Function at 0x4154d5
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
lea edi, [ebp - 0x60]
push 6
pop ecx
mov esi, 0x42ece4
mov dword [ebp - 0x28], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x430c10
mov dword [ebp - 0x18], 0xb70e117a
mov dword [ebp - 0x14], 0xff13a491
mov dword [ebp - 0x10], 0x7e29f5a3
mov dword [ebp - 0xc], 0x9fe735e6
mov dword [ebp - 8], 0xd41075bf
mov dword [ebp - 4], 0x6ce23df8
call fcn.00414ab4
push 6
pop ecx
mov esi, str.RtlNtStatusToDosErrorNoTeb
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x44], 0x49
jne 0x415594
mov al, 0x49
test al, al
je 0x41555a
cmp byte [ebp + ebx - 0x44], 0
je 0x41555a
mov al, byte [ebx + 0x430b11]
inc ebx
cmp al, byte [ebp + ebx - 0x44]
je 0x415542
mov esi, dword [ebp - 0x28]
cmp esi, ebx
jae 0x415594
mov eax, dword [0x43565c]
cmp esi, 0x994
jne 0x415587
add eax, 0x59d1cf91
mov ecx, 0x430b10
mov dword [0x43565c], eax
call fcn.00414ab4
mov eax, dword [0x43565c]
imul eax, eax, 0xc458351
inc esi
cmp esi, ebx
jb 0x415566
jmp 0x415599
mov eax, dword [0x43565c]
xor eax, 0x1d750a05
xor edi, edi
mov dword [0x43565c], eax
xor eax, eax
mov byte [ebp + eax - 0x160], al
inc eax
cmp eax, 0x100
jb 0x4155a7
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x160]
push 0x17
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x60]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x160]
mov byte [ebp + esi - 0x160], al
inc esi
mov byte [ebp + edi - 0x160], bl
cmp esi, 0x100
jb 0x4155b8
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x160]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x160]
mov byte [ebp + edi - 0x160], al
mov byte [ebp + ebx - 0x160], cl
movzx eax, byte [ebp + edi - 0x160]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x160]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x17c], al
inc esi
cmp esi, 0x18
jb 0x4155fb
xor ebx, ebx
lea eax, [ebp - 0x24]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp - 0x1c]
lea edx, [ebp - 0x17c]
mov byte [ebp - 0x164], bl
push 0x80000001
push 6
pop ecx
mov dword [ebp - 0x24], ebx
call fcn.0040a2e6
call eax
test eax, eax
jne 0x415926
push 0x15
pop ecx
mov esi, str.onecoreuap_base_appmodel_searchcommon_staterepositoryhelper_staterepositoryhelper.cpp
mov dword [ebp - 0x18], 0xe0eb6e4b
lea edi, [ebp - 0x1f0]
mov dword [ebp - 0x14], 0x71c78638
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], 0xde9934aa
mov eax, ebx
mov dword [ebp - 0xc], 0x2f531a62
mov dword [ebp - 8], 0xa1805b85
movsw word es:[edi], word [esi]
mov dword [ebp - 4], 0x154ab344
mov dword [ebp - 0x1c], ebx
movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x160], al
inc eax
cmp eax, 0x100
jb 0x4156c6
mov ebx, dword [0x43565c]
mov ecx, ebx
call fcn.00414f8a
xor esi, esi
mov ecx, ebx
call fcn.004149fd
or ebx, 0x242eec03
inc esi
cmp byte [esi + 0x430c10], 0
jne 0x4156e4
call fcn.004148e3
mov edi, dword [ebp - 0x28]
push 0x19
pop ecx
cmp edi, esi
jae 0x41573a
mov eax, ebx
cmp edi, ecx
jne 0x41572d
add eax, 0xc48bdb82
mov ecx, str.no_child_process
mov dword [0x43565c], eax
call fcn.00414ab4
mov ebx, dword [0x43565c]
push 0x19
pop ecx
imul ebx, ebx, 0x1cf8d179
inc edi
mov eax, ebx
cmp edi, esi
jb 0x41570c
xor esi, esi
xor edx, edx
mov eax, esi
push 0x56
pop ecx
div ecx
and ebx, 0xa1cd53e5
mov dword [ebp - 0x20], ebx
mov bl, byte [ebp + esi - 0x160]
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x1f0]
add eax, dword [ebp - 0x1c]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x1c], ecx
mov al, byte [ebp + ecx - 0x160]
mov byte [ebp + esi - 0x160], al
inc esi
mov byte [ebp + ecx - 0x160], bl
mov ebx, dword [ebp - 0x20]
cmp esi, 0x100
jb 0x41573c
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x160]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x160]
mov byte [ebp + edi - 0x160], al
mov byte [ebp + ebx - 0x160], cl
movzx eax, byte [ebp + edi - 0x160]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x160]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x60], al
inc esi
cmp esi, 0x18
jb 0x415792
push 6
and dword [ebp - 0x1c], 0
lea edi, [ebp - 0x44]
pop ecx
mov esi, 0x42cc20
mov byte [ebp - 0x48], 0
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0x2f615411
xor eax, eax
mov dword [ebp - 0x14], 0x5d8a3803
mov dword [ebp - 0x10], 0x38cc3452
mov dword [ebp - 0xc], 0xcefaac20
mov dword [ebp - 8], 0x75d7023b
mov dword [ebp - 4], 0xc974c140
movsw word es:[edi], word [esi]
mov byte [ebp + eax - 0x160], al
inc eax
cmp eax, 0x100
jb 0x415822
or dword [ebp - 0x20], 0x6575646f
xor edi, edi
mov esi, dword [ebp - 0x1c]
xor edx, edx
mov bl, byte [ebp + edi - 0x160]
push 0x19
mov eax, edi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x44]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x160]
mov byte [ebp + edi - 0x160], al
inc edi
mov byte [ebp + esi - 0x160], bl
cmp edi, 0x100
jb 0x41583d
and dword [ebp - 0x1c], 0
xor ebx, ebx
mov esi, dword [ebp - 0x20]
xor edi, edi
lea eax, [ebx + 1]
and esi, 0xe96658a2
movzx ebx, al
mov eax, dword [ebp - 0x1c]
mov cl, byte [ebp + ebx - 0x160]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x1c], eax
mov al, byte [ebp + eax - 0x160]
mov byte [ebp + ebx - 0x160], al
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x160], cl
movzx eax, byte [ebp + ebx - 0x160]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x160]
xor al, byte [ebp + edi - 0x18]
mov byte [ebp + edi - 0x198], al
inc edi
cmp edi, 0x18
jb 0x415885
mov ecx, dword [ebp + 8]
mov dword [0x43565c], esi
mov byte [ebp - 0x180], 0
call fcn.0040b8f4
add eax, eax
lea edx, [ebp - 0x60]
push eax
push ecx
push 1
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push 6
pop ecx
call fcn.0040a2e6
call eax
push dword [ebp - 0x24]
lea edx, [ebp - 0x198]
push 6
pop ecx
call fcn.0040a2e6
call eax
pop edi
pop esi
pop ebx
leave
ret