Function at 0x42d980
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x1c
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d990
push ebx
push ebp
push esi
sub eax, edx
lea ebx, [eax + 1]
push edi
push ebx
call fcn.00403da0
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, ebp
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d9b6
mov esi, dword [esp + 0x38]
sub eax, edx
mov edx, eax
mov eax, esi
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d9d0
sub eax, edi
lea eax, [eax + edx + 5]
lea eax, [eax + eax*2]
push eax
call fcn.00403da0
mov ecx, dword [esp + 0x38]
mov edi, eax
push ecx
mov eax, esi
push ebp
mov esi, edi
mov dword [esp + 0x28], edi
call fcn.0042d910
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [0x42f00c]
test eax, eax
je 0x42da24
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x10]
mov ebp, dword [0x42f010]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push edi
push eax
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
mov dword [esp + 0x28], eax
je 0x42dbb1
cmp eax, 0xea
je 0x42dbb1
mov esi, dword [esp + 0x38]
mov edi, 0x432898
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x42dbb1
mov esi, dword [esp + 0x1c]
push 0x42fbec
push esi
call dword [0x42f254]
lea edi, [eax + esi + 1]
lea eax, [ebx + 0xa]
push eax
call fcn.00403da0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [esp + 0x28]
push edx
push 0
push edi
push eax
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
mov dword [esp + 0x28], eax
jne 0x42dbb1
cmp dword [esp + 0x20], 1
jne 0x42dbb1
mov edi, dword [esp + 0x10]
mov dword [esp + 0x24], 2
mov byte [edi], 0x30
inc edi
push 0x42f5bc
mov byte [edi], 0x78
push esi
inc edi
call dword [0x42f254]
mov ecx, eax
cdq
and edx, 3
add eax, edx
lea edx, [ecx - 1]
mov ebx, edx
xor ebx, 3
add esp, 8
sar eax, 2
cmp byte [ebx + esi], 0x30
jne 0x42db16
cmp ecx, 1
jle 0x42db16
dec ecx
dec edx
mov ebx, edx
xor ebx, 3
cmp byte [ebx + esi], 0x30
je 0x42db04
xor edx, edx
test ecx, ecx
jle 0x42db31
lea ebp, [ecx + edi - 1]
mov ebx, edx
xor ebx, 3
mov bl, byte [ebx + esi]
inc edx
mov byte [ebp], bl
dec ebp
cmp edx, ecx
jl 0x42db20
lea esi, [esi + eax*4]
mov al, byte [esi]
add edi, ecx
test al, al
je 0x42db41
inc esi
mov byte [edi], 0x2c
inc edi
mov eax, dword [esp + 0x24]
dec eax
mov byte [edi], 0
mov dword [esp + 0x24], eax
jne 0x42dad4
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42db7f
test cl, cl
je 0x42db7b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42db7f
add eax, 2
add esi, 2
test cl, cl
jne 0x42db57
xor eax, eax
jmp 0x42db84
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42dbb1
mov edx, dword [esp + 0x10]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42db91
mov ecx, dword [esp + 0x14]
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x20]
push edx
push 1
push 0
push eax
push ecx
call dword [0x42f008]
mov edx, dword [esp + 0x14]
push edx
call dword [0x42f01c]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x3c]
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42dbee
test cl, cl
je 0x42dbea
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42dbee
add eax, 2
add esi, 2
test cl, cl
jne 0x42dbc6
xor esi, esi
jmp 0x42dbf3
sbb esi, esi
sbb esi, 0xffffffff
push edi
call fcn.00403ec0
mov eax, dword [esp + 0x20]
push eax
call fcn.00403ec0
mov eax, dword [esp + 0x30]
add esp, 8
cmp eax, 0xea
je 0x42dc32
test eax, eax
jne 0x42da17
cmp dword [esp + 0x20], 1
jne 0x42da17
test esi, esi
jne 0x42dc32
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x1c
ret