Function at 0x1400520e0
Capabilities:
Delete registry value
Get graphical window text
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov edx, 0x577
mov r15, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x500
mov qword [rsp + 0x58], rax
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItemInt]
mov qword [rsp + 0x30], 0x28
mov ecx, 5
mov r13d, eax
lea rax, str.SampleCountAutomatic
mov qword [rsp + 0x38], rax
xor eax, eax
lock cmpxchg qword [0x140193950], rcx
je 0x140052158
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x30]
mov rsi, qword [0x1401965a8]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x450], rbx
movups xmmword [rbp - 0x80], xmm0
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
xor r12d, r12d
mov rcx, qword [rsi + 0x20]
dec edx
mov r14d, eax
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x1400521cf
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x1400521c5
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rsp + 0x78]
call qword [rsi + VariantCopy]
test al, al
jne 0x1400521d2
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x1400521a0
mov rdi, r12
test rdi, rdi
je 0x1400521e1
cmp dword [rdi], 1
jne 0x1400521e1
mov ebx, dword [rdi + 0x28]
jmp 0x1400521ea
mov ebx, dword [rbp + 0x358]
mov rdi, r12
mov eax, 5
lock cmpxchg qword [0x140193950], r12
je 0x140052206
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x140052217
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
mov edx, 0x551
mov rcx, r15
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 1
mov qword [rsp + 0x30], 0x28
cmp eax, 1
movzx eax, byte [0x1401925aa]
sete r12b
cmp r12b, bl
cmovne eax, ecx
mov byte [0x1401925aa], al
lea rax, str.SampleCountAutomatic
lock bts qword [0x140193950], 0
mov qword [rsp + 0x38], rax
jae 0x14005228a
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp - 0x58]
movups xmmword [rbp - 0x50], xmm0
call qword [rdi + 0x10]
mov edx, dword [rdi + 0x18]
mov r14d, eax
mov rcx, qword [rdi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x1400522ee
nop
mov ebx, dword [rdi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x1400522e4
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x58]
call qword [rdi + VariantCopy]
test al, al
jne 0x14005233d
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x1400522c0
xor r14d, r14d
mov esi, r14d
or r12, 0xffffffffffffffff
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x14005232c
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x14005232c
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052353
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor r14d, r14d
test rsi, rsi
je 0x1400522f4
cmp dword [rsi], 1
jne 0x1400522f4
movzx eax, r12b
mov dword [rsi + 0x28], eax
jmp 0x1400522f4
test r13d, r13d
lea rcx, str.SampleCount
mov ebx, 1
cmove r13d, ebx
call sym.ProcessHacker.exe_PhGetIntegerSetting
movzx r8d, byte [0x1401925aa]
lea rcx, str.SampleCount
cmp r13d, eax
mov edx, r13d
cmovne r8d, ebx
mov byte [0x1401925aa], r8b
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x477
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x14005241d
mov rdx, qword [0x140196800]
mov ebx, eax
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r14w
mov rcx, rsi
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
shr r8d, 1
inc r8d
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1400523f9
mov qword [rbp + 0x360], rdi
jmp 0x140052429
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov qword [rbp + 0x360], rax
lea rcx, [rdi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140052429
call fcn.1400c8bc0
jmp 0x140052429
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov qword [rbp + 0x360], rax
mov rcx, qword [rbp + 0x360]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rdx, rax
lea rcx, str.SearchEngine
call sym.ProcessHacker.exe_PhSetStringSetting2
mov edx, 0x47f
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x1400524d1
mov rdx, qword [0x140196800]
mov ebx, eax
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r14w
mov rcx, rsi
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
shr r8d, 1
inc r8d
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1400524ad
mov qword [rbp + 0x368], rdi
jmp 0x1400524dd
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov qword [rbp + 0x368], rax
lea rcx, [rdi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400524dd
call fcn.1400c8bc0
jmp 0x1400524dd
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov qword [rbp + 0x368], rax
mov rcx, qword [rbp + 0x368]
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rdx, rax
lea rcx, str.ProgramInspectExecutables
call sym.ProcessHacker.exe_PhSetStringSetting2
mov edx, 0x478
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, eax
mov dword [0x140190e48], eax
lea rcx, str.MaxSizeUnit
call sym.ProcessHacker.exe_PhSetIntegerSetting
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4e0
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItemInt]
lock bts qword [0x140193950], 0
mov r15d, eax
mov qword [rsp + 0x30], 0x1a
lea rax, str.IconProcesses
mov qword [rsp + 0x38], rax
jae 0x140052572
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp - 0x28]
movups xmmword [rbp - 0x20], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400525db
nop dword [rax]
nop dword [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x1400525d3
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x28]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052624
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400525b0
xor ebx, ebx
mov esi, ebx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052613
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052613
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052636
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor ebx, ebx
test rsi, rsi
je 0x1400525df
cmp dword [rsi], 1
jne 0x1400525df
mov dword [rsi + 0x28], r15d
jmp 0x1400525df
mov r13, qword [rsp + 0x58]
mov r9d, 0xf000
mov rcx, r13
xor r8d, r8d
mov edx, 0x102c
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, ebx
mov qword [rsp + 0x30], 0x28
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.AllowOnlyOneInstance
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x140052690
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 8]
movups xmmword [rbp + 0x10], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400526fd
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x1400526f3
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 8]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052745
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400526d0
xor ebx, ebx
mov rsi, rbx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052734
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052734
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052757
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor ebx, ebx
test rsi, rsi
je 0x140052700
cmp dword [rsi], 1
jne 0x140052700
mov dword [rsi + 0x28], r15d
jmp 0x140052700
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 1
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, ebx
lea rcx, str.HideOnClose
and eax, 0xfffff000
cmp eax, 0x2000
sete dl
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 2
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, ebx
mov qword [rsp + 0x30], 0x1c
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.HideOnMinimize
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x1400527e4
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x38]
movups xmmword [rbp + 0x40], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005284d
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140052843
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x38]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052895
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052820
xor ebx, ebx
mov rsi, rbx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052884
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052884
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x1400528a5
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x140052850
cmp dword [rsi], 1
jne 0x140052850
mov dword [rsi + 0x28], r15d
jmp 0x140052850
lea rax, str.MiniInfoWindowEnabled
mov qword [rsp + 0x30], 0x2a
mov qword [rsp + 0x38], rax
mov r15d, 5
xor eax, eax
lock cmpxchg qword [0x140193950], r15
je 0x1400528d9
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x30]
mov rsi, qword [0x1401965a8]
lea rcx, [rbp + 0x68]
movups xmmword [rbp + 0x70], xmm0
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005293b
nop dword [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140052933
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x68]
call qword [rsi + VariantCopy]
test al, al
jne 0x14005294e
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052910
xor ecx, ecx
mov edi, ecx
test rdi, rdi
je 0x140052952
cmp dword [rdi], 1
jne 0x140052952
mov ebx, dword [rdi + 0x28]
jmp 0x14005295b
xor ecx, ecx
jmp 0x14005293f
mov ebx, dword [rbp + 0x358]
mov rdi, rcx
mov rax, r15
lock cmpxchg qword [0x140193950], rcx
je 0x140052975
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x140052986
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r9d, 0xf000
mov r8, r15
mov edx, 0x102c
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1401925aa]
and eax, 0xfffff000
cmp eax, 0x2000
mov qword [rsp + 0x30], 0x2a
sete r15b
test ebx, ebx
setne al
cmp r15b, al
mov eax, 1
cmovne ecx, eax
lea rax, str.MiniInfoWindowEnabled
mov byte [0x1401925aa], cl
lock bts qword [0x140193950], 0
mov qword [rsp + 0x38], rax
jae 0x1400529f5
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x98]
movups xmmword [rbp + 0xa0], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140052a5e
nop dword [rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140052a56
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x98]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052aa7
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052a30
xor edi, edi
mov esi, edi
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052a96
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052a96
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052abc
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor edi, edi
test rsi, rsi
je 0x140052a62
cmp dword [rsi], 1
jne 0x140052a62
movzx eax, r15b
mov dword [rsi + 0x28], eax
jmp 0x140052a62
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 6
mov rcx, r13
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov ecx, 1
cmp eax, 0x2000
movzx eax, byte [0x1401925aa]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ecx
lea rcx, str.EnableKph
mov byte [0x1401925aa], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 7
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, edi
mov qword [rsp + 0x30], 0x1c
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.EnableWarnings
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x140052b72
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0xc8]
movups xmmword [rbp + 0xd0], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140052bde
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140052bd6
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0xc8]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052c25
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052bb0
xor esi, esi
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052c14
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052c14
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052c35
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x140052be0
cmp dword [rsi], 1
jne 0x140052be0
mov dword [rsi + 0x28], r15d
jmp 0x140052be0
lea rdi, str.EnablePlugins
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 8
mov rcx, r13
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 1
mov qword [rsp + 0x30], 0x1a
and eax, 0xfffff000
mov qword [rsp + 0x38], rdi
cmp eax, 0x2000
movzx eax, byte [0x1401925aa]
sete r15b
cmp r15b, bl
cmovne eax, ecx
mov byte [0x1401925aa], al
lock bts qword [0x140193950], 0
jae 0x140052caf
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0xf8]
movups xmmword [rbp + 0x100], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140052d1e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140052d16
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0xf8]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052d26
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052cf0
xor r15d, r15d
mov esi, r15d
jmp 0x140052d3a
test rsi, rsi
je 0x140052d37
cmp dword [rsi], 1
jne 0x140052d37
movzx eax, r15b
mov dword [rsi + 0x28], eax
xor r15d, r15d
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052d6e
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052d6e
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052d7f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rax, str.EnableNetworkResolve
mov qword [rsp + 0x30], 0x28
mov qword [rsp + 0x38], rax
mov ecx, 5
xor eax, eax
lock cmpxchg qword [0x140193950], rcx
je 0x140052db2
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x30]
mov rsi, qword [0x1401965a8]
lea rcx, [rbp + 0x128]
movups xmmword [rbp + 0x130], xmm0
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140052e1e
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140052e16
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x128]
call qword [rsi + VariantCopy]
test al, al
jne 0x140052e21
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052df0
mov rdi, r15
test rdi, rdi
je 0x140052e30
cmp dword [rdi], 1
jne 0x140052e30
mov ebx, dword [rdi + 0x28]
jmp 0x140052e39
mov ebx, dword [rbp + 0x358]
mov rdi, r15
mov eax, 5
lock cmpxchg qword [0x140193950], r15
je 0x140052e55
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x140052e66
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 9
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1401925aa]
and eax, 0xfffff000
cmp eax, 0x2000
mov qword [rsp + 0x30], 0x28
sete r15b
test ebx, ebx
setne al
cmp r15b, al
mov eax, 1
cmovne ecx, eax
lea rax, str.EnableNetworkResolve
mov byte [0x1401925aa], cl
lock bts qword [0x140193950], 0
mov qword [rsp + 0x38], rax
jae 0x140052ed8
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x158]
movups xmmword [rbp + 0x160], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140052f3e
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140052f36
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x158]
call qword [rdi + VariantCopy]
test al, al
jne 0x140052f87
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140052f10
xor ebx, ebx
mov esi, ebx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140052f76
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140052f76
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x140052f9c
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor ebx, ebx
test rsi, rsi
je 0x140052f42
cmp dword [rsi], 1
jne 0x140052f42
movzx eax, r15b
mov dword [rsi + 0x28], eax
jmp 0x140052f42
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xa
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, ebx
mov qword [rsp + 0x30], 0x2a
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.EnableInstantTooltips
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x140052ff4
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x188]
movups xmmword [rbp + 0x190], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005305e
nop dword [rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140053056
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x188]
call qword [rdi + VariantCopy]
test al, al
jne 0x140053066
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140053030
xor r15d, r15d
mov esi, r15d
jmp 0x140053077
test rsi, rsi
je 0x140053074
cmp dword [rsi], 1
jne 0x140053074
mov dword [rsi + 0x28], r15d
xor r15d, r15d
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x1400530ab
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x1400530ab
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x1400530bc
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rax, str.EnableCycleCpuUsage
mov qword [rsp + 0x30], 0x26
mov qword [rsp + 0x38], rax
mov ecx, 5
xor eax, eax
lock cmpxchg qword [0x140193950], rcx
je 0x1400530ef
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x30]
mov rsi, qword [0x1401965a8]
lea rcx, [rbp + 0x1b8]
movups xmmword [rbp + 0x1c0], xmm0
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005315e
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140053156
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x1b8]
call qword [rsi + VariantCopy]
test al, al
jne 0x140053161
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140053130
mov rdi, r15
test rdi, rdi
je 0x140053170
cmp dword [rdi], 1
jne 0x140053170
mov ebx, dword [rdi + 0x28]
jmp 0x140053179
mov ebx, dword [rbp + 0x358]
mov rdi, r15
mov eax, 5
lock cmpxchg qword [0x140193950], r15
je 0x140053195
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x1400531a6
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xb
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1401925aa]
and eax, 0xfffff000
cmp eax, 0x2000
mov qword [rsp + 0x30], 0x26
sete r15b
test ebx, ebx
setne al
cmp r15b, al
mov eax, 1
cmovne ecx, eax
lea rax, str.EnableCycleCpuUsage
mov byte [0x1401925aa], cl
lock bts qword [0x140193950], 0
mov qword [rsp + 0x38], rax
jae 0x140053218
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x1e8]
movups xmmword [rbp + 0x1f0], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005327e
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140053276
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x1e8]
call qword [rdi + VariantCopy]
test al, al
jne 0x1400532c5
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140053250
xor esi, esi
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x1400532b4
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x1400532b4
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x1400532d8
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x140053280
cmp dword [rsi], 1
jne 0x140053280
movzx eax, r15b
mov dword [rsi + 0x28], eax
jmp 0x140053280
lea rcx, str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xc
mov rcx, r13
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov ecx, 1
cmp eax, 0x2000
movzx eax, byte [0x1401925aa]
sete dl
cmp dl, bl
movzx edx, dl
cmovne eax, ecx
lea rcx, str.EnableStage2
mov byte [0x1401925aa], al
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xd
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
mov qword [rsp + 0x30], 0x2e
and eax, 0xfffff000
mov r15d, ebx
cmp eax, 0x2000
lea rax, str.CollapseServicesOnStart
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x140053390
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x218]
movups xmmword [rbp + 0x220], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140053400
nop dword [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x1400533f6
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x218]
call qword [rdi + VariantCopy]
test al, al
jne 0x140053448
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400533d0
xor ebx, ebx
mov rsi, rbx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140053437
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140053437
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x14005345a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor ebx, ebx
test rsi, rsi
je 0x140053403
cmp dword [rsi], 1
jne 0x140053403
mov dword [rsi + 0x28], r15d
jmp 0x140053403
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xe
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, ebx
mov qword [rsp + 0x30], 0x1e
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.IconSingleClick
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x1400534b2
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x248]
movups xmmword [rbp + 0x250], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140053520
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140053516
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x248]
call qword [rdi + VariantCopy]
test al, al
jne 0x140053568
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400534f0
xor ebx, ebx
mov rsi, rbx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140053557
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140053557
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x14005357a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor ebx, ebx
test rsi, rsi
je 0x140053523
cmp dword [rsi], 1
jne 0x140053523
mov dword [rsi + 0x28], r15d
jmp 0x140053523
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xf
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, ebx
mov qword [rsp + 0x30], 0x2a
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.IconTogglesVisibility
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x1400535d2
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x278]
movups xmmword [rbp + 0x280], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140053640
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140053636
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x278]
call qword [rdi + VariantCopy]
test al, al
jne 0x140053688
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140053610
xor ebx, ebx
mov rsi, rbx
mov rcx, r12
lock xadd qword [0x140193950], rcx
movzx eax, cl
and al, 6
cmp al, 2
jne 0x140053677
lea rax, [rcx - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140053677
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x14005369a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor ebx, ebx
test rsi, rsi
je 0x140053643
cmp dword [rsi], 1
jne 0x140053643
mov dword [rsi + 0x28], r15d
jmp 0x140053643
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x10
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, ebx
mov qword [rsp + 0x30], 0x22
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.PropagateCpuUsage
mov qword [rsp + 0x38], rax
sete r15b
lock bts qword [0x140193950], 0
jae 0x1400536f2
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
movups xmm0, xmmword [rsp + 0x30]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x2a8]
movups xmmword [rbp + 0x2b0], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140053760
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140053756
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x2a8]
call qword [rdi + VariantCopy]
test al, al
jne 0x1400537a7
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140053730
xor ebx, ebx
mov rsi, rbx
lock xadd qword [0x140193950], r12
movzx eax, r12b
and al, 6
cmp al, 2
jne 0x140053796
lea rax, [r12 - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140193950], rdx
jne 0x140053796
lea rcx, [0x140193950]
call fcn.1400dd200
test rsi, rsi
jne 0x1400537b7
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x140053763
cmp dword [rsi], 1
jne 0x140053763
mov dword [rsi + 0x28], r15d
jmp 0x140053763
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 4
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x102c
mov r9d, 0xf000
mov rdi, rax
mov r8d, 3
shr edi, 0xc
mov rcx, r13
cmp edi, 2
sete sil
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
shr ebx, 0xc
cmp ebx, 2
sete cl
cmp byte [0x140194a34], cl
jne 0x140053822
cmp ebx, 2
jne 0x140053956
cmp byte [0x1401946c7], sil
je 0x140053956
mov rcx, qword [0x14018b830]
mov word [rsp + 0x68], cx
lea eax, [rcx + 2]
mov word [rsp + 0x6a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
mov qword [rsp + 0x70], rax
cmp rcx, 0xfffe
ja 0x140053956
xor r8d, r8d
lea rax, [rsp + 0x60]
lea r9, [rbp + 0x2d8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
lea rcx, [r8 - 9]
call fcn.1400da6c0
test eax, eax
js 0x140053956
lea r8, [rbp + 0x2d8]
mov edx, 0x20006
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0x60]
mov esi, eax
test rcx, rcx
je 0x1400538a2
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x140053956
mov dword [rsp + 0x48], 0x1e001c
lea rax, [0x14013cb38]
mov qword [rsp + 0x50], rax
cmp ebx, 2
jne 0x14005393b
mov r8, qword [0x140192530]
lea r9, [0x140159074]
lea rdx, [0x140159074]
lea ecx, [rbx + 1]
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhConcatStrings
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, rax
cmp edi, ebx
jne 0x14005390e
mov rcx, qword [rax + 8]
lea rdx, str.__hide
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, rax
mov eax, dword [rcx]
lea rdx, [rsp + 0x48]
add eax, 2
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rcx + 8]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
jmp 0x14005394b
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0x450]
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret