Function at 0x494f2d
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x42b238]
mov ebp, ecx
mov esi, edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
xor eax, eax
push eax
push ecx
push eax
push 0x2001f
push eax
push eax
push eax
push str.SoftwareSimonTathamPuTTYJumplist
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, 2
test eax, eax
jne 0x495187
mov eax, 0xc8
lea edi, [esp + 4]
mov dword [edi], eax
push 1
push eax
call fcn.0043f807
add esp, 8
mov ebx, eax
lea eax, [esp + 8]
push edi
push ebx
push eax
push 0
push str.Recent_sessions
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x494fd7
push ebx
call fcn.0043f9d4
add esp, 4
push 1
push dword [esp + 8]
call fcn.0043f807
add esp, 8
mov ebx, eax
push edi
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push str.Recent_sessions
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x494feb
cmp eax, 2
jne 0x495074
mov word [ebx], 0
jmp 0x494ff6
cmp dword [esp + 8], 7
jne 0x49508a
mov eax, dword [esp + 4]
xor edx, edx
mov ecx, 0
cmp eax, 1
je 0x495022
dec eax
lea edx, [ebx + 1]
xor ecx, ecx
cmp byte [edx - 1], 0
jne 0x495017
cmp byte [edx], 0
je 0x495020
mov ecx, edx
inc edx
sub ecx, ebx
cmp ecx, eax
jb 0x49500c
mov edx, eax
cmp ecx, edx
jb 0x49502b
mov word [ebx], 0
mov ecx, dword [esp + 0x28]
mov eax, ebp
mov dl, 1
or eax, esi
je 0x495083
mov edi, dword [esp + 4]
test ebp, ebp
je 0x4950be
push ebp
call fcn.004a7f30
add esp, 4
xor ecx, ecx
lea eax, [edi + eax + 1]
inc ecx
push ecx
push eax
call fcn.0043f807
add esp, 8
mov edi, eax
push ebp
push edi
call fcn.004a7c00
add esp, 8
push edi
call fcn.004a7f30
add esp, 4
lea ebp, [edi + eax + 1]
jmp 0x4950cd
push ebx
call fcn.0043f9d4
add esp, 4
push dword [esp + 0xc]
jmp 0x4950ae
mov edi, ebx
jmp 0x495159
push str.Recent_sessions
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x494fe4
push ebx
call fcn.0043f9d4
add esp, 4
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 3
jmp 0x495187
push 1
push edi
call fcn.0043f807
add esp, 8
mov edi, eax
mov ebp, edi
cmp byte [ebx], 0
mov dword [esp], edi
je 0x495126
mov edi, ebx
test esi, esi
je 0x4950e9
push esi
push edi
call fcn.004a7d00
add esp, 8
test eax, eax
je 0x495114
push edi
call fcn.00494293
add esp, 4
test eax, eax
je 0x495114
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebp
call fcn.004a7c00
add esp, 8
push ebp
call fcn.004a7f30
add esp, 4
lea ebp, [ebp + eax + 1]
push edi
call fcn.004a7f30
add esp, 4
lea edi, [edi + eax + 1]
cmp byte [edi], 0
jne 0x4950d7
mov byte [ebp], 0
inc ebp
mov edi, dword [esp]
sub ebp, edi
push ebp
push edi
push 7
push 0
push str.Recent_sessions
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
push ebx
call fcn.0043f9d4
add esp, 4
mov ecx, dword [esp + 0x28]
test esi, esi
sete dl
test ecx, ecx
mov byte [esp], dl
je 0x495168
test dl, dl
je 0x495168
mov dword [ecx], edi
jmp 0x495171
push edi
call fcn.0043f9d4
add esp, 4
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp byte [esp], 0
sete bl
shl ebx, 2
mov ecx, dword [esp + 0x10]
call fcn.00497c4a
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret