xor eax, eax
mov edi, eax
mov rax, r15
xor ecx, ecx
lock cmpxchg qword [0x14018d8b0], rcx
je 0x140059875
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x140059dcd
mov rcx, qword [rbp + 0x67]
test ebx, ebx
mov edx, 0x551
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete r15b
cmp r15b, bl
je 0x1400598b9
mov byte [0x14018dace], 1
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x1400598d6
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.SampleCountAutomatic
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x28
mov qword [rbp + 7], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059952
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059948
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059cae
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059920
xor eax, eax
mov ebx, eax
mov rcx, r13
lock xadd qword [0x14018d8b0], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x14005998a
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14005998a
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
test r12d, r12d
mov eax, 1
mov ecx, 5
cmove r12d, eax
xor eax, eax
lock cmpxchg qword [0x14018d8b0], rcx
je 0x1400599bd
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea r15, str.SampleCount
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x31], 0x16
mov qword [rbp - 0x29], r15
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059a32
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059a28
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x39]
call qword [rsi + 8]
test al, al
jne 0x140059ccf
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059a00
mov ebx, dword [rbp + 0x6f]
xor eax, eax
mov edi, eax
mov eax, 5
xor ecx, ecx
lock cmpxchg qword [0x14018d8b0], rcx
je 0x140059a57
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
je 0x140059dcd
cmp r12d, ebx
je 0x140059a6c
mov byte [0x14018dace], 1
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x140059a89
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rcx, [rbp - 9]
mov qword [rbp - 1], 0x16
mov qword [rbp + 7], r15
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x140059b02
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140059af8
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 9]
call qword [rsi + 8]
test al, al
jne 0x140059ce9
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140059ad0
xor esi, esi
mov ebx, esi
mov rdx, r13
lock xadd qword [0x14018d8b0], rdx
movzx eax, dl
and al, 6
cmp al, 2
jne 0x140059b3a
lea rax, [rdx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x140059b3a
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x140059dcd
mov rdi, qword [rbp + 0x67]
mov edx, 0x4bb
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140059db2
mov edx, 0x4bb
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov rbx, rax
sete cl
cmp byte [0x14018dae8], cl
je 0x140059db2
lea r9, [0x140188890]
mov dword [rsp + 0x20], esi
mov edx, 0x20006
lea rcx, [rbp + 0x77]
mov r8, 0xfffffffffffffffd
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhOpenKey
test eax, eax
js 0x140059db2
mov dword [rbp - 0x49], 0x120010
lea rax, str.Debugger
mov qword [rbp - 0x41], rax
mov esi, 0x10
cmp ebx, 1
jne 0x140059d09
mov r8, qword [0x140192448]
lea r9, [0x1401600b4]
lea rdx, [0x1401600b4]
mov ecx, 3
mov r8, qword [r8 + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhConcatStrings
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov r9d, ebx
lea rdx, [rbp - 0x49]
xor r8d, r8d
mov ecx, dword [rax]
mov rax, qword [rax + 8]
add ecx, 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x77]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
jmp 0x140059d17
mov rbx, rdi
test rdi, rdi
je 0x140059587
cmp dword [rdi], 1
jne 0x140059587
mov dword [rdi + 0x28], r15d
jmp 0x140059587
test rdi, rdi
je 0x140059662
cmp dword [rdi], 1
jne 0x140059662
mov ebx, dword [rdi + 0x28]
jmp 0x140059669
mov rbx, rdi
test rdi, rdi
je 0x140059766
cmp dword [rdi], 1
jne 0x140059766
movzx eax, r15b
mov dword [rdi + 0x28], eax
jmp 0x140059766
test rdi, rdi
je 0x140059852
cmp dword [rdi], 1
jne 0x140059852
mov ebx, dword [rdi + 0x28]
jmp 0x140059859
mov rbx, rdi
test rdi, rdi
je 0x140059956
cmp dword [rdi], 1
jne 0x140059956
movzx eax, r15b
mov dword [rdi + 0x28], eax
jmp 0x140059956
test rdi, rdi
je 0x140059a32
cmp dword [rdi], 1
jne 0x140059a32
mov ebx, dword [rdi + 0x28]
jmp 0x140059a39
xor esi, esi
mov rbx, rdi
test rdi, rdi
je 0x140059b06
cmp dword [rdi], 1
jne 0x140059b06
mov dword [rdi + 0x28], r12d
jmp 0x140059b06
mov rcx, qword [rbp + 0x77]
lea rdx, [rbp - 0x49]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov ebx, eax
test eax, eax
jns 0x140059da8
cmp eax, 0xc0000022
je 0x140059d40
cmp eax, 0xc0000005
je 0x140059d40
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140059d4c
movzx eax, bx
jmp 0x140059d48
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140059d55
mov ecx, ebx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
jmp 0x140059d5c
mov ecx, eax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetWin32Message
lea r9, str.Unable_to_replace_Task_Manager
mov rbx, rax
mov edx, esi
mov rcx, rdi
test rax, rax
jne 0x140059d7e
lea r8, [0x140166310]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp 0x140059da8
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r13d
cmp r13d, 1
jne 0x140059da8
call fcn.1400d9400
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3