Function at 0x1400279b0
Capabilities:
Create directory
Delete registry value
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x38], rdx
test r8, r8
jne 0x140027aa3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [r8 + 1]
lea rdx, str.SoftwareProcessLasso
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027a9c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.ConfigFolderEx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140027a9c
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 2]
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027a8f
lea rdx, str.ConfigFolderEx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140027a96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x140027e09
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140027e09
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140027e53
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rsi, 0xffffffffffffffff
cmp rbx, 0x10000
jae 0x140027ae2
movzx edx, bx
lea rcx, [rsp + 0x48]
call fcn.140002950
jmp 0x140027afe
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x140027ae5
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002da0
nop
lea rcx, str.prolasso.ini
mov rbp, rsi
nop dword [rax + rax]
inc rbp
cmp word [rcx + rbp*2], 0
jne 0x140027b10
test ebp, ebp
je 0x140027e2e
lea rax, [0x14006cce4]
mov r13, rsi
nop dword [rax]
inc r13
cmp word [rax + r13*2], 0
jne 0x140027b30
xor r14d, r14d
mov esi, r14d
mov rbx, qword [rsp + 0x48]
mov rdi, rbx
lea r12, [rbx - 0x10]
movsxd rax, dword [r12]
lea r15, [rbx + rax*2]
cmp rbx, r15
jae 0x140027d5f
lea rbx, [r14 - 1]
jmp 0x140027b77
lea rcx, str.prolasso.ini
mov rdx, rcx
mov rcx, rdi
call fcn.1400407c8
test rax, rax
je 0x140027bad
movsxd rcx, ebp
lea r14, [rcx + rcx]
nop
inc esi
lea rdi, [r14 + rax]
lea rdx, str.prolasso.ini
mov rcx, rdi
call fcn.1400407c8
test rax, rax
jne 0x140027b90
xor r14d, r14d
test rdi, rdi
je 0x140027bc1
mov rax, rbx
inc rax
cmp word [rdi + rax*2], 0
jne 0x140027bb5
jmp 0x140027bc4
mov eax, r14d
inc eax
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
cmp rdi, r15
jb 0x140027b70
test esi, esi
mov rbx, qword [rsp + 0x48]
jle 0x140027d5f
movsxd r12, dword [r12]
mov r14d, r13d
sub r14d, ebp
imul r14d, esi
add r14d, r12d
mov dword [rsp + 0x50], r14d
mov edx, r12d
cmp r14d, r12d
cmovg edx, r14d
test edx, edx
js 0x140027e48
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140027c27
lea rcx, [rsp + 0x48]
call fcn.140002b00
mov rbx, qword [rsp + 0x48]
mov rdi, rbx
lea r15, [rbx + r12*2]
mov qword [rsp + 0x30], r15
cmp rbx, r15
jae 0x140027d3f
nop dword [rax]
lea rdx, str.prolasso.ini
mov rcx, rdi
call fcn.1400407c8
mov rsi, rax
test rax, rax
je 0x140027d20
movsxd rcx, ebp
lea rax, [rcx + rcx]
mov qword [rsp + 0x40], rax
movsxd rcx, r13d
lea r15, [rcx + rcx]
nop
mov rcx, rsi
sub rcx, rbx
sar rcx, 1
mov r14d, r12d
sub r14d, ecx
sub r14d, ebp
movsxd r8, r14d
add r8, r8
lea rdx, [rax + rsi]
lea rdi, [r15 + rsi]
je 0x140027cac
test rdi, rdi
je 0x140027e38
test rdx, rdx
je 0x140027e38
mov rcx, rdi
call fcn.14005f680
test r15, r15
je 0x140027ccc
test rsi, rsi
je 0x140027e38
mov r8, r15
lea rdx, [0x14006cce4]
mov rcx, rsi
call fcn.14005f680
lea eax, [r14 + r13]
movsxd rcx, eax
xor r14d, r14d
mov word [rsi + rcx*2], r14w
mov eax, r13d
sub eax, ebp
add r12d, eax
lea rdx, str.prolasso.ini
mov rcx, rdi
call fcn.1400407c8
mov rsi, rax
test rax, rax
mov rax, qword [rsp + 0x40]
jne 0x140027c70
mov r15, qword [rsp + 0x30]
test rdi, rdi
je 0x140027d25
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x140027d14
jmp 0x140027d28
xor r14d, r14d
jmp 0x140027d08
mov eax, r14d
inc eax
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
cmp rdi, r15
jb 0x140027c40
mov r14d, dword [rsp + 0x50]
test r14d, r14d
js 0x140027e48
cmp r14d, dword [rbx - 0xc]
jg 0x140027e48
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rbx + rax*2], cx
mov rsi, 0xffffffffffffffff
mov rdi, qword [rsp + 0x38]
lea rbp, str.config
cmp dword [rbx - 0x10], 0
jl 0x140027d93
mov rdx, rbp
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x140027d93
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140027dbe
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbp + r8*2], 0
jne 0x140027da0
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140002b60
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x140027dd6
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rsp + 0x20], rbx
lea r9, str.ConfigFolderEx
mov rdx, rdi
call fcn.1400124c0
movzx edi, al
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140027e05
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003f1d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x48]
jmp 0x140027d6b
call fcn.14004b500
mov dword [rax], 0x16
call fcn.14004b3dc
mov ecx, 0x80070057
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3