Function at 0x14003b4f0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r13, r9
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140102058]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, r9
call fcn.1400b6330
mov rbp, rax
call fcn.140041ca0
mov r14, rax
lea rcx, [rax + 0x18]
lea rdx, str._s__d:
mov r8, rsi
mov r9d, ebx
call fcn.1400411b0
mov rcx, rdi
mov rdx, r14
call fcn.14006f4b0
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14003b57d
mov rcx, r14
call fcn.140041da0
mov esi, 1
jmp 0x14003b8e8
lea edi, [rbp + 1]
mov dword [rsp + 0x54], edi
movsxd rcx, edi
mov edx, 1
xor r8d, r8d
call fcn.1400416b0
mov r12, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x58]
lea r15, [rsp + 0x54]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [rsp + 0x3c], eax
je 0x14003b88e
cmp eax, 0xea
je 0x14003b88e
lea rdx, [0x1400ea475]
mov rcx, rsi
call fcn.1400b5950
test eax, eax
jne 0x14003b88e
mov rsi, qword [r14]
lea rdx, [0x1400ec902]
mov rcx, rsi
call fcn.1400b59c0
add rsi, rax
add rsi, 1
add ebp, 0xb
movsxd rcx, ebp
mov edx, 1
xor r8d, r8d
call fcn.1400416b0
mov rbx, rax
mov dword [rsp + 0x54], edi
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x3c], eax
test eax, eax
jne 0x14003b886
cmp dword [rsp + 0x50], 1
jne 0x14003b886
mov rax, qword [rsp + 0x40]
mov word [rax], 0x7830
lea rdx, [0x1400edae2]
mov rcx, rbx
call fcn.1400b59c0
lea r9d, [rax - 1]
mov r10d, eax
add r10, 1
movsxd r8, eax
lea rdx, [r8 - 1]
xor esi, esi
nop word cs:[rax + rax]
mov ecx, esi
lea ebp, [rdx + rcx]
movsxd rbp, ebp
xor rbp, 3
add rsi, 0xffffffffffffffff
cmp byte [rbx + rbp], 0x30
jne 0x14003b6ad
add ecx, eax
cmp ecx, 1
jg 0x14003b690
lea r11d, [rax + 3]
test eax, eax
cmovns r11d, eax
sar r11d, 2
add rax, rsi
lea ecx, [rax + 1]
test ecx, ecx
jle 0x14003b725
add r10, rsi
add r9, r12
test eax, eax
je 0x14003b70c
lea rdx, [rsi + r9]
add rdx, 3
mov edi, r10d
and edi, 0xfffffffe
xor ebp, ebp
nop
mov eax, ebp
and eax, 0xfffffffe
mov rcx, rax
xor rcx, 3
movzx ecx, byte [rbx + rcx]
mov byte [rdx], cl
xor rax, 2
movzx eax, byte [rbx + rax]
mov byte [rdx - 1], al
add rbp, 2
add rdx, 0xfffffffffffffffe
cmp rdi, rbp
jne 0x14003b6e0
jmp 0x14003b70e
xor ebp, ebp
test r10b, 1
je 0x14003b725
mov eax, ebp
xor rax, 3
mov al, byte [rbx + rax]
sub r9, rbp
mov byte [r9 + rsi + 3], al
add r12, r8
movsxd rax, r11d
lea rbp, [rbx + rax*4]
cmp byte [rbx + rax*4], 0
mov qword [rsp + 0x48], rbx
je 0x14003b74e
add rbp, 1
lea r15, [rsi + r12]
add r15, 4
mov byte [r12 + rsi + 3], 0x2c
jmp 0x14003b756
lea r15, [rsi + r12]
add r15, 3
mov word [r15], 0x7830
lea rdx, [0x1400edae2]
mov rcx, rbp
call fcn.1400b59c0
lea r9d, [rax - 1]
mov r10d, eax
add r10, 1
movsxd r8, eax
lea rdx, [r8 - 1]
xor esi, esi
nop
mov ecx, esi
lea ebx, [rdx + rcx]
movsxd rbx, ebx
xor rbx, 3
add rsi, 0xffffffffffffffff
cmp byte [rbp + rbx], 0x30
jne 0x14003b79e
add ecx, eax
cmp ecx, 1
jg 0x14003b780
lea r11d, [rax + 3]
test eax, eax
cmovns r11d, eax
sar r11d, 2
add rax, rsi
lea ecx, [rax + 1]
test ecx, ecx
jle 0x14003b818
add r10, rsi
add r9, r15
test eax, eax
je 0x14003b7fe
lea rdi, [rsi + r9]
add rdi, 3
mov ebx, r10d
and ebx, 0xfffffffe
xor edx, edx
mov eax, edx
and eax, 0xfffffffe
mov rcx, rax
xor rcx, 3
movzx ecx, byte [rbp + rcx]
mov byte [rdi], cl
xor rax, 2
movzx eax, byte [rbp + rax]
mov byte [rdi - 1], al
add rdx, 2
add rdi, 0xfffffffffffffffe
cmp rbx, rdx
jne 0x14003b7d0
jmp 0x14003b800
xor edx, edx
test r10b, 1
je 0x14003b818
mov eax, edx
xor rax, 3
mov al, byte [rbp + rax]
sub r9, rdx
mov byte [r9 + rsi + 3], al
add r15, r8
movsxd rax, r11d
cmp byte [rbp + rax*4], 0
je 0x14003b835
lea rax, [rsi + r15]
add rax, 4
mov byte [r15 + rsi + 3], 0x2c
jmp 0x14003b83d
lea rax, [rsi + r15]
add rax, 3
mov rbx, qword [rsp + 0x48]
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, r13
call fcn.1400b5950
test eax, eax
jne 0x14003b886
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400b6330
add eax, 1
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.140041750
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, r13
call fcn.1400b5950
mov ebx, eax
mov rcx, rsi
call fcn.140041750
mov rcx, r14
call fcn.140041da0
mov esi, 2
mov ecx, dword [rsp + 0x3c]
cmp ecx, 0xea
je 0x14003b8e8
mov eax, dword [rsp + 0x50]
test ecx, ecx
jne 0x14003b8dd
cmp eax, 1
jne 0x14003b8dd
test ebx, ebx
jne 0x14003b8e8
xor eax, 1
xor esi, esi
or ecx, eax
setne sil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a5f20
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret