Function at 0x140002f50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x78
mov rax, qword [0x140016010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x34], 8
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x14000e5a0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002ff4
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareEASEUSTodoBackupTime
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140002ff2
mov dword [rsp + 0x40], 1
jmp 0x140002ffc
mov dword [rsp + 0x40], 1
cmp dword [rsp + 0x40], 0
je 0x140003202
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 7
ja case.default.0x140003033
movsxd rax, dword [rsp + 0x44]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x3234]
add rax, rcx
jmp rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000e620]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000e62c]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000e638]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000e648]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.firstday
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.today
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.notshowtrial
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
jmp case.default.0x140003033
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.notshowfree
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], 0
cmp dword [rsp + 0x30], 0
jne 0x140003213
mov dword [rsp + 0x48], 1
jmp 0x14000321b
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000ac90
add rsp, 0x78
ret