Function at 0x406300
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x38
mov esi, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x10]
push 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareSimonTathamPuTTYJumplist
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov edx, 2
add esp, 0xc
test eax, eax
je 0x406350
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x18], 0xc8
push ebx
push ebx
push 1
push 0xc8
call fcn.004094f0
mov dword [ebp - 0x24], eax
lea edi, [ebp - 0x18]
pop edx
lea ebx, [ebp - 0x14]
pop ecx
push edi
push eax
push ebx
push 0
push str.Recent_sessions
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
cmp eax, 0xea
pop ecx
je 0x40652b
cmp eax, 2
je 0x4063c5
test eax, eax
je 0x406563
sub esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
call fcn.004093f0
pop eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 3
add esp, 0xc
mov eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ebx, eax
mov byte [eax], 0
inc ebx
mov byte [eax + 1], 0
mov ecx, dword [ebp - 0x18]
mov edx, ebx
dec ecx
test ecx, ecx
jle 0x4063f7
lea esi, [esi]
mov eax, edx
cmp byte [edx - 1], 0
jne 0x4063ed
cmp byte [edx], 0
je 0x406400
mov edi, dword [ebp - 0x24]
inc edx
sub eax, edi
cmp eax, ecx
jl 0x4063e0
mov eax, dword [ebp - 0x24]
mov byte [eax], 0
mov byte [ebx], 0
mov edx, dword [ebp - 0x28]
xor ebx, ebx
or edx, esi
je 0x4064f4
test esi, esi
je 0x406572
push edi
push edi
push 1
push esi
call sub.msvcrt.dll_strlen
mov ebx, dword [ebp - 0x18]
inc eax
add eax, ebx
mov dword [esp], eax
call fcn.004094f0
mov dword [ebp - 0x20], eax
pop edx
pop ecx
push esi
push eax
call sub.msvcrt.dll_strcpy
pop eax
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x20]
push eax
call sub.msvcrt.dll_strlen
inc ebx
add esp, 0x10
lea edi, [ebx + eax]
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0
je 0x4064bb
mov esi, eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x406471
push eax
push eax
mov eax, dword [ebp - 0x28]
push eax
push esi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
je 0x4064a4
sub esp, 0xc
push esi
call fcn.00406250
add esp, 0x10
test eax, eax
je 0x4064a4
sub esp, 0xc
push eax
call fcn.00405ac0
pop ebx
pop eax
push esi
push edi
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea ebx, [edi + 1]
add esp, 0x10
lea edi, [ebx + eax]
sub esp, 0xc
lea ebx, [esi + 1]
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
lea esi, [ebx + eax]
cmp byte [esi], 0
jne 0x406457
mov byte [edi], 0
push ecx
push ecx
lea eax, [edi + 1]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp - 0x20]
push eax
push 7
push 0
push str.Recent_sessions
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov ebx, eax
push eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.004093f0
mov edx, dword [ebp - 0x20]
add esp, 0x10
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4065b8
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
sub esp, 0xc
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp ebx, 1
sbb edx, edx
lea esp, [ebp - 0xc]
xor edx, 0xffffffff
pop ebx
and edx, 4
pop esi
mov eax, edx
pop edi
pop ebp
ret
sub esp, 0xc
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004093f0
pop eax
pop edx
push 1
mov eax, dword [ebp - 0x18]
push eax
call fcn.004094f0
mov dword [ebp - 0x24], eax
pop edx
pop ecx
push edi
push eax
push ebx
push 0
push str.Recent_sessions
mov ebx, dword [ebp - 0x10]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
pop ecx
jmp 0x406390
cmp dword [ebp - 0x14], 7
jne 0x40658c
mov ebx, dword [ebp - 0x24]
inc ebx
jmp 0x4063d2
push esi
push esi
push 1
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.004094f0
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x20], eax
jmp 0x40644d
push edi
push edi
push str.Recent_sessions
mov ebx, dword [ebp - 0x10]
push ebx
call sub.ADVAPI32.DLL_RegDeleteValueA
pop edx
test eax, eax
pop ecx
jne 0x40639d
mov edx, dword [ebp - 0x24]
mov ebx, edx
inc ebx
mov byte [edx], 0
mov byte [edx + 1], 0
jmp 0x4063d2
sub esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
call fcn.004093f0
add esp, 0x10
jmp 0x406507