Function at 0x410ec0
Capabilities:
Encode data using xor
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x411422
mov eax, dword [esp + 0xb0]
cmp byte [eax], 0
je 0x411422
mov dword [esp + 4], 0x3c
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
mov ebp, eax
je 0x41176c
mov eax, dword [esp + 0xb0]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea esi, [eax + 1]
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_calloc
test eax, eax
mov ebx, eax
je 0x411767
mov eax, dword [esp + 0xb0]
mov dword [esp], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0xb4]
mov dword [ebp], ebx
mov dword [ebp + 8], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x38], 0
mov dword [esp], ebx
and eax, 1
cmp eax, 1
sbb edx, edx
and edx, 2
add edx, 0x8000
mov dword [esp + 4], edx
call sub.msvcrt.dll__open
test eax, eax
mov dword [ebp + 4], eax
mov ebx, dword [esp + 0xb4]
js 0x41144c
lea edx, [esp + 0x6c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__fstat]
cmp eax, 0xffffffff
je 0x4115ab
mov edx, dword [esp + 0x6c]
mov esi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x68], edx
jne 0x4115ba
or ebx, 2
mov dword [ebp + 0x24], esi
mov dword [ebp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_calloc
test eax, eax
mov dword [ebp + 0x38], eax
je 0x41176c
mov edx, esi
xor ebx, ebx
mov edi, dword [sym.imp.msvcrt.dll__errno]
jmp 0x41104a
mov edx, dword [ebp + 0x24]
cmp ebx, edx
jge 0x41106d
mov eax, dword [ebp + 0x38]
sub edx, ebx
add eax, ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 4]
mov dword [esp], eax
call sub.msvcrt.dll__read
add ebx, eax
mov esi, eax
call edi
mov eax, dword [eax]
test eax, eax
je 0x411040
call edi
mov edi, dword [eax]
test edi, edi
jne 0x4116d2
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jg 0x4116f8
mov eax, dword [ebp + 0x38]
cmp dword [eax], 0x66676572
mov dword [esp + 0x34], eax
jne 0x411304
mov ebx, eax
xor edx, edx
lea ecx, [ebx + 0x1fc]
xor edx, dword [eax]
add eax, 4
cmp eax, ecx
jne 0x4110a1
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x1fc]
cmp eax, edx
je 0x4110e3
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.openHive__s_:_WARNING:_REGF_header_checksum_mismatch__calc:_0x_08x___file:_0x_08x_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00412a20
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0xb4]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x2c], eax
add eax, 0x1000
and ebx, 0x4000
mov dword [ebp + 0x28], eax
mov dword [esp + 0x3c], ebx
jne 0x411547
mov edx, dword [ebp + 0x38]
lea eax, [edx + eax + 4]
cmp word [eax], 0x6b6e
jne 0x41142f
mov eax, dword [eax + 0x1c]
lea ebx, [edx + eax + 0x1004]
movzx eax, word [ebx]
cmp ax, 0x6972
mov word [ebp + 0x34], ax
je 0x41167e
mov edx, eax
and dh, 0xfe
cmp dx, 0x686c
je 0x41115a
cmp ax, 0x666c
je 0x41115a
mov ecx, 0x666c
mov eax, 0x666c
mov word [ebp + 0x34], cx
mov edx, dword [esp + 0x3c]
test edx, edx
jne 0x411516
mov eax, dword [esp + 0xb4]
and eax, 0x1000
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x2c], eax
add eax, 0x1000
cmp eax, 0x1000
jbe 0x41172b
mov edx, dword [ebp + 0x38]
cmp dword [edx + 0x1000], 0x6e696268
lea ebx, [edx + 0x1000]
mov dword [esp + 0x30], ebx
jne 0x41173b
mov eax, dword [esp + 0xb4]
mov ebx, 0x1000
shr eax, 0xd
and eax, 1
mov byte [esp + 0x2c], al
mov esi, dword [esp + 0x38]
add dword [ebp + 0x10], 1
test esi, esi
jne 0x4113e0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x411411
lea edi, [ebx + 0x20]
cmp ecx, 0x20
mov edx, ecx
mov esi, edi
jbe 0x411251
cmp edi, dword [ebp + 0x24]
jge 0x411251
add edi, dword [ebp + 0x38]
movsx eax, byte [edi + 1]
movzx edx, byte [edi]
shl eax, 8
movzx eax, ax
add edx, eax
movsx eax, byte [edi + 2]
shl eax, 0x10
and eax, 0xff0000
add edx, eax
movsx eax, byte [edi + 3]
shl eax, 0x18
add eax, edx
je 0x411360
js 0x411380
add dword [ebp + 0x20], eax
add dword [ebp + 0x18], 1
lea edi, [esi + eax]
cmp byte [esp + 0x2c], 0
jne 0x411334
mov esi, edi
mov eax, esi
mov edi, esi
mov edx, ecx
sub eax, ebx
cmp eax, ecx
jae 0x411251
cmp dword [ebp + 0x24], esi
jg 0x4111f4
mov eax, dword [esp + 0x34]
add ebx, ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 0x30], eax
add eax, 0x1000
cmp eax, ebx
jbe 0x411540
mov ecx, dword [ebp + 0x38]
add ecx, ebx
cmp dword [ecx], 0x6e696268
mov dword [esp + 0x30], ecx
je 0x4111c4
mov esi, ebx
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x4116ad
mov ebx, dword [esp + 0x30]
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x38]
mov ebx, esi
mov dword [ebp + 0x30], eax
sub ebx, edx
mov dword [ebp + 0x2c], ebx
test ecx, ecx
jne 0x41163f
mov eax, dword [esp + 0x3c]
or eax, dword [esp + 0x38]
jne 0x4115f4
xor edx, edx
mov dword [ebp + 0xc], 0
mov ecx, str.SAM
mov eax, ebp
call fcn.004076b0
test eax, eax
je 0x4115d2
mov dword [ebp + 0xc], 1
mov edx, dword [esp + 0x38]
mov eax, ebp
test edx, edx
je 0x411329
mov edx, dword [ebp + 0xc]
mov dword [esp], str.Type_of_hive_guessed_to_be:__d_n
mov dword [esp + 0x2c], ebp
mov dword [esp + 4], edx
call fcn.00412a10
mov eax, dword [esp + 0x2c]
jmp 0x411329
mov eax, dword [esp + 0xb0]
mov dword [esp + 4], str.openHive__s_:_File_does_not_seem_to_be_a_registry_hive__n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00412a20
mov eax, ebp
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str.FREE_BLOCK____06x_to__06x_:__d__0x_0x_n
call fcn.00412a10
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 8]
jmp 0x41123e
mov dword [esp], str.parse_block:_FATAL__Zero_data_block_size___not_registry_or_corrupt_file___n
call fcn.00412a10
cmp byte [esp + 0x2c], 0
jne 0x4113a0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 8]
jmp 0x411240
mov edx, eax
sub dword [ebp + 0x1c], eax
add dword [ebp + 0x14], 1
neg edx
cmp byte [esp + 0x2c], 0
jne 0x4113b4
sub esi, eax
mov edi, esi
jmp 0x41123e
mov eax, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x38]
mov dword [esp], eax
call fcn.004081c0
jmp 0x411373
mov edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
sub edi, eax
mov dword [esp + 4], esi
mov dword [esp], str.USED_BLOCK____06x_to__06x_:__d__0x_0x_n
mov dword [esp + 8], edi
call fcn.00412a10
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 8]
jmp 0x41123e
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], ebx
mov dword [esp], str._Page_at_0x_0x_ofs_self_0x_0x__size__delta_ofs_next__0x_0x__n
mov dword [esp + 8], eax
call fcn.00412a10
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4111e3
mov dword [esp + 8], ebx
mov dword [esp + 4], str.openHive:_ERROR:_Page_at_0x_x_has_size_zero__File_may_be_corrupt__or_program_has_a_bug_n
jmp 0x411317
add esp, 0x9c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.openHive:_WARNING:_ROOT_key_does_not_seem_to_be_a_key___not_type__nk__n
add eax, 0x40
mov dword [esp], eax
call fcn.00412a20
jmp 0x411166
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp]
mov dword [esp + 4], str.openHive__s__failed:__s__trying_read_only_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00412a20
mov dword [esp + 4], 0x8000
mov eax, dword [ebp]
mov ebx, dword [esp + 0xb4]
mov dword [esp], eax
call sub.msvcrt.dll__open
or ebx, 1
test eax, eax
mov dword [ebp + 4], eax
jns 0x410f98
call esi
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebp]
mov dword [esp + 4], str.openHive__s__in_fallback_RO_mode_failed:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00412a20
test byte [ebp + 8], 2
jne 0x4116e8
mov eax, dword [ebp]
test eax, eax
je 0x4114f8
mov dword [esp], eax
call fcn.0041a100
mov dword [ebp], 0
mov eax, dword [ebp + 0x38]
test eax, eax
je 0x411507
mov dword [esp], eax
call fcn.0041a100
mov dword [esp], ebp
call fcn.0041a100
xor eax, eax
jmp 0x411329
mov edx, eax
mov dword [esp], str.Subkey_indexing_type_is:__04x___c_c__n
sar dx, 8
movsx edx, dx
mov dword [esp + 0xc], edx
movzx edx, al
cwde
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.00412a10
jmp 0x411166
mov esi, ebx
jmp 0x411295
mov eax, dword [esp + 0xb0]
mov dword [esp], str.Hive___s__name__from_header_:__
mov dword [esp + 4], eax
call fcn.00412a10
mov ebx, dword [esp + 0x34]
movsx eax, byte [ebx + 0x30]
lea esi, [ebx + 0x30]
add ebx, 0x70
test al, al
jne 0x411576
jmp 0x411590
cmp esi, ebx
jae 0x411590
mov dword [esp + 4], eax
add esi, 2
mov dword [esp], 0x41c8ca
call fcn.00412a10
movsx eax, byte [esi]
test al, al
jne 0x411572
mov eax, dword [ebp + 0x28]
mov dword [esp], str.__nROOT_KEY_at_offset:_0x_06x_
mov dword [esp + 4], eax
call fcn.00412a10
mov eax, dword [ebp + 0x28]
jmp 0x41110d
lea edx, [esp + 0x48]
mov ecx, 9
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp], str.stat__
call sub.msvcrt.dll_perror
mov dword [esp], 1
call sub.msvcrt.dll_exit
xor edx, edx
mov ecx, str.ControlSet
mov eax, ebp
call fcn.004076b0
test eax, eax
je 0x41170d
mov dword [ebp + 0xc], 2
jmp 0x4112dd
mov eax, dword [ebp + 0x24]
mov edx, dword [ebp + 0x10]
mov dword [esp], str.File_size__d___x__bytes__containing__d_pages___1_headerpage__n
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], edx
call fcn.00412a10
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], str.Used_for_data:__d__d_blocks_bytes__unused:__d__d_blocks_bytes._n_n
mov dword [esp + 4], eax
call fcn.00412a10
jmp 0x4112b9
mov dword [esp + 4], ebx
mov dword [esp], str.Last_HBIN_at_offset_______:_0x_x_n
call fcn.00412a10
mov eax, dword [ebp + 0x30]
mov dword [esp], str.First_non_HBIN_page_offset:_0x_x_n
mov dword [esp + 4], eax
call fcn.00412a10
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x18]
mov dword [esp], str.hdr__unknown4__version____:_0x_x_n
mov dword [esp + 4], eax
call fcn.00412a10
jmp 0x4112ab
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.openHive:_DEBUG:_BIG_ROOT__n
add eax, 0x40
mov dword [esp], eax
call fcn.00412a20
mov eax, dword [ebx + 4]
mov edx, dword [ebp + 0x38]
movzx eax, word [edx + eax + 0x1004]
mov word [ebp + 0x34], ax
jmp 0x41113a
mov dword [esp + 4], esi
mov dword [esp], str.Page_at_0x_x_is_not_hbin__assuming_file_contains_garbage_at_end_n
call fcn.00412a10
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x2c], eax
add eax, 0x1000
jmp 0x41128e
mov dword [esp], str.openHive__:_read_error:
call sub.msvcrt.dll_perror
test byte [ebp + 8], 2
je 0x4114e2
mov eax, dword [ebp + 4]
mov dword [esp], eax
call sub.msvcrt.dll__close
jmp 0x4114e2
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.Could_not_read_file__got__d_bytes_while_expecting__d_n
jmp 0x4114c8
xor edx, edx
mov ecx, str.Policy
mov eax, ebp
call fcn.004076b0
test eax, eax
je 0x411745
mov dword [ebp + 0xc], 3
jmp 0x4112dd
mov edx, dword [8]
mov esi, 0x1000
jmp 0x411295
mov esi, 0x1000
jmp 0x411282
xor edx, edx
mov ecx, str.Microsoft
mov eax, ebp
call fcn.004076b0
test eax, eax
je 0x4112dd
mov dword [ebp + 0xc], 4
jmp 0x4112dd
call fcn.0041a370
mov dword [esp], 0x41c840
call sub.msvcrt.dll_perror
call sub.msvcrt.dll_abort
nop
nop
nop