Function at 0x14001a8c0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r13, r9
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x1400c5038]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, r9
call fcn.14007fac0
mov rbp, rax
call fcn.140016610
mov r14, rax
lea rcx, [rax + 0x18]
lea rdx, str._s__d:
mov r8, rsi
mov r9d, ebx
call fcn.140015c70
mov rcx, rdi
mov rdx, r14
call fcn.140036480
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14001a94d
mov rcx, r14
call fcn.140016710
mov esi, 1
jmp 0x14001acb8
lea edi, [rbp + 1]
mov dword [rsp + 0x54], edi
movsxd rcx, edi
mov edx, 1
xor r8d, r8d
call fcn.140016170
mov r12, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x58]
lea r15, [rsp + 0x54]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [rsp + 0x3c], eax
je 0x14001ac5e
cmp eax, 0xea
je 0x14001ac5e
lea rdx, [0x1400b12ff]
mov rcx, rsi
call fcn.14007ef70
test eax, eax
jne 0x14001ac5e
mov rsi, qword [r14]
lea rdx, [0x1400b2cb1]
mov rcx, rsi
call fcn.14007f150
add rsi, rax
add rsi, 1
add ebp, 0xb
movsxd rcx, ebp
mov edx, 1
xor r8d, r8d
call fcn.140016170
mov rbx, rax
mov dword [rsp + 0x54], edi
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x3c], eax
test eax, eax
jne 0x14001ac56
cmp dword [rsp + 0x50], 1
jne 0x14001ac56
mov rax, qword [rsp + 0x40]
mov word [rax], 0x7830
lea rdx, [0x1400b3c6d]
mov rcx, rbx
call fcn.14007f150
lea r9d, [rax - 1]
mov r10d, eax
add r10, 1
movsxd r8, eax
lea rdx, [r8 - 1]
xor esi, esi
nop word cs:[rax + rax]
mov ecx, esi
lea ebp, [rdx + rcx]
movsxd rbp, ebp
xor rbp, 3
add rsi, 0xffffffffffffffff
cmp byte [rbx + rbp], 0x30
jne 0x14001aa7d
add ecx, eax
cmp ecx, 1
jg 0x14001aa60
lea r11d, [rax + 3]
test eax, eax
cmovns r11d, eax
sar r11d, 2
add rax, rsi
lea ecx, [rax + 1]
test ecx, ecx
jle 0x14001aaf5
add r10, rsi
add r9, r12
test eax, eax
je 0x14001aadc
lea rdx, [rsi + r9]
add rdx, 3
mov edi, r10d
and edi, 0xfffffffe
xor ebp, ebp
nop
mov eax, ebp
and eax, 0xfffffffe
mov rcx, rax
xor rcx, 3
movzx ecx, byte [rbx + rcx]
mov byte [rdx], cl
xor rax, 2
movzx eax, byte [rbx + rax]
mov byte [rdx - 1], al
add rbp, 2
add rdx, 0xfffffffffffffffe
cmp rdi, rbp
jne 0x14001aab0
jmp 0x14001aade
xor ebp, ebp
test r10b, 1
je 0x14001aaf5
mov eax, ebp
xor rax, 3
mov al, byte [rbx + rax]
sub r9, rbp
mov byte [r9 + rsi + 3], al
add r12, r8
movsxd rax, r11d
lea rbp, [rbx + rax*4]
cmp byte [rbx + rax*4], 0
mov qword [rsp + 0x48], rbx
je 0x14001ab1e
add rbp, 1
lea r15, [rsi + r12]
add r15, 4
mov byte [r12 + rsi + 3], 0x2c
jmp 0x14001ab26
lea r15, [rsi + r12]
add r15, 3
mov word [r15], 0x7830
lea rdx, [0x1400b3c6d]
mov rcx, rbp
call fcn.14007f150
lea r9d, [rax - 1]
mov r10d, eax
add r10, 1
movsxd r8, eax
lea rdx, [r8 - 1]
xor esi, esi
nop
mov ecx, esi
lea ebx, [rdx + rcx]
movsxd rbx, ebx
xor rbx, 3
add rsi, 0xffffffffffffffff
cmp byte [rbp + rbx], 0x30
jne 0x14001ab6e
add ecx, eax
cmp ecx, 1
jg 0x14001ab50
lea r11d, [rax + 3]
test eax, eax
cmovns r11d, eax
sar r11d, 2
add rax, rsi
lea ecx, [rax + 1]
test ecx, ecx
jle 0x14001abe8
add r10, rsi
add r9, r15
test eax, eax
je 0x14001abce
lea rdi, [rsi + r9]
add rdi, 3
mov ebx, r10d
and ebx, 0xfffffffe
xor edx, edx
mov eax, edx
and eax, 0xfffffffe
mov rcx, rax
xor rcx, 3
movzx ecx, byte [rbp + rcx]
mov byte [rdi], cl
xor rax, 2
movzx eax, byte [rbp + rax]
mov byte [rdi - 1], al
add rdx, 2
add rdi, 0xfffffffffffffffe
cmp rbx, rdx
jne 0x14001aba0
jmp 0x14001abd0
xor edx, edx
test r10b, 1
je 0x14001abe8
mov eax, edx
xor rax, 3
mov al, byte [rbp + rax]
sub r9, rdx
mov byte [r9 + rsi + 3], al
add r15, r8
movsxd rax, r11d
cmp byte [rbp + rax*4], 0
je 0x14001ac05
lea rax, [rsi + r15]
add rax, 4
mov byte [r15 + rsi + 3], 0x2c
jmp 0x14001ac0d
lea rax, [rsi + r15]
add rax, 3
mov rbx, qword [rsp + 0x48]
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, r13
call fcn.14007ef70
test eax, eax
jne 0x14001ac56
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14007fac0
add eax, 1
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.140016210
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, r13
call fcn.14007ef70
mov ebx, eax
mov rcx, rsi
call fcn.140016210
mov rcx, r14
call fcn.140016710
mov esi, 2
mov ecx, dword [rsp + 0x3c]
cmp ecx, 0xea
je 0x14001acb8
mov eax, dword [rsp + 0x50]
test ecx, ecx
jne 0x14001acad
cmp eax, 1
jne 0x14001acad
test ebx, ebx
jne 0x14001acb8
xor eax, 1
xor esi, esi
or ecx, eax
setne sil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14006cf60
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret