Function at 0x18000cae0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xa8
mov qword [rsp + 0x70], 0xfffffffffffffffe
xor ebp, ebp
mov qword [rax - 0x40], rbp
mov dword [rax - 0x38], ebp
mov qword [rax - 0x50], rbp
mov dword [rax - 0x48], ebp
lea rcx, [0x18006af50]
mov rax, qword [0x18006af50]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWN
or rbx, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x18000cb5d
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.180005550
test rax, rax
je 0x18000cb7e
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180005780
mov rdi, qword [rsp + 0x58]
jmp 0x18000cb7e
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.180005a60
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000cc54
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0xd0], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.iexplore.exe
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xd8], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.regsvr32.exe
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x18000cc4d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x68], rbp
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18000cd30
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0xe0], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.iexplore.exe
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.regsvr32.exe
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x18000cd29
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x90], ebp
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000cd49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000cd5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x18000cd6d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret