Function at 0x14008a4e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov edx, 0x47b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a522
mov dword [rsp + 0x6c], 1
jmp 0x14008a52a
mov dword [rsp + 0x6c], 0
mov edx, dword [rsp + 0x6c]
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhSetIntegerSetting
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14008a554
mov dword [rsp + 0x4c], 1
jmp 0x14008a55c
mov dword [rsp + 0x4c], 0
movzx eax, byte [rsp + 0x4c]
mov byte [rsp + 0x36], al
mov edx, 0x47d
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a59b
mov dword [rsp + 0x44], 1
jmp 0x14008a5a3
mov dword [rsp + 0x44], 0
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
movzx ecx, byte [rsp + 0x36]
cmp eax, ecx
je 0x14008a5c1
mov byte [0x14013dceb], 1
movzx eax, byte [rsp + 0x34]
mov edx, eax
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor eax, eax
test eax, eax
jne 0x14008a53a
mov edx, 0x45e
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a614
mov dword [rsp + 0x54], 1
jmp 0x14008a61c
mov dword [rsp + 0x54], 0
mov edx, dword [rsp + 0x54]
lea rcx, str.HideUnnamedHandles
call sym.ProcessHacker.exe_PhSetIntegerSetting
lea rcx, str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14008a646
mov dword [rsp + 0x78], 1
jmp 0x14008a64e
mov dword [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x3a], al
mov edx, 0x4e5
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a68d
mov dword [rsp + 0x5c], 1
jmp 0x14008a695
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x32]
movzx ecx, byte [rsp + 0x3a]
cmp eax, ecx
je 0x14008a6b3
mov byte [0x14013dceb], 1
movzx eax, byte [rsp + 0x32]
mov edx, eax
lea rcx, str.EnableStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor eax, eax
test eax, eax
jne 0x14008a62c
lea rcx, str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14008a6ea
mov dword [rsp + 0x74], 1
jmp 0x14008a6f2
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
mov byte [rsp + 0x39], al
mov edx, 0x4f7
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a731
mov dword [rsp + 0x64], 1
jmp 0x14008a739
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x39]
cmp eax, ecx
je 0x14008a757
mov byte [0x14013dceb], 1
movzx eax, byte [rsp + 0x30]
mov edx, eax
lea rcx, str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor eax, eax
test eax, eax
jne 0x14008a6d0
mov edx, 0x4fa
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a7aa
mov dword [rsp + 0x7c], 1
jmp 0x14008a7b2
mov dword [rsp + 0x7c], 0
mov edx, dword [rsp + 0x7c]
lea rcx, str.PropagateCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x50c
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a7f8
mov dword [rsp + 0x48], 1
jmp 0x14008a800
mov dword [rsp + 0x48], 0
mov edx, dword [rsp + 0x48]
lea rcx, str.EnableInstantTooltips
call sym.ProcessHacker.exe_PhSetIntegerSetting
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
jb 0x14008a8c1
lea rcx, str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14008a837
mov dword [rsp + 0x50], 1
jmp 0x14008a83f
mov dword [rsp + 0x50], 0
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x37], al
mov edx, 0x50d
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a87e
mov dword [rsp + 0x58], 1
jmp 0x14008a886
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x37]
cmp eax, ecx
je 0x14008a8a4
mov byte [0x14013dceb], 1
movzx eax, byte [rsp + 0x31]
mov edx, eax
lea rcx, str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor eax, eax
test eax, eax
jne 0x14008a81d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x500
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItemInt]
mov dword [rsp + 0x3c], eax
lea rcx, str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14008a8f8
mov dword [rsp + 0x60], 1
jmp 0x14008a900
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x38], al
mov edx, 0x551
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008a93f
mov dword [rsp + 0x68], 1
jmp 0x14008a947
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x33]
movzx ecx, byte [rsp + 0x38]
cmp eax, ecx
je 0x14008a965
mov byte [0x14013dceb], 1
movzx eax, byte [rsp + 0x33]
mov edx, eax
lea rcx, str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor eax, eax
test eax, eax
jne 0x14008a8de
cmp dword [rsp + 0x3c], 0
jne 0x14008a991
mov dword [rsp + 0x3c], 1
lea rcx, str.SampleCount
call sym.ProcessHacker.exe_PhGetIntegerSetting
cmp dword [rsp + 0x3c], eax
je 0x14008a9aa
mov byte [0x14013dceb], 1
mov edx, dword [rsp + 0x3c]
lea rcx, str.SampleCount
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x4bb
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x14008ab50
mov edx, 0x4bb
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x14008aa14
mov dword [rsp + 0x70], 1
jmp 0x14008aa1c
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x35], al
movzx eax, byte [0x14013dce9]
movzx ecx, byte [rsp + 0x35]
cmp eax, ecx
je 0x14008ab50
mov dword [rsp + 0x20], 0
lea r9, [0x140136da0]
mov r8, 0xfffffffffffffffd
mov edx, 0x20006
lea rcx, [rsp + 0x88]
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
jl 0x14008ab50
lea rdx, str.Debugger
lea rcx, [rsp + 0x90]
call fcn.140020210
movzx eax, byte [rsp + 0x35]
test eax, eax
je 0x14008ab05
lea r9, [0x14011e904]
mov rax, qword [0x140140c70]
mov r8, qword [rax + 8]
lea rdx, [0x14011e904]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
add eax, 2
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x80]
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x14008ab1f
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x14008ab42
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
lea rdx, [0x14011e908]
mov rcx, qword [rsp + 0xb0]
call sym.ProcessHacker.exe_PhShowStatus
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
add rsp, 0xa8
ret