Function at 0x1400a534b
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r14, r9
mov rsi, r8
mov ebp, edx
mov rdi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x70], rax
mov rcx, r14
call fcn.1400b93d0
mov r15, rax
mov rcx, rdi
call fcn.1400b93d0
mov rbx, rax
mov rcx, rsi
call fcn.1400b93d0
add rax, rbx
lea rcx, [rax + rax*2 + 0xf]
mov edx, 1
call fcn.14004723d
mov rbx, rax
mov rcx, rbx
mov rdx, rdi
mov r8d, ebp
mov r9, rsi
call fcn.1400a565f
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
lea r8, [rsp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1400a53e5
mov rcx, rbx
call fcn.140047430
mov esi, 1
jmp 0x1400a5642
inc r15
lea rdi, [rsp + 0x64]
mov dword [rdi], r15d
movsxd rcx, r15d
mov edx, 1
call fcn.14004723d
mov r12, rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
test ebp, ebp
je 0x1400a55f1
cmp ebp, 0xea
je 0x1400a55f1
lea rdx, [0x14000ad8e]
mov rcx, rsi
call fcn.1400b90f0
test eax, eax
jne 0x1400a55f1
mov rsi, r15
shl rsi, 0x20
lea rdx, [0x14000eaf9]
mov rcx, rbx
call fcn.1400b9158
lea rbp, [rbx + rax + 1]
movabs rcx, 0xa00000000
add rcx, rsi
sar rcx, 0x20
mov edx, 1
call fcn.14004723d
mov rsi, rax
mov dword [rsp + 0x64], r15d
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
test ebp, ebp
jne 0x1400a55e9
cmp dword [rsp + 0x60], 1
jne 0x1400a55e9
mov dword [rsp + 0x3c], ebp
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r14
xor r15d, r15d
movabs r13, 0x100000000
mov qword [rsp + 0x40], rsi
mov r14, rsi
mov qword [rsp + 0x48], r12
mov word [r12], 0x7830
mov rcx, r14
lea rdx, [0x14000984a]
call fcn.1400b9158
movsxd rcx, eax
lea rdi, [r12 + rcx + 1]
mov ebp, ecx
mov ecx, eax
mov r8d, ecx
mov rdx, rdi
mov rsi, rbp
cmp r8d, 2
jl 0x1400a5534
lea ecx, [r8 - 1]
mov ebx, ecx
xor ebx, 3
movsxd rbx, ebx
lea rdi, [rdx - 1]
lea rbp, [rsi - 1]
cmp byte [r14 + rbx], 0x30
je 0x1400a550a
add r12, 2
mov edi, eax
sar edi, 0x1f
shr edi, 0x1e
add edi, eax
sar edi, 2
test r8d, r8d
jle 0x1400a5568
xor eax, eax
mov rcx, rax
sar rcx, 0x20
xor rcx, 3
mov cl, byte [r14 + rcx]
mov byte [rdx], cl
add rax, r13
dec rdx
dec rsi
jne 0x1400a554c
movsxd rax, r8d
add r12, rax
movsxd rax, edi
lea r14, [r14 + rax*4]
cmp byte [r14], 0
je 0x1400a5586
inc r14
mov byte [r12], 0x2c
inc r12
mov byte [r12], 0
inc r15d
cmp r15d, 2
jne 0x1400a54e8
mov r12, qword [rsp + 0x48]
mov rcx, r12
mov r14, qword [rsp + 0x58]
mov rdx, r14
call fcn.1400b90f0
test eax, eax
mov rbx, qword [rsp + 0x50]
mov ebp, dword [rsp + 0x3c]
mov rsi, qword [rsp + 0x40]
jne 0x1400a55e9
mov rcx, r12
call fcn.1400b93d0
inc eax
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov r9d, 1
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rsi
call fcn.140047430
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
mov rdx, r14
call fcn.1400b90f0
mov edi, eax
mov rcx, r12
call fcn.140047430
mov rcx, rbx
call fcn.140047430
mov esi, 2
cmp ebp, 0xea
je 0x1400a5642
mov eax, dword [rsp + 0x60]
test edi, edi
je 0x1400a5637
test ebp, ebp
jne 0x1400a5637
cmp eax, 1
je 0x1400a5642
xor eax, 1
xor esi, esi
or ebp, eax
setne sil
mov rcx, qword [rsp + 0x70]
call fcn.1400a8e70
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret