Function at 0x140055494
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov r13, r8
mov rcx, r9
mov ebx, edx
call fcn.140066d10
lea r12d, [rax + 1]
call fcn.14004a278
mov r9, r13
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov r15, rax
call fcn.140054aec
lea r8, [rbp - 8]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x140055512
mov rcx, r15
call fcn.14004a23c
mov eax, 1
jmp 0x140055728
xor r8d, r8d
movsxd rcx, r12d
mov dword [rbp - 0x10], r12d
lea edx, [r8 + 1]
call fcn.140008cbc
mov rdx, qword [r15]
lea r9, [rbp - 0xc]
mov rcx, qword [rbp - 8]
mov rsi, rax
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test eax, eax
je 0x1400556d4
cmp eax, 0xea
je 0x1400556d4
lea rdx, [0x1400c2b98]
mov rcx, r13
call fcn.140081540
test eax, eax
jne 0x1400556d4
mov rcx, qword [r15]
lea rdx, [0x1400c19fc]
call fcn.140084470
mov rbx, qword [r15]
xor r8d, r8d
add rbx, rax
lea eax, [r12 + 0xa]
movsxd rcx, eax
lea edx, [r8 + 1]
call fcn.140008cbc
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0xc]
mov r13, rax
mov dword [rbp - 0x10], r12d
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, [rbx + 1]
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test eax, eax
jne 0x1400556c6
cmp dword [rbp - 0xc], 1
jne 0x1400556c6
mov rbx, rsi
lea r12d, [rax + 2]
mov rdi, r13
mov word [rbx], 0x7830
lea rdx, [0x1400c2630]
mov rcx, rdi
add rbx, 2
call fcn.140084470
mov r8, rax
cdq
and edx, 3
movsxd rcx, r8d
lea r10d, [rdx + rax]
sar r10d, 2
dec rcx
jmp 0x140055628
movsxd rcx, r8d
cmp r8d, 1
jle 0x140055632
dec r8d
sub rcx, 2
xor rcx, 3
cmp byte [rcx + rdi], 0x30
je 0x140055618
xor r9d, r9d
movsxd rcx, r8d
test r8d, r8d
jle 0x14005565f
lea rdx, [rbx - 1]
mov r8, rcx
add rdx, rcx
movsxd rax, r9d
inc r9d
xor rax, 3
mov al, byte [rax + rdi]
mov byte [rdx], al
dec rdx
sub r8, 1
jne 0x140055647
add rbx, rcx
mov eax, r10d
shl eax, 2
movsxd rcx, eax
add rdi, rcx
cmp byte [rdi], 0
je 0x14005567c
inc rdi
mov byte [rbx], 0x2c
inc rbx
mov byte [rbx], 0
sub r12, 1
jne 0x1400555e9
mov rbx, qword [rbp + 0x48]
mov rcx, rsi
mov rdx, rbx
call fcn.140081540
test eax, eax
jne 0x1400556ca
mov rcx, rsi
call fcn.140066d10
mov rdx, qword [r15]
lea r9d, [r12 + 1]
mov rcx, qword [rbp - 8]
inc eax
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1400556ca
mov rbx, qword [rbp + 0x48]
mov rcx, r13
call fcn.140008bbc
jmp 0x1400556d8
mov rbx, qword [rbp + 0x48]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
mov rcx, rsi
call fcn.140081540
mov rcx, rsi
mov ebx, eax
call fcn.140008bbc
mov rcx, r15
call fcn.14004a23c
cmp r14d, 0xea
je 0x140055723
test r14d, r14d
jne 0x140055508
cmp dword [rbp - 0xc], 1
jne 0x140055508
test ebx, ebx
jne 0x140055723
xor eax, eax
jmp 0x140055728
mov eax, 2
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret