Function at 0x140055118
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
lea rax, [rbp - 8]
mov qword [r11 - 0x48], rsi
mov r13, r8
mov qword [r11 - 0x50], rax
mov r12, rdx
mov qword [r11 - 0x58], rsi
lea rdx, str.SoftwareSimonTathamPuTTYJumplist
mov r15, rcx
mov dword [rsp + 0x28], 0x2001f
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140055184
lea eax, [rsi + 2]
jmp 0x14005538c
xor r8d, r8d
mov ecx, 0xc8
mov dword [rbp + 0x48], ecx
lea edi, [r8 + 1]
mov edx, edi
call fcn.140008cbc
mov rcx, qword [rbp - 8]
lea r14, str.Recent_sessions
mov rbx, rax
lea r9, [rbp - 0x10]
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x140055207
mov rcx, rbx
call fcn.140008bbc
mov ecx, dword [rbp + 0x48]
xor r8d, r8d
mov edx, edi
call fcn.140008cbc
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov rbx, rax
xor r8d, r8d
lea rax, [rbp + 0x48]
mov rdx, r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140055243
test eax, eax
je 0x14005522c
mov rcx, rbx
call fcn.140008bbc
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14005538c
cmp dword [rbp - 0x10], 7
je 0x140055246
mov rcx, qword [rbp - 8]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x140055210
mov word [rbx], si
mov edx, dword [rbp + 0x48]
mov rcx, rbx
sub edx, edi
je 0x14005526a
mov rax, rsi
cmp byte [rcx], sil
jne 0x14005525f
cmp byte [rax + rbx + 1], sil
je 0x14005526a
add rcx, rdi
add rax, rdi
cmp rax, rdx
jl 0x140055253
sub rcx, rbx
cmp rcx, rdx
jl 0x140055275
mov word [rbx], si
test r15, r15
jne 0x14005528b
test r12, r12
jne 0x140055286
mov edi, esi
jmp 0x140055364
mov rax, rsi
jmp 0x140055296
mov rcx, r15
call fcn.140066d10
add rax, rdi
mov ecx, dword [rbp + 0x48]
xor r8d, r8d
add rcx, rax
mov rdx, rdi
call fcn.140008cbc
mov r14, rax
mov rsi, rax
mov rdi, rbx
test r15, r15
je 0x1400552cf
mov rdx, r15
mov rcx, rax
call fcn.1400842f0
mov rcx, rsi
call fcn.140066d10
lea rsi, [rsi + 1]
add rsi, rax
xor r15d, r15d
cmp byte [rbx], r15b
je 0x14005532c
test r12, r12
je 0x1400552eb
mov rdx, r12
mov rcx, rdi
call fcn.140081540
test eax, eax
je 0x140055319
mov rcx, rdi
call fcn.140054b28
test rax, rax
je 0x140055319
mov rcx, rax
call fcn.1400548b4
mov rdx, rdi
mov rcx, rsi
call fcn.1400842f0
mov rcx, rsi
call fcn.140066d10
inc rsi
add rsi, rax
mov rcx, rdi
call fcn.140066d10
inc rdi
add rdi, rax
cmp byte [rdi], r15b
jne 0x1400552d7
mov byte [rsi], r15b
lea rdx, str.Recent_sessions
mov rcx, qword [rbp - 8]
sub esi, r14d
inc esi
mov r9d, 7
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
mov edi, eax
call fcn.140008bbc
mov rbx, r14
test r13, r13
je 0x140055373
test edi, edi
jne 0x140055373
mov qword [r13], rbx
jmp 0x14005537b
mov rcx, rbx
call fcn.140008bbc
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg edi
sbb eax, eax
and eax, 4
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret