Function at 0x9b9ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0xa9892b
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebp
push esi
push edi
mov eax, dword [0xb196ec]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov eax, dword [esp + 0x284]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
call fcn.008c3b90
push 0x103
lea ecx, [esp + 0x169]
push 0
mov dword [esp + 0x280], 0
push ecx
mov byte [esp + 0x170], 0
call fcn.00a7ffb0
mov edx, dword [esp + 0x28c]
push edx
lea eax, [esp + 0x174]
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorPidTmp_u
push eax
xor edi, edi
call fcn.00a78f30
add esp, 0x18
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
lea edx, [esp + 0x170]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x9ba22a
mov esi, 0x8000
push esi
call fcn.00a7a155
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x9b9dcf
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [esp + 0x24]
call fcn.008c3c10
xor eax, eax
jmp 0x9ba235
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.processname
push eax
call edi
mov eax, ebp
lea edx, [eax + 1]
jmp 0x9b9e00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9b9e00
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x2c]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.lpszCmdLine
push eax
call edi
mov eax, ebp
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x9b9e40
sub eax, ecx
push eax
push ebp
lea ecx, [esp + 0x48]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.BitPt
push eax
call edi
mov eax, ebp
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x9b9e80
sub eax, ecx
push eax
push ebp
lea ecx, [esp + 0x64]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.SessionUser
push eax
call edi
mov eax, ebp
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x9b9ec0
sub eax, ecx
push eax
push ebp
lea ecx, [esp + 0x80]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.ClientProtoStr
push eax
call edi
mov eax, ebp
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x9b9f00
sub eax, ecx
push eax
push ebp
lea ecx, [esp + 0x9c]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.PidIsSuspiciousReason
push eax
call edi
mov eax, ebp
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x9b9f40
sub eax, ecx
push eax
push ebp
lea ecx, [esp + 0xb8]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.MD5Hash
push eax
call edi
lea edx, [esp + 0xcc]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x9b9f83
mov dword [esp + 0x14], esi
mov byte [ebp], cl
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
push str.SignOutputString
push eax
call edi
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9b9fb2
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0xfc]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
push ebp
lea edx, [esp + 0x24]
push edx
push 0
mov dword [esp + 0x24], esi
mov byte [ebp], 0
mov eax, dword [esp + 0x28]
push str.Publisher
push eax
call edi
mov eax, ebp
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x9b9ff0
sub eax, ecx
push eax
push ebp
lea ecx, [esp + 0x118]
call fcn.0085d360
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.ZoneInfo
mov esi, 4
push ecx
mov dword [esp + 0x2c], esi
call edi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Signed
push edx
mov dword [esp + 0x2c], esi
call edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push str.IsProcessActive
push eax
mov dword [esp + 0x2c], esi
call edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.ChildrenCount
push ecx
mov dword [esp + 0x2c], esi
call edi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.ProcessInactiveSetTime
push edx
mov dword [esp + 0x2c], esi
call edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0xaf7a60
push eax
mov dword [esp + 0x2c], esi
call edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.PidIsSuspicious
push ecx
call edi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.ParentPID
push edx
mov dword [esp + 0x2c], esi
call edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push str.Parent_to_ParentPID
push eax
mov dword [esp + 0x2c], esi
call edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.ProcessStartTimeLow
push ecx
mov dword [esp + 0x2c], esi
call edi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.ProcessStartTimeHigh
push edx
mov dword [esp + 0x2c], esi
call edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push str.ItIs64BitProcess
push eax
mov dword [esp + 0x2c], esi
call edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.dwCurrentSessionId
push ecx
mov dword [esp + 0x2c], esi
call edi
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.ClientProto
push edx
mov dword [esp + 0x2c], esi
call edi
mov esi, dword [esp + 0x20]
lea edi, [esp + 0x24]
call fcn.009ba260
push ebp
mov edi, 1
call fcn.00a78fec
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [esp + 0x24]
call fcn.008c3c10
mov eax, edi
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00a78f21
add esp, 0x26c
ret