Function at 0x43fca0
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
push 0x577
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
push edi
mov dword [ebp - 8], eax
call sym.ProcessHacker.exe_PhGetDialogItemValue
push str.SampleCountAutomatic
mov esi, eax
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0
push 0
push 0xf0
test eax, eax
push 0x551
push edi
setne bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
mov edx, 1
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edx
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhSetIntegerSetting
test esi, esi
mov ebx, 1
push str.SampleCount
cmove esi, ebx
call sym.ProcessHacker.exe_PhGetIntegerSetting
movzx ecx, byte [0x549c0b]
cmp esi, eax
push esi
cmovne ecx, ebx
push str.SampleCount
mov byte [0x549c0b], cl
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x477
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x43fdbf
push dword [0x54b7b4]
lea esi, [eax + eax]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor eax, eax
lea ecx, [ebx + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], esi
mov word [ecx + esi], ax
mov ecx, dword [ebx]
shr ecx, 1
inc ecx
push ecx
push dword [ebx + 4]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x43fda3
mov esi, ebx
jmp 0x43fdc6
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
lea ecx, [ebx - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x43fdc6
call fcn.004a2a20
jmp 0x43fdc6
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.SearchEngine
call sym.ProcessHacker.exe_PhSetStringSetting2
push 0x47f
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x43fe49
push dword [0x54b7b4]
lea esi, [eax + eax]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor eax, eax
lea ecx, [ebx + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], esi
mov word [esi + ecx], ax
mov ecx, dword [ebx]
shr ecx, 1
inc ecx
push ecx
push dword [ebx + 4]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x43fe2d
mov esi, ebx
jmp 0x43fe50
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
lea ecx, [ebx - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x43fe50
call fcn.004a2a20
jmp 0x43fe50
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.ProgramInspectExecutables
call sym.ProcessHacker.exe_PhSetStringSetting2
push 0
push 0
push 0x147
push 0x478
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push str.MaxSizeUnit
mov dword [0x5484ac], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x4e0
push edi
call sym.ProcessHacker.exe_PhGetDialogItemValue
push eax
push str.IconProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0x4c2
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x43ff19
push dword [0x54b7b4]
lea esi, [eax + eax]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ebx, eax
xor eax, eax
lea ecx, [ebx + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], esi
mov word [esi + ecx], ax
mov ecx, dword [ebx]
shr ecx, 1
inc ecx
push ecx
push dword [ebx + 4]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x43fefa
mov dword [ebp - 4], ebx
jmp 0x43ff21
call sym.ProcessHacker.exe_PhReferenceEmptyString
lea ecx, [ebx - 8]
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov edx, ebx
lock xadd dword [ecx + 4], edx
dec edx
jne 0x43ff24
call fcn.004a2a20
jmp 0x43ff24
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov dword [ebp - 4], eax
or ebx, 0xffffffff
push str.DbgHelpSearchPath
call sym.ProcessHacker.exe_PhGetStringSetting
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [ebp - 4]
mov esi, eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 1
push esi
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x43ffdd
push 0x4c2
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x43ffbe
push dword [0x54b7b4]
lea esi, [eax + eax]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [edi + 4], ecx
mov dword [edi], esi
mov word [esi + ecx], ax
mov ecx, dword [edi]
shr ecx, 1
inc ecx
push ecx
push dword [edi + 4]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x43ffa5
mov esi, edi
jmp 0x43ffc5
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x43ffc5
call fcn.004a2a20
jmp 0x43ffc5
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push eax
push str.DbgHelpSearchPath
call sym.ProcessHacker.exe_PhSetStringSetting2
mov byte [0x549c0b], 1
mov esi, dword [ebp - 8]
push 0xf000
push 0
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.AllowOnlyOneInstance
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 1
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.HideOnClose
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 2
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.HideOnMinimize
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 5
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov edi, 1
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 6
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.EnableKph
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 7
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableWarnings
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 8
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.EnablePlugins
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 9
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.DbgHelpUndecorate
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xa
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0xb
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.EnableInstantTooltips
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xc
test eax, eax
push 0x102c
setne bl
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xd
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.EnableStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
push str.EnableServiceStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
push 0xf000
push 0xe
test eax, eax
push 0x102c
push esi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
movzx eax, byte [0x549c0b]
sete cl
cmp cl, bl
cmovne eax, edi
mov byte [0x549c0b], al
movzx eax, cl
push eax
push str.EnableServiceStage2
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0xf
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.CollapseServicesOnStart
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x10
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.IconSingleClick
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x11
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.IconTogglesVisibility
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 0x12
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
push ecx
push str.PropagateCpuUsage
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 0xf000
push 4
push 0x102c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
mov edi, eax
push 3
shr edi, 0xc
push 0x102c
cmp edi, 2
push esi
sete bl
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
shr esi, 0xc
cmp esi, 2
sete cl
cmp byte [0x549de8], cl
jne 0x440422
cmp esi, 2
jne 0x4404d1
cmp byte [0x549c0a], bl
je 0x4404d1
push 0
push 0x546a80
push 0xfffffffffffffff7
push 0x20006
lea eax, [ebp - 4]
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x4404d1
mov dword [ebp - 0x10], 0x1e001c
mov dword [ebp - 0xc], 0x5078b8
cmp esi, 2
jne 0x4404bb
mov eax, dword [0x5491d4]
push 0x523054
push dword [eax + 4]
push 0x523054
push 3
call sym.ProcessHacker.exe_PhConcatStrings
add esp, 0x10
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, eax
cmp edi, esi
jne 0x440491
push str.__hide
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, eax
mov eax, dword [ecx]
add eax, 2
push eax
push dword [ecx + 4]
lea eax, [ebp - 0x10]
push 1
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret