Function at 0x140038eb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.14003fd50
mov r13, rax
lea rcx, [rax + 0x18]
lea rdx, str._s__d:
mov r8, rdi
mov r9d, esi
call fcn.14003f0d0
mov rcx, rbx
mov rdx, r13
call fcn.140078270
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTYSshHostKeys
xor ecx, ecx
xor edx, edx
mov r8, 0xffffffff80000001
call fcn.140042ce0
test rax, rax
je 0x140038f5e
mov r12, rax
mov rdx, qword [r13]
mov rcx, rax
call fcn.140042fd0
test rax, rax
je 0x140038f6d
mov rsi, rax
mov rcx, r12
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rsi
mov rdx, r14
call fcn.1400ce580
xor edi, edi
test eax, eax
setne dil
add edi, edi
jmp 0x140038f8f
mov rcx, r13
call fcn.14003fe50
mov edi, 1
jmp 0x140038f9f
lea rdx, [0x14010f220]
mov rcx, rdi
call fcn.1400ce580
test eax, eax
je 0x140038fbf
mov rcx, r12
call sub.ADVAPI32.dll_RegCloseKey
mov edi, 1
xor esi, esi
mov rcx, rsi
call fcn.14003f720
mov rcx, r13
call fcn.14003fe50
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b9230
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [r13]
lea rdx, [0x14011321c]
mov rcx, rsi
call fcn.1400ce5f0
lea rdx, [rsi + rax]
add rdx, 1
mov rcx, r12
call fcn.140042fd0
mov rdi, rax
test rax, rax
je 0x140039166
call fcn.14003fd50
mov rbx, rax
mov qword [rsp + 0x28], rax
add rbx, 0x18
lea r15, [0x140105018]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003ec20
lea rdx, [0x14011461e]
mov rcx, rdi
call fcn.1400ce5f0
mov edx, eax
nop word cs:[rax + rax]
nop dword [rax]
lea ecx, [rdx - 1]
movsxd rsi, ecx
xor rsi, 3
cmp byte [rdi + rsi], 0x30
jne 0x140039057
cmp edx, 1
mov edx, ecx
jg 0x140039040
lea esi, [rax + 3]
test eax, eax
cmovns esi, eax
sar esi, 2
lea eax, [rcx + 1]
test eax, eax
jle 0x140039091
nop dword [rax]
movsxd rbp, ecx
mov rax, rbp
xor rax, 3
movzx edx, byte [rdi + rax]
mov rcx, rbx
call fcn.14003ecc0
lea ecx, [rbp - 1]
add ebp, 1
cmp ebp, 1
ja 0x140039070
movsxd rax, esi
lea rsi, [rdi + rax*4]
cmp byte [rdi + rax*4], 0
je 0x1400390ac
add rsi, 1
mov rcx, rbx
mov dl, 0x2c
call fcn.14003ecc0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003ec20
lea rdx, [0x14011461e]
mov rcx, rsi
call fcn.1400ce5f0
mov edx, eax
nop dword [rax + rax]
lea ecx, [rdx - 1]
movsxd rbp, ecx
xor rbp, 3
cmp byte [rsi + rbp], 0x30
jne 0x1400390f7
cmp edx, 1
mov edx, ecx
jg 0x1400390e0
lea ebp, [rax + 3]
test eax, eax
cmovns ebp, eax
sar ebp, 2
lea eax, [rcx + 1]
test eax, eax
jle 0x140039134
nop dword [rax]
movsxd r15, ecx
mov rax, r15
xor rax, 3
movzx edx, byte [rsi + rax]
mov rcx, rbx
call fcn.14003ecc0
lea ecx, [r15 - 1]
add r15d, 1
cmp r15d, 1
ja 0x140039110
movsxd rax, ebp
cmp byte [rsi + rax*4], 0
je 0x140039147
mov rcx, rbx
mov dl, 0x2c
call fcn.14003ecc0
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rbx]
mov rcx, rsi
mov rdx, r14
call fcn.1400ce580
test eax, eax
je 0x14003916a
mov rcx, rbx
call fcn.14003fe50
xor esi, esi
jmp 0x140039184
mov rdx, qword [r13]
mov rcx, r12
mov r8, rsi
call fcn.1400430c0
mov rcx, rbx
call fcn.14003fe90
mov rsi, rax
mov rcx, rdi
call fcn.14003f720
mov rcx, r12
call sub.ADVAPI32.dll_RegCloseKey
test rsi, rsi
jne 0x140038f47
jmp 0x140038f88