The Syskey Decoder extracts the Boot Key (Startup Key), generated by the SYSKEY utility, from the local registry or "off-line" SYSTEM files.

 

 

The Boot Key is the information used by the program SYSKEY.EXE to encrypt password hashes before they are saved  to SAM database files.

 

 

If stored locally, the Boot Key is scrambled into subkeys of the following registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa.

The Syskey Decoder can reconstruct this information into its hexadecimal form, ready to be used by Cain's NT Hashes Dumper.