Function at 0xc6b6ab
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0xc78c24]
push ebx
push esi
push edi
mov esi, str.interrupted
mov dword [ebp - 0x30], edx
lea edi, [ebp - 0x40]
mov dword [ebp - 0x34], ecx
xor ebx, ebx
mov dword [ebp - 0x28], 0x2dac25eb
mov dword [ebp - 0x24], 0x57efef9
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], 0xb7543247
mov dword [ebp - 0x1c], 0xad1e65d4
mov dword [ebp - 0x18], 0xd81e8921
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xae29fe04
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], eax
call fcn.00c67f6c
push 5
pop ecx
mov esi, 0xc6f33c
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov edx, ebx
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x64], 0x48
jne 0xc6b737
mov al, 0x48
test al, al
je 0xc6b737
cmp byte [ebp + edx - 0x64], bl
je 0xc6b737
mov al, byte [edx + 0xc76351]
inc edx
cmp al, byte [ebp + edx - 0x64]
je 0xc6b720
movzx eax, byte [ebp + edx - 0x64]
movzx ecx, byte [edx + str.HKEY_CURRENT_USER]
mov esi, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, 0xf61
jne 0xc6b758
add esi, 0x2355df42
jmp 0xc6b75e
xor esi, 0x16f634e0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov byte [ebp + eax - 0x180], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jb 0xc6b702
mov edi, ebx
xor edx, edx
mov bl, byte [ebp + edi - 0x180]
push 0xb
mov eax, edi
xor esi, 0x2bb8cffd
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x40]
add eax, dword [ebp - 8]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 8], ecx
mov al, byte [ebp + ecx - 0x180]
mov byte [ebp + edi - 0x180], al
inc edi
mov byte [ebp + ecx - 0x180], bl
cmp edi, 0x100
jb 0xc6b778
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], ebx
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + edi - 0x180]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x180]
mov byte [ebp + edi - 0x180], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x180], cl
movzx eax, byte [ebp + edi - 0x180]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + esi - 0x28]
mov byte [ebp + esi - 0x64], al
inc esi
cmp esi, 0x18
jb 0xc6b7cb
mov esi, 0xc6f58c
mov byte [ebp - 0x4c], bl
lea edi, [ebp - 0x44]
mov dword [ebp - 0x28], 0xc8d44097
mov dword [ebp - 0x24], 0x1fcec6ab
mov dword [ebp - 0x20], 0xcb34209c
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], 0xca0fe44f
mov dword [ebp - 0x18], 0x96c84119
mov dword [ebp - 0x14], 0xc62ef7ca
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, ebx
mov byte [ebp + ebx - 0x180], bl
inc ebx
cmp ebx, 0x100
jb 0xc6b85d
mov ebx, dword [ebp - 0x10]
add ebx, 0x4f2301f0
xor ecx, ecx
mov dword [ebp - 4], ecx
mov al, byte [ebp + ecx - 0x180]
lea edi, [ebp - 0x1cc]
mov byte [ebp - 9], al
xor edx, edx
mov eax, ecx
or ebx, 0xfd085540
push 0xe
pop ecx
div ecx
movzx ecx, byte [ebp - 9]
push 0x12
movzx eax, byte [ebp + edx - 0x44]
add eax, esi
mov esi, str.onecoreuap_base_appmodel_search_search_searchgather_fltrdmn_fltrsink.cxx
add ecx, eax
movzx eax, cl
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 8], eax
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1cc], 0x62
jne 0xc6b8f2
mov cl, 0x62
test cl, cl
je 0xc6b8f2
cmp byte [ebp + eax - 0x1cc], 0
je 0xc6b8f2
call fcn.00c66b7a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov cl, byte [eax + str.bad_address]
cmp cl, byte [ebp + eax - 0x1cc]
je 0xc6b8c9
call fcn.00c66c96
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
cmp edi, esi
jae 0xc6b927
cmp edi, 0xf38
jne 0xc6b914
and ebx, 0x903948ba
call fcn.00c67611
xor ebx, 0x2204a5e6
call fcn.00c67611
inc edi
cmp edi, esi
jb 0xc6b901
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov al, byte [ebp + esi - 0x180]
mov byte [ebp + ecx - 0x180], al
inc ecx
mov al, byte [ebp - 9]
mov byte [ebp + esi - 0x180], al
mov dword [ebp - 4], ecx
cmp ecx, 0x100
jb 0xc6b87b
xor esi, esi
mov dword [ebp - 8], esi
mov eax, esi
mov edi, esi
inc eax
or ebx, 0x753f19d3
movzx eax, al
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x180]
mov eax, dword [ebp - 8]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x180]
mov byte [ebp + ebx - 0x180], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x180], cl
mov eax, ebx
mov ebx, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x180]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + edi - 0x28]
mov byte [ebp + edi - 0x80], al
inc edi
mov eax, dword [ebp - 4]
cmp edi, 0x18
jb 0xc6b95e
imul ebx, ebx, 0xfe7cd72c
inc esi
cmp byte [esi + str.HKEY_CURRENT_USER], 0
jne 0xc6b9c8
mov dword [0xc78c24], ebx
call fcn.00c671ed
mov edi, dword [ebp + 0xc]
cmp edi, esi
jae 0xc6ba1e
mov dword [ebp - 4], ebx
call fcn.00c6710f
cmp edi, 0x2700
jne 0xc6ba02
imul eax, ebx, 0x7a999257
jmp 0xc6ba05
mov eax, dword [ebp - 4]
lea ebx, [eax + 0xed83835]
call fcn.00c67f6c
inc edi
mov dword [ebp - 4], ebx
cmp edi, esi
jb 0xc6b9ed
mov dword [0xc78c24], ebx
xor ebx, ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x68], bl
call fcn.00c4d02f
mov esi, eax
xor ecx, ecx
mov edx, esi
call fcn.00c4d470
mov ecx, esi
mov edi, eax
call fcn.00c4d309
push eax
push ebx
push esi
call fcn.00c4cf49
mov ecx, esi
call fcn.00c4ba07
mov ecx, 0x800
call fcn.00c4b9d3
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.00c4d5c1
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
lea ecx, [ebp - 0x80]
call fcn.00c4d02f
mov esi, eax
mov ecx, esi
call fcn.00c4d309
mov edi, dword [ebp - 4]
push eax
push esi
push edi
call fcn.00c4cef6
mov ecx, esi
call fcn.00c4d309
push eax
push ebx
push esi
call fcn.00c4cf49
mov ecx, esi
call fcn.00c4ba07
mov ecx, edi
call fcn.00c4d309
mov edx, dword [ebp + 0x18]
push eax
call fcn.00c4a061
push dword [ebp + 0x18]
mov edx, dword [ebp - 0x30]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x34]
push dword [ebp + 0x10]
push ebx
push edi
push dword [ebp + 8]
call fcn.00c4faec
add esp, 0x40
mov esi, 0x100000
push esi
push ebx
push dword [ebp + 0x10]
call fcn.00c4cf49
push esi
push ebx
push dword [ebp + 0x14]
call fcn.00c4cf49
push esi
push ebx
push dword [ebp + 0x18]
call fcn.00c4cf49
push 0x800
push ebx
push edi
call fcn.00c4cf49
add esp, 0x30
call fcn.00c67f6c
push 5
pop ecx
mov esi, 0xc73028
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x48], 0x53
jne 0xc6bb32
mov al, 0x53
test al, al
je 0xc6bb32
cmp byte [ebp + ebx - 0x48], 0
je 0xc6bb32
mov al, byte [ebx + 0xc76421]
inc ebx
cmp al, byte [ebp + ebx - 0x48]
je 0xc6bb1a
call fcn.00c67f6c
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jae 0xc6bb68
mov edi, dword [0xc78c24]
cmp esi, 0x773
jne 0xc6bb57
add edi, 0x50340103
call fcn.00c66c96
imul edi, edi, 0xf651ed7
inc esi
cmp esi, ebx
jb 0xc6bb44
mov dword [0xc78c24], edi
mov ecx, dword [ebp - 4]
call fcn.00c4ba07
pop edi
pop esi
pop ebx
leave
ret