Function at 0x14006a120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x70
mov r15, r9
mov rsi, r8
mov ebx, edx
mov rdi, rcx
call fcn.1400a6c40
mov r9d, ebx
lea rdx, str._s__d:
mov r8, rsi
mov r12, rax
lea rcx, [rax + 0x18]
call fcn.1400a22b0
mov rdx, r12
mov rcx, rdi
call fcn.1400aee20
xor r13d, r13d
lea r9, str.SoftwareSimonTathamPuTTYSshHostKeys
xor edx, edx
mov qword [rsp + 0x20], r13
xor ecx, ecx
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
je 0x14006a3c2
mov rdx, qword [r12]
mov rcx, rax
call fcn.1400a9e40
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
jne 0x14006a374
mov edx, r13d
lea rax, [0x1400c6cf0]
nop dword [rax]
movzx ecx, byte [rsi + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x14006a374
cmp rdx, 4
jne 0x14006a1c0
mov rcx, qword [r12]
lea rdx, [0x1400c2dac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcspn]
mov rdx, qword [r12]
mov rcx, rdi
inc rax
add rdx, rax
call fcn.1400a9e40
mov qword [rsp + 0x40], rax
mov rsi, rax
test rax, rax
je 0x14006a36c
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], r14
call fcn.1400a6c40
mov qword [rsp + 0x48], rax
lea r13, [0x1400d0a08]
mov rdi, rsi
mov r14d, 2
lea rbp, [rax + 0x18]
nop dword [rax]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], r13
mov rcx, rbp
mov qword [rsp + 0x68], 2
call fcn.1400a22a0
lea rdx, [0x1400cdb6c]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcspn]
mov rbx, rax
cdq
and edx, 3
movsxd rcx, ebx
dec rcx
add eax, edx
sar eax, 2
xor rcx, 3
mov dword [rsp + 0x30], eax
cmp byte [rcx + rdi], 0x30
jne 0x14006a2a8
nop dword [rax + rax]
movsxd rcx, ebx
cmp ebx, 1
jle 0x14006a2a8
lea rax, [rcx - 2]
dec ebx
xor rax, 3
cmp byte [rax + rdi], 0x30
je 0x14006a290
test ebx, ebx
jle 0x14006a2cc
movsxd rsi, ebx
nop
dec rsi
mov rcx, rbp
mov rax, rsi
dec ebx
xor rax, 3
movzx edx, byte [rax + rdi]
call fcn.1400a2270
test ebx, ebx
jg 0x14006a2b0
mov eax, dword [rsp + 0x30]
lea eax, [rax*4]
movsxd rcx, eax
add rdi, rcx
cmp byte [rdi], 0
je 0x14006a2ef
inc rdi
mov dl, 0x2c
mov rcx, rbp
call fcn.1400a2270
sub r14, 1
jne 0x14006a240
mov rbx, qword [rsp + 0x48]
mov r9, r15
mov r14, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
mov r8, qword [rbx]
sub r9, r8
mov rax, r8
xor r13d, r13d
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14006a333
inc rax
test ecx, ecx
jne 0x14006a320
test edx, edx
jne 0x14006a355
mov rdi, qword [rsp + 0x38]
mov rdx, qword [r12]
mov rcx, rdi
call fcn.1400aa1d0
mov rcx, rbx
call fcn.1400a6df0
mov rbx, rax
jmp 0x14006a367
mov rcx, rbx
call fcn.1400a6c00
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400a62e0
mov rcx, rdi
call sub.ADVAPI32.dll_RegCloseKey
test rbx, rbx
je 0x14006a3ba
mov rax, rbx
sub r15, rbx
movzx ecx, byte [rax]
cmp cl, byte [rax + r15]
jne 0x14006a399
inc rax
test cl, cl
jne 0x14006a387
jmp 0x14006a3a0
sbb r13d, r13d
or r13d, 1
mov rcx, rbx
call fcn.1400a62e0
mov rcx, r12
call fcn.1400a6c00
neg r13d
sbb eax, eax
and eax, 2
jmp 0x14006a3cf
mov rcx, rbx
call fcn.1400a62e0
mov rcx, r12
call fcn.1400a6c00
mov eax, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret