Function at 0x41c2f3
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
lea edi, [ebp - 0x274]
push 0x12
pop ecx
mov esi, str.onecoreuap_base_appmodel_search_search_searchgather_fltrdmn_fltrbatch.hxx
mov dword [ebp - 0x5c], 0x68b3de87
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x58], 0xd6768fb4
mov dword [ebp - 0x54], 0x28cedf08
mov dword [ebp - 0x50], 0x2da94fab
movsw word es:[edi], word [esi]
mov dword [ebp - 0x4c], 0xe09322e2
mov dword [ebp - 0x48], 0x93f54775
mov dword [ebp - 0x44], 0x93a82864
mov dword [ebp - 0x40], 0xdfcf0547
mov dword [ebp - 0x3c], 0x56bc3d42
mov dword [ebp - 0x38], 0x24aa568f
mov dword [ebp - 0x34], 0xdc4bfeb
movsb byte es:[edi], byte [esi]
call fcn.0041b895
xor esi, esi
imul ebx, dword [0x435900], 0xb3b2a6b0
add ebx, 0x52ea641d
inc esi
mov dword [0x435900], ebx
cmp byte [esi + 0x431670], 0
jne 0x41c373
mov dword [ebp - 0x24], ebx
call fcn.0041bbbd
cmp esi, 0xa42
jbe 0x41c3a8
imul ebx, ebx, 0xf4cec493
mov dword [ebp - 0x24], ebx
mov dword [0x435900], ebx
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41c3ac
push 0x4a
xor esi, esi
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x19c]
mov eax, esi
div ecx
movzx ecx, bl
push 0x4a
movzx eax, byte [ebp + edx - 0x274]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x19c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov byte [ebp + edi - 0x19c], bl
cmp esi, 0x100
jb 0x41c3c0
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x5c]
mov byte [ebp + esi - 0x258], al
inc esi
cmp esi, 0x2c
jb 0x41c406
push 5
pop ecx
mov esi, 0x43015c
mov byte [ebp - 0x22c], 0
lea edi, [ebp - 0x98]
mov dword [ebp - 0x18], 0xf7d944b3
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x14], 0x50ddccb1
mov dword [ebp - 0x10], 0x969ae689
xor eax, eax
mov dword [ebp - 0xc], 0x63b4bd01
mov dword [ebp - 8], 0xfcb81df
mov dword [ebp - 4], 0xfa070220
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41c49b
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x19c]
push 0x13
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x98]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x19c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov byte [ebp + edi - 0x19c], bl
cmp esi, 0x100
jb 0x41c4ac
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1d4], al
inc esi
cmp esi, 0x18
jb 0x41c4f2
push 0xa
pop ecx
mov esi, 0x42ce30
and dword [ebp - 0x1c], 0
lea edi, [ebp - 0x5c]
mov byte [ebp - 0x1bc], 0
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0xd95b4de9
xor eax, eax
mov dword [ebp - 0x14], 0x2ff365b6
mov dword [ebp - 0x10], 0xf9a5cd14
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc], 0x194d836e
mov dword [ebp - 8], 0x1d2ec25
mov dword [ebp - 4], 0xa8540947
movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41c589
mov ebx, dword [ebp - 0x2c]
xor edi, edi
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
xor edx, edx
mov dword [ebp - 0x24], 0x2a
mov eax, edi
mov cl, byte [ebp + edi - 0x19c]
div dword [ebp - 0x24]
mov byte [ebp - 0x1d], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x5c]
add eax, dword [ebp - 0x1c]
add ecx, eax
movzx eax, cl
mov dword [ebp - 0x1c], eax
mov al, byte [ebp + eax - 0x19c]
mov byte [ebp + edi - 0x19c], al
call fcn.0041b895
mov eax, esi
xor edi, edi
xor eax, 0x1609dc7c
mov dword [ebp - 0x24], eax
mov dword [0x4358b8], eax
push ecx
call fcn.0041ba46
inc edi
pop ecx
cmp byte [edi + 0x431690], 0
jne 0x41c5f2
mov ecx, str.SrchDSSAdmin
call fcn.0041be81
jmp 0x41c639
cmp ebx, 0xe12
jne 0x41c623
imul esi, esi, 0xeff8ecd4
mov dword [0x435900], esi
mov eax, dword [ebp - 0x24]
and eax, 0x5b77438c
mov dword [ebp - 0x24], eax
mov dword [0x4358b8], eax
call fcn.0041bbbd
inc ebx
cmp ebx, edi
jb 0x41c60f
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
inc edi
mov al, byte [ebp - 0x1d]
mov dword [ebp - 0x28], edi
mov byte [ebp + ecx - 0x19c], al
cmp edi, 0x100
jb 0x41c5a3
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x228], al
inc esi
cmp esi, 0x18
jb 0x41c663
xor ecx, ecx
mov byte [ebp - 0x210], 0
push 0
push 2
lea edx, [ebp - 0x258]
mov dword [ebp - 0x4a0], 0x22c
inc ecx
call fcn.0040a2e6
call eax
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 0x1c], eax
push ecx
xor ecx, ecx
lea edx, [ebp - 0x1d4]
push eax
inc ecx
call fcn.0040a2e6
call eax
cmp eax, 1
jne 0x41ca8e
mov esi, 0x431270
mov dword [ebp - 0x18], 0x60ee322e
lea edi, [ebp - 0x98]
mov dword [ebp - 0x14], 0x18577da4
mov dword [ebp - 0x10], 0x72d5a8fb
mov dword [ebp - 0xc], 0xbdf07c83
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0xc272b816
mov dword [ebp - 4], 0x64d744b6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41c73b
push 0x11
xor esi, esi
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x19c]
mov eax, esi
div ecx
movzx ecx, bl
push 0x11
movzx eax, byte [ebp + edx - 0x98]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x19c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov byte [ebp + edi - 0x19c], bl
cmp esi, 0x100
jb 0x41c74f
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1b8], al
inc esi
cmp esi, 0x18
jb 0x41c795
xor ebx, ebx
mov byte [ebp - 0x1a0], bl
jmp 0x41ca6b
mov ecx, dword [ebp - 0x2c]
call fcn.0040b8f4
cmp eax, 4
jbe 0x41c813
mov edx, ecx
lea ecx, [ebp - 0x47c]
call fcn.0040ba40
mov edi, eax
jmp 0x41c943
push 0x51
pop eax
push 7
pop ecx
mov esi, str.ActivityStoppedAutomatically
add dword [0x435900], 0x30b4d7e9
lea edi, [ebp - 0x4c]
mov byte [ebp - 9], al
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0x662cff19
mov eax, ebx
mov dword [ebp - 0x14], 0xa06b8bb6
mov dword [ebp - 0x10], 0xb8250a
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xc], 0x4c2c
mov edi, ebx
mov byte [ebp - 0xa], 0xab
mov dword [ebp - 8], 0x44bcb14a
mov dword [ebp - 4], 0x589340ce
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41c862
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x19c]
push 0x1c
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x4c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x19c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov byte [ebp + edi - 0x19c], bl
cmp esi, 0x100
jb 0x41c873
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x9c], al
inc esi
cmp esi, 0x18
jb 0x41c8b6
xor ebx, ebx
lea ecx, [ebp - 0x9c]
mov byte [ebp - 0x84], bl
call fcn.0040b628
mov esi, eax
lea ecx, [ebp - 0x47c]
mov edx, esi
call fcn.0040ba40
mov ecx, esi
mov edi, eax
call fcn.0040b8f4
push eax
push ebx
push esi
call fcn.0040b587
add esp, 0xc
mov ecx, esi
call fcn.0040a2d2
test edi, edi
jne 0x41ca6b
mov eax, dword [0x435900]
lea edi, [ebp - 0x80]
push 0x14
pop ecx
mov esi, str.Did_NOT_process_ContentSnippet_for__s__Indexing_Content:__d__has_file_IFilter:__d
mov dword [ebp - 0x18], 0xc13ca7af
rep movsd dword es:[edi], dword [esi]
add eax, 0x23b59794
mov dword [ebp - 0x14], 0x1d9f9714
mov dword [0x4358b8], eax
mov eax, ebx
mov dword [ebp - 0x10], 0x29118544
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc], 0xefeec56c
mov edi, ebx
mov dword [ebp - 8], 0x6d1242
mov dword [ebp - 4], 0x82ddb923
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41c997
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x19c]
push 0x51
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x80]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x19c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov byte [ebp + edi - 0x19c], bl
cmp esi, 0x100
jb 0x41c9a8
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1f0], al
inc esi
cmp esi, 0x18
jb 0x41c9eb
push dword [ebp - 0x498]
xor ebx, ebx
lea edx, [ebp - 0x1f0]
xor ecx, ecx
mov byte [ebp - 0x1d8], bl
push ebx
push 0x1fffff
inc ecx
call fcn.0040a2e6
call eax
mov dword [ebp - 0x28], eax
test eax, eax
je 0x41ca6b
cmp eax, 0xffffffff
jne 0x41caa9
lea eax, [ebp - 0x4a0]
xor ecx, ecx
push eax
push dword [ebp - 0x1c]
lea edx, [ebp - 0x1b8]
inc ecx
call fcn.0040a2e6
call eax
cmp eax, 1
je 0x41c7f2
push dword [ebp - 0x1c]
xor ecx, ecx
lea edx, [ebp - 0x228]
inc ecx
call fcn.0040a2e6
call eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
mov esi, str.io_error
mov dword [ebp - 0x18], 0x4cc9eea1
lea edi, [ebp - 0x8c]
mov dword [ebp - 0x14], 0x6943d18a
mov dword [ebp - 0x10], 0x6195e5c0
mov eax, ebx
mov dword [ebp - 0xc], 0x152ee2f
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x82e23f7b
mov dword [ebp - 4], 0x589de788
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, ebx
mov byte [ebp + eax - 0x19c], al
inc eax
cmp eax, 0x100
jb 0x41cae5
mov esi, ebx
mov dl, byte [ebp + esi - 0x19c]
mov eax, esi
and eax, 7
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x8c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x19c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov byte [ebp + edi - 0x19c], dl
cmp esi, 0x100
jb 0x41caf6
mov eax, dword [0x435900]
xor edi, edi
xor edx, edx
imul ecx, eax, 0xdfa1d0b8
mov dword [0x4358b8], ecx
inc edx
cmp byte [edx + 0x431690], bl
jne 0x41cb47
cmp edx, 0x1a42
jne 0x41cb66
xor ecx, 0xdd72a635
mov dword [0x4358b8], ecx
jmp 0x41cb70
add eax, 0x57f03c99
mov dword [0x435900], eax
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x19c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x19c]
mov byte [ebp + edi - 0x19c], al
mov byte [ebp + ebx - 0x19c], cl
movzx eax, byte [ebp + edi - 0x19c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x19c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x20c], al
inc esi
cmp esi, 0x18
jb 0x41cb72
push dword [ebp - 0x1c]
xor ecx, ecx
mov byte [ebp - 0x1f4], 0
lea edx, [ebp - 0x20c]
inc ecx
call fcn.0040a2e6
call eax
mov eax, dword [ebp - 0x28]
jmp 0x41caa4