Function at 0x1400a5b90
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, r8
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareSimonTathamPuTTYJumplist
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, 2
test eax, eax
jne 0x1400a5e44
lea rdi, [rsp + 0x50]
mov dword [rdi], 0xc8
mov ecx, 0xc8
mov edx, 1
call fcn.14004723d
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea rdx, str.Recent_sessions
lea r9, [rsp + 0x54]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x1400a5c87
mov rcx, rbx
call fcn.140047430
mov ecx, dword [rsp + 0x50]
mov edx, 1
call fcn.14004723d
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea rdx, str.Recent_sessions
lea r9, [rsp + 0x54]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1400a5c9b
cmp eax, 2
jne 0x1400a5d4a
mov word [rbx], 0
jmp 0x1400a5ca6
cmp dword [rsp + 0x54], 7
jne 0x1400a5d30
mov eax, dword [rsp + 0x50]
cmp eax, 1
jne 0x1400a5cb5
xor eax, eax
xor ecx, ecx
jmp 0x1400a5cd6
dec eax
lea rdx, [rbx + 1]
xor ecx, ecx
cmp byte [rdx - 1], 0
jne 0x1400a5cc8
cmp byte [rdx], 0
je 0x1400a5cd6
mov rcx, rdx
sub rcx, rbx
inc rdx
cmp rcx, rax
jl 0x1400a5cbd
cmp rcx, rax
jl 0x1400a5ce0
mov word [rbx], 0
mov bpl, 1
mov rax, rsi
or rax, r12
je 0x1400a5d28
test rsi, rsi
mov edi, dword [rsp + 0x50]
je 0x1400a5d67
mov rcx, rsi
call fcn.1400b93d0
lea rcx, [rdi + rax + 1]
mov edx, 1
call fcn.14004723d
mov r15, rax
mov rcx, r15
mov rdx, rsi
call fcn.1400b9020
mov rcx, r15
call fcn.1400b93d0
lea rsi, [r15 + rax + 1]
jmp 0x1400a5d7a
mov r15, rbx
jmp 0x1400a5e16
mov rcx, qword [rsp + 0x58]
lea rdx, str.Recent_sessions
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1400a5c94
mov rcx, rbx
call fcn.140047430
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 3
jmp 0x1400a5e44
mov edx, 1
mov rcx, rdi
call fcn.14004723d
mov r15, rax
mov rsi, r15
cmp byte [rbx], 0
je 0x1400a5dda
mov r13, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rbx
test r12, r12
je 0x1400a5d9d
mov rcx, rdi
mov rdx, r12
call fcn.1400b90f0
test eax, eax
je 0x1400a5dc8
mov rcx, rdi
call fcn.1400a4cd0
test rax, rax
je 0x1400a5dc8
mov rcx, rax
call r13
mov rcx, rsi
mov rdx, rdi
call fcn.1400b9020
mov rcx, rsi
call fcn.1400b93d0
lea rsi, [rsi + rax + 1]
mov rcx, rdi
call fcn.1400b93d0
lea rdi, [rdi + rax + 1]
cmp byte [rdi], 0
jne 0x1400a5d89
mov byte [rsi], 0
inc esi
sub esi, r15d
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea rdx, str.Recent_sessions
xor r8d, r8d
mov r9d, 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov rcx, rbx
call fcn.140047430
test esi, esi
sete bpl
test r14, r14
je 0x1400a5e25
test bpl, bpl
je 0x1400a5e25
mov qword [r14], r15
jmp 0x1400a5e2d
mov rcx, r15
call fcn.140047430
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
test bpl, bpl
sete dil
shl edi, 2
mov rcx, qword [rsp + 0x60]
call fcn.1400a8e70
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret