Function at 0x14003f548
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
mov r13, r8
mov rcx, r9
mov edi, edx
call fcn.14004bdc0
mov r14d, 1
mov rcx, rsi
lea r12d, [r14 + rax]
call fcn.14004bdc0
mov rcx, r13
mov rbx, rax
call fcn.14004bdc0
mov edx, r14d
lea rcx, [rax + 5]
add rcx, rbx
lea rcx, [rcx + rcx*2]
call fcn.140039714
mov r9, r13
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov r15, rax
call fcn.14003ef10
lea r8, [rbp - 8]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14003f5eb
mov rcx, r15
call fcn.140039700
mov eax, r14d
jmp 0x14003f7f4
movsxd rcx, r12d
mov rdx, r14
mov dword [rbp - 0x10], r12d
call fcn.140039714
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0xc]
mov rsi, rax
xor r8d, r8d
lea rax, [rbp - 0x10]
mov rdx, r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test eax, eax
je 0x14003f7a1
cmp eax, 0xea
je 0x14003f7a1
lea rdx, [0x140069b94]
mov rcx, r13
call fcn.14004bd40
test eax, eax
jne 0x14003f7a1
lea rdx, [0x14006a840]
mov rcx, r15
call fcn.1400527dc
mov edx, 1
lea rbx, [rax + 1]
lea eax, [r12 + 0xa]
movsxd rcx, eax
call fcn.140039714
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0xc]
mov r13, rax
mov dword [rbp - 0x10], r12d
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, [rbx + r15]
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test eax, eax
jne 0x14003f793
cmp dword [rbp - 0xc], 1
jne 0x14003f793
mov rbx, rsi
lea r12d, [rax + 2]
mov rdi, r13
mov word [rbx], 0x7830
lea rdx, [0x140067590]
mov rcx, rdi
add rbx, 2
call fcn.1400527dc
mov r8, rax
cdq
and edx, 3
lea r10d, [rdx + rax]
sar r10d, 2
lea edx, [r8 - 1]
jmp 0x14003f6f2
cmp r8d, 1
jle 0x14003f6ff
mov r8d, edx
dec edx
movsxd rcx, edx
xor rcx, 3
cmp byte [rcx + rdi], 0x30
je 0x14003f6e7
xor r9d, r9d
movsxd rcx, r8d
test r8d, r8d
jle 0x14003f72c
lea rdx, [rbx - 1]
mov r8, rcx
add rdx, rcx
movsxd rax, r9d
inc r9d
xor rax, 3
mov al, byte [rax + rdi]
mov byte [rdx], al
dec rdx
sub r8, 1
jne 0x14003f714
add rbx, rcx
mov eax, r10d
shl eax, 2
movsxd rcx, eax
add rdi, rcx
cmp byte [rdi], 0
je 0x14003f749
inc rdi
mov byte [rbx], 0x2c
inc rbx
mov byte [rbx], 0
sub r12, 1
jne 0x14003f6ba
mov rbx, qword [rbp + 0x48]
mov rcx, rsi
mov rdx, rbx
call fcn.14004bd40
test eax, eax
jne 0x14003f797
mov rcx, rsi
call fcn.14004bdc0
mov rcx, qword [rbp - 8]
lea r9d, [r12 + 1]
inc eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14003f797
mov rbx, qword [rbp + 0x48]
mov rcx, r13
call fcn.140039700
jmp 0x14003f7a5
mov rbx, qword [rbp + 0x48]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
mov rcx, rsi
call fcn.14004bd40
mov rcx, rsi
mov ebx, eax
call fcn.140039700
mov rcx, r15
call fcn.140039700
cmp r14d, 0xea
je 0x14003f7ef
test r14d, r14d
jne 0x14003f7e8
cmp dword [rbp - 0xc], 1
jne 0x14003f7e8
test ebx, ebx
jne 0x14003f7ef
xor eax, eax
jmp 0x14003f7f4
mov eax, 1
jmp 0x14003f7f4
mov eax, 2
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret