Function at 0x453620
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x1c
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453630
push ebx
push ebp
push esi
push edi
sub eax, edx
lea ebx, [eax + 1]
push 1
push ebx
call fcn.0040c6e0
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, ebp
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453658
mov edi, dword [esp + 0x38]
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453670
sub eax, esi
lea eax, [eax + edx + 5]
lea eax, [eax + eax*2]
push 1
push eax
call fcn.0040c6e0
mov ecx, dword [esp + 0x3c]
mov esi, eax
push ecx
push ebp
mov eax, edi
mov dword [esp + 0x2c], esi
call fcn.004535b0
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4536c4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push esi
push eax
mov dword [esp + 0x30], ebx
call ebp
mov dword [esp + 0x28], eax
test eax, eax
je 0x453872
cmp eax, 0xea
je 0x453872
mov ecx, 0x46f578
mov eax, edi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x453730
test dl, dl
je 0x45372c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x453730
add eax, 2
add ecx, 2
test dl, dl
jne 0x453710
xor eax, eax
jmp 0x453735
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x453872
push 0x471d54
push esi
call fcn.00459820
lea ecx, [ebx + 0xa]
push 1
push ecx
lea esi, [eax + esi + 1]
call fcn.0040c6e0
mov ecx, dword [esp + 0x24]
add esp, 0x10
lea edx, [esp + 0x18]
push edx
mov edi, eax
push edi
lea eax, [esp + 0x28]
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], ebx
call ebp
mov dword [esp + 0x28], eax
test eax, eax
jne 0x453872
cmp dword [esp + 0x20], 1
jne 0x453872
mov ebp, dword [esp + 0x10]
mov ebx, ebp
mov dword [esp + 0x24], 2
lea ebx, [ebx]
mov byte [ebx], 0x30
inc ebx
push 0x46ef80
mov byte [ebx], 0x78
push edi
inc ebx
call fcn.00459820
mov ecx, eax
cdq
and edx, 3
add eax, edx
lea edx, [ecx - 1]
mov esi, edx
xor esi, 3
add esp, 8
sar eax, 2
cmp byte [esi + edi], 0x30
jne 0x4537e2
nop
cmp ecx, 1
jle 0x4537e2
dec edx
mov esi, edx
xor esi, 3
dec ecx
cmp byte [esi + edi], 0x30
je 0x4537d0
xor esi, esi
test ecx, ecx
jle 0x453805
lea ebp, [ecx + ebx - 1]
lea esp, [esp]
mov edx, esi
xor edx, 3
mov dl, byte [edx + edi]
mov byte [ebp], dl
inc esi
dec ebp
cmp esi, ecx
jl 0x4537f0
mov ebp, dword [esp + 0x10]
lea edi, [edi + eax*4]
add ebx, ecx
cmp byte [edi], 0
je 0x453814
inc edi
mov byte [ebx], 0x2c
inc ebx
sub dword [esp + 0x24], 1
mov byte [ebx], 0
jne 0x4537a0
mov ecx, dword [esp + 0x3c]
mov eax, ebp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x453844
test dl, dl
je 0x453840
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x453844
add eax, 2
add ecx, 2
test dl, dl
jne 0x453824
xor eax, eax
jmp 0x453849
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x453872
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x453852
mov ecx, dword [esp + 0x14]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x20]
push ebp
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4538a5
test dl, dl
je 0x4538a1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4538a5
add eax, 2
add ecx, 2
test dl, dl
jne 0x453885
xor esi, esi
jmp 0x4538aa
sbb esi, esi
sbb esi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.0040c850
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040c850
mov eax, dword [esp + 0x30]
add esp, 8
cmp eax, 0xea
je 0x4538eb
test eax, eax
jne 0x4536b7
cmp dword [esp + 0x20], 1
jne 0x4536b7
test esi, esi
jne 0x4538eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x1c
ret