Function at 0x40de10
Capabilities:
Encode data using xor
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x40e282
mov eax, dword [esp + 0xa0]
cmp byte [eax], 0
je 0x40e282
mov dword [esp + 4], 0x3c
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
mov ebp, eax
je 0x40e5a3
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
call fcn.00407240
mov ecx, dword [esp + 0xa4]
mov dword [ebp], eax
mov dword [ebp + 8], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x38], 0
mov dword [esp], eax
and ecx, 1
cmp ecx, 1
sbb ecx, ecx
and ecx, 2
add ecx, 0x8000
mov dword [esp + 4], ecx
call sub.msvcrt.dll__open
test eax, eax
mov dword [ebp + 4], eax
mov ebx, dword [esp + 0xa4]
js 0x40e2ae
lea ecx, [esp + 0x5c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.msvcrt.dll__fstat]
cmp eax, 0xffffffff
mov esi, eax
je 0x40e58b
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x74]
test esi, esi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x58], edx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x4c], eax
jne 0x40e58b
or ebx, 2
mov dword [ebp + 0x24], eax
mov dword [ebp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [ebp + 0x38], eax
je 0x40e5a3
mov eax, dword [sym.imp.msvcrt.dll__errno]
mov ebx, eax
mov dword [esp + 0x20], eax
call eax
mov dword [esp + 0x24], edi
mov dword [eax], 0
mov edi, ebx
mov eax, dword [ebp + 0x24]
jmp 0x40df69
mov eax, dword [ebp + 0x24]
cmp esi, eax
jge 0x40df8f
sub eax, esi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x38]
add eax, esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 4]
mov dword [esp], eax
call sub.msvcrt.dll__read
add esi, eax
mov ebx, eax
call edi
mov eax, dword [eax]
test eax, eax
je 0x40df62
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
call eax
mov eax, dword [eax]
test eax, eax
jne 0x40e4ed
mov edx, dword [ebp + 0x24]
cmp esi, edx
jl 0x40e508
mov edx, dword [ebp + 0x38]
cmp dword [edx], 0x66676572
mov dword [esp + 0x24], edx
mov ecx, edx
lea ebx, [edx + 0x1fc]
jne 0x40e1fc
lea esi, [esi]
xor eax, dword [ecx]
add ecx, 4
cmp ecx, ebx
jne 0x40dfd0
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x1fc]
cmp ecx, eax
je 0x40e012
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], str.openHive__s_:_WARNING:_REGF_header_checksum_mismatch__calc:_0x_08x___file:_0x_08x_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0xa4]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x20], eax
add eax, 0x1000
and edx, 0x4000
mov dword [ebp + 0x28], eax
mov dword [esp + 0x2c], edx
jne 0x40e377
mov ecx, dword [ebp + 0x38]
lea eax, [ecx + eax + 4]
cmp word [eax], 0x6b6e
jne 0x40e291
mov eax, dword [eax + 0x1c]
lea ebx, [ecx + eax + 0x1004]
movzx eax, word [ebx]
cmp ax, 0x6972
mov word [ebp + 0x34], ax
je 0x40e4be
mov ecx, eax
and ch, 0xfe
cmp cx, 0x686c
je 0x40e084
cmp ax, 0x666c
je 0x40e084
mov eax, 0x666c
mov word [ebp + 0x34], ax
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x40e349
mov eax, dword [esp + 0xa4]
and eax, 0x1000
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x28]
lea eax, [ecx + 0x1000]
cmp eax, 0x1000
jbe 0x40e54d
mov eax, dword [ebp + 0x38]
mov esi, 0x1000
cmp dword [eax + 0x1000], 0x6e696268
lea edi, [eax + 0x1000]
jne 0x40e166
mov eax, dword [esp + 0xa4]
shr eax, 0xd
and eax, 1
mov dword [esp + 0x20], eax
mov esi, esi
lea edi, [edi]
mov ecx, dword [esp + 0x28]
add dword [ebp + 0x10], 1
test ecx, ecx
jne 0x40e230
mov eax, dword [edi + 8]
test eax, eax
je 0x40e259
cmp eax, 0x20
lea ebx, [esi + 0x20]
jbe 0x40e146
cmp ebx, dword [ebp + 0x24]
jl 0x40e125
jmp 0x40e146
cmp dword [ebp + 0x24], ebx
jle 0x40e146
mov eax, dword [esp + 0x20]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.00408550
add ebx, eax
mov eax, dword [edi + 8]
mov ecx, ebx
sub ecx, esi
cmp ecx, eax
jb 0x40e120
add esi, eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x28]
lea eax, [ecx + 0x1000]
cmp eax, esi
jbe 0x40e178
mov edi, dword [ebp + 0x38]
add edi, esi
cmp dword [edi], 0x6e696268
je 0x40e0f0
mov ebx, dword [esp + 0x2c]
lea eax, [ecx + 0x1000]
test ebx, ebx
jne 0x40e499
sub esi, dword [edi + 8]
mov edx, dword [esp + 0x28]
mov dword [ebp + 0x30], eax
test edx, edx
mov dword [ebp + 0x2c], esi
jne 0x40e426
test dword [esp + 0xa4], 0x5000
jne 0x40e3db
mov dword [ebp + 0xc], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.SAM
mov dword [esp + 4], 0
mov dword [esp], ebp
call fcn.0040b510
test eax, eax
je 0x40e465
mov dword [ebp + 0xc], 1
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40e21f
mov eax, dword [ebp + 0xc]
mov dword [esp], str.Type_of_hive_guessed_to_be:__d_n
mov dword [esp + 4], eax
call fcn.00413030
add esp, 0x8c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0xa0]
mov dword [esp + 4], str.openHive__s_:_File_does_not_seem_to_be_a_registry_hive__n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
add esp, 0x8c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 8]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 4]
mov dword [esp + 4], esi
mov dword [esp], str._Page_at_0x_0x_ofs_self_0x_0x__size__delta_ofs_next__0x_0x__n
mov dword [esp + 8], eax
call fcn.00413030
mov eax, dword [edi + 8]
test eax, eax
jne 0x40e10b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], esi
mov dword [esp + 4], str.openHive:_ERROR:_Page_at_0x_x_has_size_zero__File_may_be_corrupt__or_program_has_a_bug_n
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
add esp, 0x8c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x8c
xor ebp, ebp
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.openHive:_WARNING:_ROOT_key_does_not_seem_to_be_a_key___not_type__nk__n
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
jmp 0x40e090
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp]
mov dword [esp + 4], str.openHive__s__failed:__s__trying_read_only_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
mov dword [esp + 4], 0x8000
mov eax, dword [ebp]
mov ebx, dword [esp + 0xa4]
mov dword [esp], eax
call sub.msvcrt.dll__open
or ebx, 1
test eax, eax
mov dword [ebp + 4], eax
jns 0x40deb4
call esi
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp]
mov dword [esp + 4], str.openHive__s__in_fallback_RO_mode_failed:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
mov dword [esp], ebp
xor ebp, ebp
call fcn.0040dc90
jmp 0x40e21f
movzx eax, word [ebp + 0x34]
mov dword [esp], str.Subkey_indexing_type_is:__04x___c_c__n
mov ecx, eax
sar cx, 8
movsx ecx, cx
mov dword [esp + 0xc], ecx
movzx ecx, al
cwde
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.00413030
jmp 0x40e090
mov eax, dword [esp + 0xa0]
mov dword [esp], str.Hive___s__name__from_header_:__
mov dword [esp + 4], eax
call fcn.00413030
mov edx, dword [esp + 0x24]
movsx eax, byte [edx + 0x30]
lea esi, [edx + 0x30]
lea ebx, [edx + 0x70]
test al, al
jne 0x40e3a6
jmp 0x40e3c0
cmp esi, ebx
jae 0x40e3c0
mov dword [esp + 4], eax
add esi, 2
mov dword [esp], 0x417095
call fcn.00413030
movsx eax, byte [esi]
test al, al
jne 0x40e3a2
mov eax, dword [ebp + 0x28]
mov dword [esp], str.__nROOT_KEY_at_offset:_0x_06x_
mov dword [esp + 4], eax
call fcn.00413030
mov eax, dword [ebp + 0x28]
jmp 0x40e03c
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x10]
mov dword [esp], str.File_size__d___x__bytes__containing__d_pages___1_headerpage__n
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
call fcn.00413030
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], str.Used_for_data:__d__d_blocks_bytes__unused:__d__d_blocks_bytes._n_n
mov dword [esp + 4], eax
call fcn.00413030
jmp 0x40e19e
mov dword [esp + 4], esi
mov dword [esp], str.Last_HBIN_at_offset_______:_0x_x_n
call fcn.00413030
mov eax, dword [ebp + 0x30]
mov dword [esp], str.First_non_HBIN_page_offset:_0x_x_n
mov dword [esp + 4], eax
call fcn.00413030
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x18]
mov dword [esp], str.hdr__unknown4__version____:_0x_x_n
mov dword [esp + 4], eax
call fcn.00413030
jmp 0x40e18d
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.ControlSet
mov dword [esp + 4], 0
mov dword [esp], ebp
call fcn.0040b510
test eax, eax
je 0x40e51d
mov dword [ebp + 0xc], 2
jmp 0x40e1d4
mov dword [esp + 4], esi
mov dword [esp], str.Page_at_0x_x_is_not_hbin__assuming_file_contains_garbage_at_end_n
call fcn.00413030
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], eax
add eax, 0x1000
jmp 0x40e178
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.openHive:_DEBUG:_BIG_ROOT__n
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x38]
movzx eax, word [ecx + eax + 0x1004]
mov word [ebp + 0x34], ax
jmp 0x40e069
mov dword [esp], str.openHive__:_read_error:
call sub.msvcrt.dll_perror
mov dword [esp], ebp
xor ebp, ebp
call fcn.0040dc90
jmp 0x40e21f
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Could_not_read_file__got__d_bytes_while_expecting__d_n
jmp 0x40e32a
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Policy
mov dword [esp + 4], 0
mov dword [esp], ebp
call fcn.0040b510
test eax, eax
je 0x40e557
mov dword [ebp + 0xc], 3
jmp 0x40e1d4
mov esi, 0x1000
jmp 0x40e178
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Microsoft
mov dword [esp + 4], 0
mov dword [esp], ebp
call fcn.0040b510
test eax, eax
je 0x40e1d4
mov dword [ebp + 0xc], 4
jmp 0x40e1d4
mov dword [esp], str.stat__
call sub.msvcrt.dll_perror
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], 0x417069
call sub.msvcrt.dll_perror
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop