Function at 0x940180
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xd64
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xd5c], eax
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
mov esi, str.SoftwareMicroWorldeScan_For_WindowsMwMonitorExcludeFolders
lea edi, [esp + 0x860]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
push 0xc5
lea eax, [esp + 0x8a3]
push ebx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
movsb byte es:[edi], byte [esi]
call fcn.00a7ffb0
add esp, 0xc
xor ecx, ecx
call fcn.009790d0
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebx
call fcn.00963620
cmp eax, 2
jle 0x94020b
mov ebx, str.ClusSVC
call fcn.009605b0
test eax, eax
je 0x940209
mov ecx, ebx
call fcn.00954680
cmp eax, 1
je 0x940209
mov dword [esp + 0x24], 1
xor ebx, ebx
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x86c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9403b0
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x940259
mov edx, dword [esp + 0x14]
push edx
jmp 0x9403b9
mov esi, dword [esp + 0x20]
cmp esi, ebx
jbe 0x9403b0
push 0x3ff
lea eax, [esp + 0x465]
push ebx
push eax
mov byte [esp + 0x46c], bl
call fcn.00a7ffb0
add esp, 0xc
xor edi, edi
cmp esi, ebx
jbe 0x9403b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, 0x400
mov eax, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x474]
push edx
push edi
push eax
mov byte [esp + 0x480], bl
mov dword [esp + 0x4c], ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x9403b0
cmp byte [esp + 0x460], bl
je 0x9403a5
push 0x3ff
lea ecx, [esp + 0x96d]
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x974], bl
call fcn.00a7ffb0
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x46c]
push eax
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9403b0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x96c]
push eax
push ebx
push ebx
push str.ObjectName
push ecx
mov dword [esp + 0x34], ebp
call esi
mov edx, dword [esp + 0x18]
test eax, eax
je 0x94034f
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x9403a5
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push str.ObjectType
push edx
mov dword [esp + 0x34], 4
call esi
test eax, eax
je 0x94037c
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x9403a5
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x970]
push ecx
mov dword [esp + 0x24], ebx
call fcn.0093fd50
add esp, 0xc
inc edi
cmp edi, dword [esp + 0x20]
jb 0x940297
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x9403c3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
push 0x103
lea edx, [esp + 0x35d]
push ebx
push edx
mov byte [esp + 0x364], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0x255]
push ebx
push eax
mov byte [esp + 0x25c], bl
call fcn.00a7ffb0
add esp, 0xc
mov edi, 0x104
lea ecx, [esp + 0x358]
call fcn.00958630
lea esi, [esp + 0x358]
call fcn.00960950
push edi
lea ecx, [esp + 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea esi, [esp + 0x250]
call fcn.00960950
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esp + 0x24], ebx
je 0x9404e8
push 0x103
lea edx, [esp + 0x45]
push ebx
push edx
mov byte [esp + 0x4c], bl
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x358]
mov byte [esp + eax + 0x40], cl
inc eax
cmp cl, bl
jne 0x940460
cmp byte [esp + 0x40], bl
je 0x94049e
lea eax, [esp + 0x40]
lea ebx, [ebx]
inc eax
cmp byte [eax], bl
jne 0x940480
lea ecx, [esp + 0x40]
sub eax, ecx
je 0x94049e
cmp byte [esp + eax + 0x3f], 0x5c
je 0x94049e
push 0xaa1564
mov edx, ecx
push edx
call esi
lea eax, [esp + 0x40]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x9404a3
mov ecx, dword [str.Cluster]
mov edx, dword [0xae74cc]
mov dword [eax], ecx
lea ecx, [esp + 0x40]
mov dword [eax + 4], edx
call fcn.0095a450
test eax, eax
je 0x9404e8
push 0xadb0c4
lea eax, [esp + 0x44]
push eax
call esi
push 1
push 0x2c
lea ecx, [esp + 0x48]
push ecx
mov edi, 0xb8e204
call fcn.0098d640
mov edi, str.Vmms.exe
lea ecx, [esp + 0x250]
call fcn.00959ba0
test eax, eax
je 0x94052b
mov edi, str.Vmwp.exe
lea ecx, [esp + 0x250]
call fcn.00959ba0
test eax, eax
je 0x94052b
mov edi, str.Vmsp.exe
lea ecx, [esp + 0x250]
call fcn.00959ba0
test eax, eax
jne 0x940718
push 2
lea edx, [esp + 0x35c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00a7a620
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x14c]
push edx
mov byte [esp + 0x3e], bl
call ebp
cmp byte [esp + 0x148], bl
je 0x940594
lea eax, [esp + 0x148]
jmp 0x940570
inc eax
cmp byte [eax], bl
jne 0x940570
lea ecx, [esp + 0x148]
sub eax, ecx
je 0x940594
cmp byte [esp + eax + 0x147], 0x5c
je 0x940594
push 0xaa1564
mov edx, ecx
push edx
call esi
push str.UsersPublic
lea eax, [esp + 0x14c]
push eax
call esi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
cmp byte [esp + 0x40], bl
je 0x9405de
lea eax, [esp + 0x40]
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x9405c0
lea ecx, [esp + 0x40]
sub eax, ecx
je 0x9405de
cmp byte [esp + eax + 0x3f], 0x5c
je 0x9405de
push 0xaa1564
mov edx, ecx
push edx
call esi
push str.ProgramData
lea eax, [esp + 0x44]
push eax
call esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x464]
push str._sMicrosoftWindowsHyper_V
push edx
call fcn.00a78f30
add esp, 0xc
lea ecx, [esp + 0x460]
call fcn.0095a450
test eax, eax
je 0x940639
push 0xadb0c4
lea eax, [esp + 0x464]
push eax
call esi
push 1
push 0x2c
lea ecx, [esp + 0x468]
push ecx
mov edi, 0xb8e204
call fcn.0098d640
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x464]
push str._sPublicDocumentsHyper_VVirtual_Hard_Disks
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [esp + 0x460]
call fcn.0095a450
test eax, eax
je 0x94068b
push 0xadb0c4
lea ecx, [esp + 0x464]
push ecx
call esi
push 1
push 0x2c
lea edx, [esp + 0x468]
push edx
mov edi, 0xb8e204
call fcn.0098d640
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x464]
push ecx
call ebp
cmp byte [esp + 0x460], bl
je 0x9406d4
lea eax, [esp + 0x460]
lea ebx, [ebx]
inc eax
cmp byte [eax], bl
jne 0x9406b0
lea edx, [esp + 0x460]
sub eax, edx
je 0x9406d4
cmp byte [esp + eax + 0x45f], 0x5c
je 0x9406d4
push 0xaa1564
mov eax, edx
push eax
call esi
push str.ClusterStorage
lea ecx, [esp + 0x464]
push ecx
call esi
lea ecx, [esp + 0x460]
call fcn.0095a450
test eax, eax
je 0x940718
push 0xadb0c4
lea edx, [esp + 0x464]
push edx
call esi
push 1
push 0x2c
lea eax, [esp + 0x468]
push eax
mov edi, 0xb8e204
call fcn.0098d640
mov ecx, dword [esp + 0xd6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0xd64
ret