Function at 0x140089620
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rbx
mov r15, r8
mov qword [rsp + 0x38], rax
mov r14, rdx
mov qword [rsp + 0x30], rbx
lea rdx, str.SoftwareSimonTathamPuTTYJumplist
mov rdi, rcx
mov dword [rsp + 0x28], 0x2001f
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14008968c
lea eax, [rbx + 2]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
ret
xor r8d, r8d
mov qword [rsp + 0x88], rsi
mov ecx, 0xc8
mov dword [rsp + 0x98], 0xc8
lea edx, [r8 + 1]
call fcn.140012100
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
mov rsi, rax
lea rdx, str.Recent_sessions
lea rax, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x140089730
mov rcx, rsi
call fcn.140011ff0
mov ecx, dword [rsp + 0x98]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.140012100
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x50]
mov rsi, rax
lea rdx, str.Recent_sessions
lea rax, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140089773
test eax, eax
jne 0x140089756
cmp dword [rsp + 0x50], 7
je 0x140089776
mov rcx, qword [rsp + 0x58]
lea rdx, str.Recent_sessions
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x140089773
mov rcx, rsi
call fcn.140011ff0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x140089941
mov word [rsi], bx
mov r8d, dword [rsp + 0x98]
mov rcx, rsi
lea eax, [r8 - 1]
mov edx, eax
test eax, eax
je 0x1400897a5
mov rax, rbx
nop
cmp byte [rcx], bl
jne 0x14008979a
cmp byte [rax + rsi + 1], bl
je 0x1400897a5
inc rcx
inc rax
cmp rax, rdx
jl 0x140089790
sub rcx, rsi
cmp rcx, rdx
jl 0x1400897b8
mov word [rsi], bx
mov r8d, dword [rsp + 0x98]
mov qword [rsp + 0x80], rbp
test rdi, rdi
jne 0x1400897e7
test r14, r14
je 0x140089920
mov ecx, r8d
lea edx, [rdi + 1]
xor r8d, r8d
call fcn.140012100
mov rdi, rax
mov rbp, rax
mov rbx, rsi
jmp 0x140089845
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rdi + rcx], bl
jne 0x1400897f0
mov eax, r8d
xor r8d, r8d
inc rax
add rcx, rax
lea edx, [r8 + 1]
call fcn.140012100
mov rdx, rax
mov rbp, rax
sub rdx, rdi
mov rbx, rsi
nop dword [rax]
movzx ecx, byte [rdi]
mov byte [rdx + rdi], cl
lea rdi, [rdi + 1]
test cl, cl
jne 0x140089820
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp], 0
jne 0x140089835
lea rdi, [rbp + 1]
add rdi, rax
cmp byte [rsi], 0
je 0x1400898e8
nop
test r14, r14
je 0x140089877
mov r8, r14
mov rax, rbx
sub r8, rbx
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140089873
inc rax
test ecx, ecx
jne 0x140089860
test edx, edx
je 0x1400898c4
mov rcx, rbx
call fcn.140088f30
test rax, rax
je 0x1400898c4
mov rcx, rax
call fcn.140088c90
mov rdx, rdi
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400898a0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x1400898b5
inc rdi
add rdi, rax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400898d0
inc rbx
add rbx, rax
cmp byte [rbx], 0
jne 0x140089850
mov byte [rdi], 0
lea rdx, str.Recent_sessions
mov rcx, qword [rsp + 0x58]
sub edi, ebp
inc edi
mov r9d, 7
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rsi
mov ebx, eax
call fcn.140011ff0
mov rsi, rbp
mov rbp, qword [rsp + 0x80]
test r15, r15
je 0x14008995b
test ebx, ebx
jne 0x14008995b
mov rcx, qword [rsp + 0x58]
mov qword [r15], rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
ret
mov rcx, rsi
call fcn.140011ff0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14008993f
mov eax, 4
jmp 0x140089941