Function at 0x454de0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x5d03a0], 0x80
push ebx
push esi
push edi
mov ebx, ecx
je 0x454f8c
call fcn.004560c0
test al, al
mov ecx, str.Do_you_want_to_make_Process_Hacker_the_default_Windows_Task_Manager_
mov edx, str.Do_you_want_to_restore_the_default_Windows_Task_Manager_
cmove edx, ecx
push edx
push 0x5621e4
push 0xfffd
push 6
push ebx
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
cmp eax, 6
jne 0x455026
push 0
push 0
push 0x80
push 0x5c9c58
push 0xfffffffffffffffd
push 0x2001f
lea eax, [ebp - 8]
push eax
call sym.ProcessHacker.exe_PhCreateKey
mov esi, eax
test esi, esi
js 0x454f55
call fcn.004560c0
test al, al
je 0x454ebf
mov ecx, dword [0x5c9f40]
mov word [ebp - 0x10], cx
lea eax, [ecx + 2]
mov word [ebp - 0xe], ax
mov eax, dword [str.Debugger]
mov dword [ebp - 0xc], eax
cmp ecx, 0xfffe
jbe 0x454eab
push dword ds:[ebp - 8]
mov esi, 0xc0000106
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x454f55
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov esi, eax
jmp 0x454f48
nop
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov edi, eax
test edi, edi
je 0x454f48
push 0x5838c0
push dword ds:[edi + 4]
push 0x5838c0
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, dword [0x5c9f40]
mov word [ebp - 0x10], cx
mov edx, dword [eax]
mov esi, dword [eax + 4]
add edx, 2
lea eax, [ecx + 2]
mov word [ebp - 0xe], ax
mov eax, dword [str.Debugger]
mov dword [ebp - 0xc], eax
cmp ecx, 0xfffe
jbe 0x454f1e
mov esi, 0xc0000106
jmp 0x454f33
push edx
push esi
push 1
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
lea ecx, ds:[edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x454f48
call fcn.004c1f60
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x454f66
push 0
push esi
push str.Unable_to_replace_Task_Manager
push ebx
lfence
call sym.ProcessHacker.exe_PhShowStatus
mov eax, dword [0x5ccf70]
test eax, eax
je 0x455026
push dword [eax + 4]
call sym.ProcessHacker.exe_PhSaveSettings
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cdc84]
test eax, eax
jne 0x454feb
mov esi, dword [0x5cd528]
lea eax, [ebp - 8]
push eax
push 0
push 5
push 0xe3
push esi
call sym.ProcessHacker.exe_PhLoadResource
test al, al
jne 0x454fb6
xor eax, eax
jmp 0x454fc9
push 0
push 0x455180
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x5cdc84], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5cdc84]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5cdc84]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x455017
push 9
push dword [0x5cdc84]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5cdc84]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret