Function at 0x14007ef10
Capabilities:
Delete registry value
Persist via image file execution options registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov edx, 0x47b
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
lea rcx, str.EnableWarnings
cmp eax, 1
mov edx, edi
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x47d
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebp, 1
lea rcx, str.EnableKph
cmp eax, 1
movzx eax, byte [0x14015c817]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c817], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x45e
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, edi
lea rcx, str.HideUnnamedHandles
cmp eax, ebp
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
lea rcx, str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x4e5
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableStage2
movzx eax, byte [0x14015c817]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c817], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
lea rcx, str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x4f7
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov edx, 0xf0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableNetworkResolve
movzx eax, byte [0x14015c817]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c817], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x4fa
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, edi
lea rcx, str.PropagateCpuUsage
cmp eax, ebp
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x50c
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableInstantTooltips
sete dil
mov edx, edi
call sym.ProcessHacker.exe_PhSetIntegerSetting
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
jb 0x14007f16a
lea rcx, str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x50d
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.EnableCycleCpuUsage
movzx eax, byte [0x14015c817]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c817], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor r9d, r9d
xor r8d, r8d
mov edx, 0x500
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItemInt]
lea rcx, str.SampleCountAutomatic
mov edi, eax
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x551
mov rcx, rsi
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
lea rcx, str.SampleCountAutomatic
movzx eax, byte [0x14015c817]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ebp
mov byte [0x14015c817], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
test edi, edi
lea rcx, str.SampleCount
cmove edi, ebp
call sym.ProcessHacker.exe_PhGetIntegerSetting
movzx r8d, byte [0x14015c817]
lea rcx, str.SampleCount
cmp edi, eax
mov edx, edi
cmovne r8d, ebp
mov byte [0x14015c817], r8b
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x4bb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x14007f393
mov edx, 0x4bb
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebp
sete bl
cmp byte [0x14015c888], bl
je 0x14007f393
mov rcx, qword [0x140156470]
mov rax, qword [str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x48], rax
cmp rcx, 0xfffe
ja 0x14007f393
xor r8d, r8d
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea rcx, [r8 - 3]
call fcn.140023c80
test eax, eax
js 0x14007f393
lea r8, [rsp + 0x50]
mov edx, 0x20006
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0xb0]
mov edi, eax
test rcx, rcx
je 0x14007f2e1
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x14007f393
mov dword [rsp + 0x30], 0x120010
lea rax, str.Debugger
mov qword [rsp + 0x38], rax
test bl, bl
je 0x14007f359
mov r8, qword [0x14015e7c8]
lea r9, [0x1401313cc]
lea rdx, [0x1401313cc]
mov ecx, 3
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r9d, ebp
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov ecx, dword [rax]
mov rax, qword [rax + 8]
add ecx, 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
jmp 0x14007f36c
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
test eax, eax
jns 0x14007f385
xor r9d, r9d
lea rdx, [0x1401313d0]
mov r8d, eax
mov rcx, rsi
call sym.ProcessHacker.exe_PhShowStatus
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret