Function at 0x140089a70
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, 0xffffffffffffffff
mov r15, r9
mov rdi, rsi
mov rbx, r8
mov ebp, edx
mov r14, rcx
nop dword [rax + rax]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x140089aa0
inc edi
call fcn.14006d0e0
mov r9, rbx
mov r8d, ebp
mov rdx, r14
mov rcx, rax
mov r13, rax
call fcn.140088ef0
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x140089af4
mov rcx, r13
call fcn.14006d0a0
mov eax, 1
jmp 0x140089d79
xor r8d, r8d
movsxd rcx, edi
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x30], edi
lea edx, [r8 + 1]
call fcn.140012100
mov rdx, qword [r13]
lea r9, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
mov r14, rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor r12d, r12d
mov ebp, eax
test eax, eax
je 0x140089d0a
cmp eax, 0xea
je 0x140089d0a
mov ecx, r12d
lea rdx, [0x1400b9118]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140089d0a
cmp rcx, 4
jne 0x140089b60
mov rcx, qword [r13]
lea rdx, [0x1400b7ffc]
call fcn.140099310
mov rbx, qword [r13]
xor r8d, r8d
add rbx, rax
lea eax, [rdi + 0xa]
movsxd rcx, eax
lea edx, [r8 + 1]
call fcn.140012100
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbx + 1]
xor r8d, r8d
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x38], eax
mov ebp, eax
test eax, eax
jne 0x140089d00
cmp dword [rsp + 0x34], 1
jne 0x140089d00
mov rbx, qword [rsp + 0x48]
lea ebp, [rax + 2]
mov rdi, r14
nop dword [rax]
nop word [rax + rax]
mov word [rdi], 0x7830
lea rdx, [0x1400b8ac4]
mov rcx, rbx
add rdi, 2
call fcn.140099310
mov rcx, rax
cdq
and edx, 3
lea r10d, [rdx + rax]
movsxd rdx, ecx
sar r10d, 2
dec rdx
xor rdx, 3
cmp byte [rdx + rbx], 0x30
jne 0x140089c4f
movsxd rdx, ecx
cmp ecx, 1
jle 0x140089c4f
sub rdx, 2
dec ecx
xor rdx, 3
cmp byte [rdx + rbx], 0x30
je 0x140089c37
movsxd r9, ecx
mov edx, r12d
test ecx, ecx
jle 0x140089c7d
lea rcx, [rdi - 1]
mov r8, r9
add rcx, r9
movsxd rax, edx
lea rcx, [rcx - 1]
xor rax, 3
inc edx
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
sub r8, 1
jne 0x140089c63
lea eax, [r10*4]
add rdi, r9
movsxd rcx, eax
add rbx, rcx
cmp byte [rbx], r12b
je 0x140089c9c
inc rbx
mov byte [rdi], 0x2c
inc rdi
mov byte [rdi], r12b
sub rbp, 1
jne 0x140089c00
mov r8, r15
mov rax, r14
sub r8, r14
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140089cc5
inc rax
test ecx, ecx
jne 0x140089cb2
test edx, edx
jne 0x140089cfc
nop dword [rax]
inc rsi
cmp byte [r14 + rsi], r12b
jne 0x140089cd0
mov rdx, qword [r13]
inc esi
mov rcx, qword [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.140011ff0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r14
sub r15, r14
nop dword [rax + rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r15]
jne 0x140089d32
inc rax
test cl, cl
jne 0x140089d20
jmp 0x140089d39
sbb r12d, r12d
or r12d, 1
mov rcx, r14
call fcn.140011ff0
mov rcx, r13
call fcn.14006d0a0
cmp ebp, 0xea
je 0x140089d6c
test ebp, ebp
jne 0x140089d65
cmp dword [rsp + 0x34], 1
jne 0x140089d65
test r12d, r12d
jne 0x140089d6c
xor eax, eax
jmp 0x140089d71
mov eax, 1
jmp 0x140089d71
mov eax, 2
mov r12, qword [rsp + 0x80]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret