Function at 0x406870
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x38
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
push edi
call sub.msvcrt.dll_strlen
pop ecx
pop esi
mov dword [ebp - 0x34], eax
inc eax
mov dword [ebp - 0x38], eax
push 1
push eax
call fcn.004094f0
mov dword [ebp - 0x30], eax
pop eax
pop edx
push 1
mov edi, dword [ebp + 0x10]
push edi
call sub.msvcrt.dll_strlen
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_strlen
lea eax, [esi + eax]
lea eax, [eax + eax*2 + 0xf]
mov dword [esp], eax
call fcn.004094f0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov edx, ebx
pop esi
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00406770
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
pop edx
test eax, eax
je 0x406900
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push edi
push edi
push ecx
mov esi, dword [ebp - 0x30]
lea edi, [ebp - 0x18]
push esi
push edi
push 0
mov ebx, dword [ebp - 0x2c]
push ebx
mov ecx, dword [ebp - 0x10]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
pop eax
test ebx, ebx
pop edx
je 0x406a00
cmp ebx, 0xea
je 0x406a00
mov edx, 0x41d5bb
mov eax, 4
cld
mov esi, dword [ebp + 0x10]
mov edi, edx
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x406a00
mov ebx, dword [ebp - 0x2c]
push eax
push eax
push 0x41d5bf
mov edi, dword [ebp - 0x2c]
inc ebx
push edi
call sub.msvcrt.dll_strcspn
pop ecx
pop esi
push 1
add ebx, eax
mov eax, dword [ebp - 0x34]
lea edi, [ebp - 0x18]
add eax, 0xb
push eax
call fcn.004094f0
mov esi, eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
pop eax
pop edx
push ecx
push esi
push edi
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
pop ebx
test eax, eax
pop edi
mov ebx, eax
jne 0x406a00
cmp dword [ebp - 0x18], 1
je 0x406a5d
sub esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x14
mov esi, eax
mov eax, dword [ebp - 0x30]
push eax
call fcn.004093f0
pop eax
mov edi, dword [ebp - 0x2c]
push edi
call fcn.004093f0
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x406a49
dec eax
setne al
and eax, 0xff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 0xc
mov edi, dword [ebp + 0x14]
push edi
mov esi, dword [ebp - 0x30]
push esi
call sub.msvcrt.dll_strcmp
add esp, 0x14
mov ecx, dword [ebp - 0x30]
mov esi, eax
push ecx
call fcn.004093f0
pop edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004093f0
add esp, 0x10
cmp ebx, 0xea
je 0x406a50
test ebx, ebx
jne 0x4068ec
jmp 0x4069e3
test esi, esi
je 0x4069eb
lea esi, [esi]
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x28], 0
lea eax, [edi + 2]
mov byte [edi], 0x30
mov byte [edi + 1], 0x78
mov dword [ebp - 0x20], eax
push ecx
push ecx
push 0x41d5c1
push esi
call sub.msvcrt.dll_strcspn
add esp, 0x10
mov dword [ebp - 0x24], eax
mov ebx, eax
lea edx, [ebx - 1]
mov eax, edx
xor eax, 3
cmp byte [eax + esi], 0x30
je 0x406b30
test ebx, ebx
jle 0x406ab5
lea edx, [edi + edx]
xor ecx, ecx
mov eax, ecx
inc ecx
xor eax, 3
mov al, byte [eax + esi]
mov byte [edx + 2], al
dec edx
cmp ecx, ebx
jne 0x406aa4
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
sar eax, 0x1f
mov edi, dword [ebp - 0x20]
shr eax, 0x1e
add edi, ebx
add eax, edx
and eax, 0xfffffffc
add esi, eax
cmp byte [esi], 0
je 0x406ad7
mov byte [edi], 0x2c
inc esi
inc edi
mov byte [edi], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jne 0x406a67
push edi
push edi
mov esi, dword [ebp + 0x14]
push esi
mov ebx, dword [ebp - 0x30]
push ebx
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x4069ac
sub esp, 0xc
mov ecx, dword [ebp - 0x30]
push ecx
call sub.msvcrt.dll_strlen
pop edi
inc eax
pop edx
push eax
mov esi, dword [ebp - 0x30]
push esi
push 1
push 0
mov ebx, dword [ebp - 0x2c]
push ebx
mov ecx, dword [ebp - 0x10]
push ecx
call sub.ADVAPI32.DLL_RegSetValueExA
pop eax
pop edx
jmp 0x4069ac
cmp ebx, 1
jle 0x406a9b
mov ebx, edx
jmp 0x406a89