Function at 0x1400282c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx r14d, cl
lea rax, [rbp - 0x20]
xor ebx, ebx
lea rdx, str.SOFTWAREPoliciesGoogleChrome
mov qword [rsp + 0x40], rbx
mov esi, r14d
mov qword [rsp + 0x38], rax
xor esi, 1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 6
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x18], esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140028333
mov edi, ebx
jmp 0x14002837b
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.IncognitoModeAvailability
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
test eax, eax
je 0x140028370
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, ebx
jmp 0x14002837b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwarePoliciesMicrosoftMicrosoftEdgeMain
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 6
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
mov dword [rbp - 0x18], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400283c0
mov eax, ebx
jmp 0x140028408
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.AllowInPrivate
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
test eax, eax
je 0x1400283fd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140028408
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov qword [rsp + 0x40], rbx
lea rdx, str.SOFTWAREPoliciesMicrosoftEdge
and edi, eax
mov dword [rbp - 0x18], esi
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14002844e
mov edi, ebx
jmp 0x140028491
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.InPrivateModeAvailability
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
test eax, eax
je 0x14002848b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, ebx
jmp 0x140028491
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 6
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
mov dword [rbp - 0x18], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140028517
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.DisablePrivateBrowsing
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
test eax, eax
je 0x14002850c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140028517
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 1
and dil, bl
movzx eax, dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400a5460
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret