Function at 0xc5ada5
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [str.count]
mov dword [ebp - 0xcc], eax
mov ax, word [0xc73b14]
push esi
push edi
mov word [ebp - 0xc8], ax
xor edi, edi
mov dword [ebp - 0xd8], edx
xor eax, eax
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0x28], 0xe202f34d
mov dword [ebp - 0x24], 0x49bd5945
mov dword [ebp - 0x20], 0xdbf33cd3
mov dword [ebp - 0x1c], 0x80a4f34d
mov dword [ebp - 0x18], 0xfd5959b6
mov dword [ebp - 0x14], 0xea792e6e
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jb 0xc5ae14
xor esi, esi
mov dword [ebp - 0x10], 5
xor edx, edx
mov cl, byte [ebp + esi - 0x218]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0x10]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0xcc]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + esi - 0x218], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x218], al
cmp esi, 0x100
jb 0xc5ae2c
and dword [ebp - 8], 0
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + edi - 0x218]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x218]
mov byte [ebp + edi - 0x218], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x218], cl
movzx eax, byte [ebp + edi - 0x218]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [ebp + esi - 0x28]
mov byte [ebp + esi - 0xf8], al
inc esi
cmp esi, 0x18
jb 0xc5ae78
mov eax, dword [0xc78630]
lea edi, [ebp - 0x20]
mov esi, 0xc725d0
mov byte [ebp - 0xe0], 0
xor ecx, ecx
mov dword [ebp - 0x40], 0xf1c85e01
mov dword [ebp - 0x3c], 0x4b58666b
mov dword [ebp - 0x38], 0x82a7abc3
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], 0xaaa9ee6d
mov dword [ebp - 0x30], 0xe82847f1
mov dword [ebp - 0x2c], 0xc6061264
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
and eax, 0xa3623093
xor eax, 0x78f2d2e7
mov byte [ebp + ecx - 0x218], cl
inc ecx
cmp ecx, 0x100
jb 0xc5af1b
mov dword [0xc78630], eax
xor esi, esi
xor edx, edx
mov dword [ebp - 0x10], 0xc
mov eax, esi
mov cl, byte [ebp + esi - 0x218]
div dword [ebp - 0x10]
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x20]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + esi - 0x218], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x218], al
cmp esi, 0x100
jb 0xc5af37
and dword [ebp - 8], 0
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + edi - 0x218]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x218]
mov byte [ebp + edi - 0x218], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x218], cl
movzx eax, byte [ebp + edi - 0x218]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [ebp + esi - 0x40]
mov byte [ebp + esi - 0x114], al
inc esi
cmp esi, 0x18
jb 0xc5af87
xor eax, eax
lea ecx, [ebp - 0xf8]
mov byte [ebp - 0xfc], al
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x10], eax
call fcn.00c4d02f
lea ecx, [ebp - 0x114]
mov dword [ebp - 0xcc], eax
call fcn.00c4d02f
mov dword [ebp - 0xdc], eax
mov esi, 0xc71030
mov dword [ebp - 0xc0], 0xd455f99
lea edi, [ebp - 0x24]
mov dword [ebp - 0xbc], 0xd1bebab5
push 5
pop eax
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x7c], al
mov byte [ebp - 0x79], al
mov byte [ebp - 0x41], al
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb8], 0xd09f4ed7
mov dword [ebp - 0xb4], 0x1d02b05b
mov dword [ebp - 0xb0], 0x7ccc136c
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac], 0xdc1890a2
mov dword [ebp - 0xa8], 0x90a2bca4
mov dword [ebp - 0xa4], 0x847aded8
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa0], 0xe417f202
mov dword [ebp - 0x9c], 0x30815c86
mov dword [ebp - 0x98], 0x7d0e061c
movsb byte es:[edi], byte [esi]
xor edi, edi
mov dword [ebp - 0x94], 0x5214f97e
mov dword [ebp - 0x90], 0xa07150d8
xor eax, eax
mov dword [ebp - 0x8c], 0xeaf78755
mov dword [ebp - 0x88], 0xb796c9c0
mov dword [ebp - 0x84], 0x43f624de
mov dword [ebp - 0x80], 0xcfacd96b
mov word [ebp - 0x7b], 0xd589
mov dword [ebp - 0x78], 0xc70a1d81
mov dword [ebp - 0x74], 0x65b794b5
mov dword [ebp - 0x70], 0xa7d1d8b2
mov dword [ebp - 0x6c], 0x71849bc3
mov dword [ebp - 0x68], 0x3b25346a
mov dword [ebp - 0x64], 0x2913e5e7
mov dword [ebp - 0x60], 0x3e60515c
mov dword [ebp - 0x5c], 0x9eb0f098
mov dword [ebp - 0x58], 0x6855143a
mov dword [ebp - 0x54], 0xd652c0d8
mov dword [ebp - 0x50], 0x567a6c33
mov dword [ebp - 0x4c], 0xb6a5162f
mov dword [ebp - 0x48], 0x3c7fd803
mov word [ebp - 0x44], 0xeac8
mov byte [ebp - 0x42], 0x3b
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jb 0xc5b141
mov esi, dword [0xc78630]
xor edx, edx
mov dword [ebp - 0xc], edx
mov cl, byte [ebp + edx - 0x318]
mov eax, edx
and eax, 0xf
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ebp + eax - 0x24]
add eax, edi
add ecx, eax
movzx eax, cl
mov dword [ebp - 0xd0], eax
push ecx
mov ecx, 0xc73b20
mov al, byte [ebp + eax - 0x318]
mov byte [ebp + edx - 0x318], al
mov edx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
call fcn.00c5623d
xor edi, edi
cmp byte [str.HostProcessExecution], 0
pop ecx
je 0xc5b1bf
and esi, 0x2e194369
inc edi
cmp byte [edi + str.HostProcessExecution], 0
jne 0xc5b1a9
mov dword [0xc78630], esi
push str.Msg:__ws_
call fcn.00c56a34
pop ecx
cmp dword [ebp - 8], edi
jae 0xc5b1ff
call fcn.00c56a87
cmp dword [ebp - 8], 0x17f3
jne 0xc5b1e3
xor esi, 0x248ec16d
add esi, 0x3a937bb3
call fcn.00c56a87
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, edi
jb 0xc5b1cf
mov dword [0xc78630], esi
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xd0]
inc edx
mov al, byte [ebp - 1]
mov dword [ebp - 0xc], edx
mov byte [ebp + edi - 0x318], al
cmp edx, 0x100
jb 0xc5b15b
and dword [ebp - 0xc], 0
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp + edi - 0x318]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0xc], eax
mov al, byte [ebp + eax - 0x318]
mov byte [ebp + edi - 0x318], al
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x318], cl
movzx eax, byte [ebp + edi - 0x318]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x318]
xor al, byte [ebp + esi - 0xc0]
mov byte [ebp + esi - 0x1a0], al
inc esi
cmp esi, 0x80
jb 0xc5b22a
cmp dword [ebp - 0xc4], 0x78
mov byte [ebp - 0x120], 0
jge 0xc5b372
mov edi, dword [ebp - 0xd4]
push 0x800
push 0
push edi
call fcn.00c4cf49
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov esi, dword [ebp - 0x10]
cmp esi, dword [eax]
jne 0xc5b2c8
mov ecx, dword [ebx + 0x14]
mov edx, eax
call fcn.00c59708
xor esi, esi
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + esi*4]
call fcn.00c4d309
mov edx, ecx
mov ecx, edi
push eax
call fcn.00c4d13f
pop ecx
push 0
push dword [ebx + 0x10]
inc esi
lea edx, [ebp - 0x1a0]
push dword [ebx + 0xc]
mov ecx, edi
mov dword [ebp - 0x10], esi
push dword [ebp - 0xd8]
call fcn.00c4e687
add esp, 0x10
test eax, eax
jne 0xc5b32b
mov edi, dword [ebp - 0xdc]
mov edx, edi
mov ecx, dword [ebx + 0xc]
call fcn.00c4d470
test eax, eax
je 0xc5b32b
mov esi, dword [ebp - 0xcc]
mov ecx, eax
mov edx, esi
call fcn.00c4d364
test eax, eax
je 0xc5b33e
mov ecx, dword [ebx + 8]
call fcn.00c4d5dc
inc dword [ebp - 0xc4]
jmp 0xc5b012
mov ecx, esi
call fcn.00c4d309
push eax
push 0
push esi
call fcn.00c4cf49
add esp, 0xc
mov ecx, edi
call fcn.00c4d309
push eax
push 0
push edi
call fcn.00c4cf49
add esp, 0xc
mov ecx, esi
call fcn.00c4ba07
mov ecx, edi
call fcn.00c4ba07
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret