Function at 0x140093c10
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x810
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x800], rax
mov rbx, rdx
xor esi, esi
mov dword [rsp + 0x30], esi
mov word [rsp + 0x400], si
xor edx, edx
mov r8d, 0x3fe
lea rcx, [r11 - 0x416]
call fcn.1400ad2f0
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x1f0], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1f2]
call fcn.1400ad2f0
lea r8, str.Settings
lea rdx, str.softwareWeatherTool
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x1f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140093d04
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UpdateUrl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140093d14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], rsi
mov word [rsp + 0xa8], si
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x400]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0xa0]
call fcn.140025a70
nop
cmp qword [rsp + 0xb8], 0
je 0x140093d7b
lea rcx, [rsp + 0x400]
call qword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0x140093dd2
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
mov r8d, 0x2c
lea rdx, str.http:__popup.toptools100.com_weather_getmsg_
lea rcx, [rsp + 0x40]
call fcn.140025a70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call fcn.140025740
nop
cmp qword [rsp + 0x60], 8
jb 0x140093dd2
mov rcx, qword [rsp + 0x48]
call fcn.1400ad0b8
mov dword [rsp + 0x30], 0x400
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x400]
call fcn.1400ad2f0
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x1f0], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1f2]
call fcn.1400ad2f0
lea r8, [0x1400f9500]
lea rdx, str.softwareWeatherTool
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x1f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140093e88
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UserID
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140093e98
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x400]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140093ed0
lea r8, [rsp + 0x400]
lea rdx, str.id_s
lea rcx, [rsp + 0xa0]
call fcn.140093010
jmp 0x140093ef1
call fcn.14001f620
mov r9, rax
lea r8, [0x1400f32e4]
mov edx, 0xfde9
lea rcx, [rsp + 0xa0]
call fcn.140093be0
mov dword [rsp + 0x30], 0x400
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x400]
call fcn.1400ad2f0
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x1f0], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1f2]
call fcn.1400ad2f0
lea r8, [0x1400f9500]
lea rdx, str.softwareWeatherTool
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x1f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140093fa7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140093fb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x400]
lea rdx, str.soft_weather_s
lea rcx, [rsp + 0xa0]
call fcn.140093010
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0xd0]
call fcn.1400ad2f0
mov dword [rsp + 0xd0], 0x11c
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r9d, dword [rsp + 0xd8]
mov r8d, dword [rsp + 0xd4]
lea rdx, str.os_u._u
lea rcx, [rsp + 0xa0]
call fcn.140093010
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x70]
cmp dx, 9
je 0x14009405d
cmp dx, 6
je 0x14009405d
mov r8d, 0x11
lea rdx, str.architecturex86
lea rcx, [rsp + 0xa0]
call fcn.1400258f0
jmp 0x140094077
mov r8d, 0x11
lea rdx, str.architecturex64
lea rcx, [rsp + 0xa0]
call fcn.1400258f0
mov dword [rsp + 0x30], 0x400
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x400]
call fcn.1400ad2f0
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x1f0], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x1f2]
call fcn.1400ad2f0
lea r8, [0x1400f9500]
lea rdx, str.softwareWeatherTool
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x1f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009412d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PartnerID
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009413d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x400]
lea rdx, str.weather_pn_s
lea rcx, [rsp + 0xa0]
call fcn.140093010
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
mov word [rbx + 8], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call fcn.140025740
nop
cmp qword [rsp + 0xc0], 8
jb 0x14009419e
mov rcx, qword [rsp + 0xa8]
call fcn.1400ad0b8
mov rax, rbx
jmp 0x1400941a1
mov rax, rbx
mov rcx, qword [rsp + 0x800]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x810]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret