Function at 0xc5a079
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
push 0x3a
pop eax
push 0x11
mov dword [ebp - 0x240], ecx
pop ecx
push 0x69
mov dword [ebp - 0x244], edx
pop edx
mov dword [ebp - 0x220], 0x46c5d7ac
mov dword [ebp - 0x21c], 0x7ffb0f36
mov byte [ebp - 0x218], 0xdb
mov byte [ebp - 0x217], al
mov dword [ebp - 0x216], 0x8eaa6f22
mov dword [ebp - 0x212], 0x543739c9
mov dword [ebp - 0x20e], 0x8e121ddd
mov dword [ebp - 0x20a], 0x40598981
mov dword [ebp - 0x206], 0x79bb5e5c
mov dword [ebp - 0x202], 0x8933fe99
mov dword [ebp - 0x1fe], 0x46db28ac
mov dword [ebp - 0x1fa], 0xcd86edf2
mov dword [ebp - 0x1f6], 0x4e4b28a4
mov dword [ebp - 0x1f2], 0xcb2c985f
mov dword [ebp - 0x1ee], 0xef3520e8
mov dword [ebp - 0x1ea], 0x599c660e
mov dword [ebp - 0x1e6], 0xb0e1fc66
mov dword [ebp - 0x1e2], 0xf52b236f
mov dword [ebp - 0x1de], 0xdc9b6534
mov dword [ebp - 0x1da], 0x2c91e492
mov dword [ebp - 0x1d6], 0xe5ab97bd
mov dword [ebp - 0x1d2], 0x6481e475
mov dword [ebp - 0x1ce], 0xa9b2bd1c
mov dword [ebp - 0x1ca], 0x417c0375
mov dword [ebp - 0x1c6], 0x9e28a097
mov dword [ebp - 0x1c2], 0x3b54c600
mov dword [ebp - 0x1be], 0x92739a29
mov word [ebp - 0x1ba], 0xa637
mov byte [ebp - 0x1b8], 0x89
mov byte [ebp - 0x1b7], cl
mov dword [ebp - 0x1b6], 0x3d967533
mov dword [ebp - 0x1b2], 0x4b66a766
mov dword [ebp - 0x1ae], 0x2972bf79
mov dword [ebp - 0x1aa], 0x22383d6e
mov dword [ebp - 0x1a6], 0xe8204d43
mov dword [ebp - 0x1a2], 0xcdb6ec1b
mov dword [ebp - 0x19e], 0xae237661
mov dword [ebp - 0x19a], 0x97353d02
mov dword [ebp - 0x196], 0xc84ec1a2
mov dword [ebp - 0x192], 0xbc9b72ce
mov dword [ebp - 0x18e], 0x52752f9
mov dword [ebp - 0x18a], 0xeb49d0c9
mov dword [ebp - 0x186], 0x4842ea51
mov dword [ebp - 0x182], 0x2100aa9e
mov dword [ebp - 0x17e], 0x20c3f5f8
mov dword [ebp - 0x17a], 0x26deec93
mov dword [ebp - 0x176], 0x18f49cb9
mov dword [ebp - 0x172], 0xb784914a
mov dword [ebp - 0x16e], 0x38c76339
mov dword [ebp - 0x16a], 0xfe1edacf
mov dword [ebp - 0x166], 0x6c3e38aa
mov dword [ebp - 0x162], 0xa8ea63e7
mov dword [ebp - 0x15e], 0x298f4896
mov dword [ebp - 0x15a], 0xaf73c44c
mov byte [ebp - 0x156], 0x29
mov byte [ebp - 0x155], cl
mov dword [ebp - 0x154], 0x2925d405
mov dword [ebp - 0x150], 0xa6d1065c
mov dword [ebp - 0x14c], 0xc05dac68
mov dword [ebp - 0x148], 0xe20e1b3b
mov dword [ebp - 0x144], 0x6504916
mov dword [ebp - 0x140], 0x6a20c5d2
mov dword [ebp - 0x13c], 0xede14bea
mov dword [ebp - 0x138], 0x6aaa4ee9
mov dword [ebp - 0x134], 0xb6084ee8
mov dword [ebp - 0x130], 0xb79c74c4
mov dword [ebp - 0x12c], 0xc5e4a7d7
mov dword [ebp - 0x128], 0x561fe94
mov byte [ebp - 0x124], dl
mov dword [ebp - 0x123], 0x2a3610b7
push 0x15
pop eax
mov byte [ebp - 0xeb], cl
lea edi, [ebp - 0x4c]
push 0xe
pop ecx
mov esi, str.onecoreuap_base_appmodel_searchcommon_secutil_secutil.cxx
mov ebx, dword [0xc786f4]
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
sub ebx, 0x4e44cb9f
mov dword [ebp - 0x224], eax
movsw word es:[edi], word [esi]
mov byte [ebp - 0x104], al
mov byte [ebp - 0xab], al
mov byte [ebp - 0x8d], al
xor eax, eax
movsb byte es:[edi], byte [esi]
mov esi, str.EventThrottleBlockPeriodMs
mov dword [ebp - 0x11f], 0x477c0772
lea edi, [ebp - 0x268]
mov dword [ebp - 0x11b], 0x37f5400f
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x117], 0xb9cea887
mov dword [ebp - 0x113], 0xe7e2fe98
mov dword [ebp - 0x10f], 0x97a16b68
movsw word es:[edi], word [esi]
mov dword [ebp - 0x10b], 0x8bb480db
mov word [ebp - 0x107], 0x3cfa
mov byte [ebp - 0x105], 0x38
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x268], dl
mov dword [ebp - 0x103], 0xf5f8ebaf
mov dword [ebp - 0xff], 0x5bb4fa01
mov dword [ebp - 0xfb], 0x5fa2c22d
mov dword [ebp - 0xf7], 0x537254eb
mov dword [ebp - 0xf3], 0xe6ba12a3
mov dword [ebp - 0xef], 0x7ac0eb21
mov dword [ebp - 0xea], 0x3dce60a4
mov dword [ebp - 0xe6], 0xc810c9ae
mov dword [ebp - 0xe2], 0xd1c141d5
mov dword [ebp - 0xde], 0xcf5c8dab
mov dword [ebp - 0xda], 0xf4e5c7d5
mov dword [ebp - 0xd6], 0xbb4a30b3
mov dword [ebp - 0xd2], 0x12a19854
mov dword [ebp - 0xce], 0xe783fc1e
mov dword [ebp - 0xca], 0xbae07241
mov dword [ebp - 0xc6], 0x1332dd37
mov dword [ebp - 0xc2], 0x8a634e86
mov dword [ebp - 0xbe], 0xe365e156
mov dword [ebp - 0xba], 0x99469a81
mov dword [ebp - 0xb6], 0x34833bf0
mov dword [ebp - 0xb2], 0xf75587de
mov word [ebp - 0xae], 0x1453
mov byte [ebp - 0xac], 0xd
mov dword [ebp - 0xaa], 0xd41e4de5
mov dword [ebp - 0xa6], 0x57fddae3
mov dword [ebp - 0xa2], 0x3967d2e3
mov dword [ebp - 0x9e], 0x715bb24d
mov dword [ebp - 0x9a], 0xe7072054
mov dword [ebp - 0x96], 0xdeb3ee99
mov dword [ebp - 0x92], 0x2d0b258a
mov byte [ebp - 0x8e], 0x89
mov dword [ebp - 0x8c], 0x3ff2ef6e
mov dword [ebp - 0x88], 0xa467a68d
mov dword [ebp - 0x84], 0xb776b822
mov dword [ebp - 0x80], 0x6628ae96
mov dword [ebp - 0x7c], 0x6d8c14c3
mov dword [ebp - 0x78], 0x878f5d98
mov dword [ebp - 8], ebx
jmp 0xc5a571
test dl, dl
je 0xc5a576
cmp byte [ebp + eax - 0x268], 0
je 0xc5a576
push 0xc73ff0
call fcn.00c56a34
mov eax, dword [ebp - 4]
inc eax
pop ecx
mov dl, byte [eax + 0xc73dd4]
cmp dl, byte [ebp + eax - 0x268]
mov dword [ebp - 4], eax
je 0xc5a547
push 0xc73f14
call fcn.00c56a34
mov edi, dword [ebp - 0x244]
mov esi, dword [ebp - 4]
pop ecx
cmp edi, esi
jae 0xc5a5af
cmp edi, 0xb7d
jne 0xc5a59c
add ebx, 0x5041f486
sub ebx, 0x664fbe4f
call fcn.00c56a87
inc edi
cmp edi, esi
jb 0xc5a58e
mov dword [ebp - 8], ebx
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x368], al
inc eax
cmp eax, 0x100
jb 0xc5a5b3
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x368]
push 0x3a
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x4c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x368]
mov byte [ebp + esi - 0x368], al
inc esi
mov byte [ebp + edi - 0x368], bl
cmp esi, 0x100
jb 0xc5a5c4
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x368]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x368]
mov byte [ebp + edi - 0x368], al
mov byte [ebp + ebx - 0x368], cl
movzx eax, byte [ebp + edi - 0x368]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x368]
xor al, byte [ebp + esi - 0x220]
mov byte [ebp + esi - 0x560], al
inc esi
cmp esi, 0x1ac
jb 0xc5a607
push 0x3a
pop eax
push 5
pop ecx
mov esi, str.RtlNotifyFeatureUsage
mov byte [ebp - 0x12], al
lea edi, [ebp - 0x23c]
mov byte [ebp - 0x3b4], 0
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x50], 0x349eae24
mov dword [ebp - 0x4c], 0xa836976a
mov dword [ebp - 0x48], 0xf36c8374
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0x44], 0x75f887a7
mov dword [ebp - 0x40], 0x18b83128
xor eax, eax
mov dword [ebp - 0x3c], 0xd089814a
mov dword [ebp - 0x38], 0x4b88b2a0
mov dword [ebp - 0x34], 0x478a72e4
mov dword [ebp - 0x30], 0xb0ba350e
mov dword [ebp - 0x2c], 0x20e36486
mov dword [ebp - 0x28], 0xfd4936c8
mov dword [ebp - 0x24], 0x1c9e78ec
mov dword [ebp - 0x20], 0xd274e36d
mov dword [ebp - 0x1c], 0x5abff8f2
mov dword [ebp - 0x18], 0x72fce7e5
mov word [ebp - 0x14], 0xdf58
mov byte [ebp - 0x11], 0x3f
mov byte [ebp + eax - 0x368], al
inc eax
cmp eax, 0x100
jb 0xc5a6f3
mov ebx, dword [ebp - 8]
xor esi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0x368]
mov eax, esi
mov byte [ebp - 9], cl
div dword [ebp - 0x224]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x23c]
add eax, edi
add ecx, eax
movzx edi, cl
call fcn.00c56a87
mov eax, 0xc73f14
imul ebx, ebx, 0x80c861e6
inc eax
cmp byte [eax], 0
jne 0xc5a737
mov al, byte [ebp + edi - 0x368]
mov byte [ebp + esi - 0x368], al
inc esi
mov al, byte [ebp - 9]
mov byte [ebp + edi - 0x368], al
cmp esi, 0x100
jb 0xc5a707
xor ecx, ecx
xor esi, esi
and dword [ebp - 8], ecx
lea eax, [ecx + 1]
movzx edx, al
lea edi, [ebp - 0x238]
mov dword [ebp - 0x224], edx
mov cl, byte [ebp + edx - 0x368]
movzx eax, cl
mov dword [ebp - 0x248], eax
add eax, esi
movzx esi, al
mov dword [ebp - 0x24c], esi
mov al, byte [ebp + esi - 0x368]
mov byte [ebp + edx - 0x368], al
xor eax, eax
mov byte [ebp + esi - 0x368], cl
mov esi, 0xc71654
mov dword [ebp - 4], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x238], 0x6f
jne 0xc5a7fc
mov cl, 0x6f
test cl, cl
je 0xc5a7fc
cmp byte [ebp + eax - 0x238], 0
je 0xc5a7fc
push ecx
mov edx, 0xc73dd4
mov ecx, 0xc73af0
call fcn.00c56392
mov eax, dword [ebp - 4]
inc eax
pop ecx
mov dword [ebp - 4], eax
mov cl, byte [eax + 0xc73ff0]
cmp cl, byte [ebp + eax - 0x238]
je 0xc5a7c7
mov ecx, ebx
call fcn.00c56618
mov ecx, dword [ebp - 4]
movzx eax, byte [ebp + ecx - 0x238]
movzx ecx, byte [ecx + 0xc73ff0]
sub ecx, eax
cmp ecx, 0x2516
jbe 0xc5a838
push ecx
mov edx, 0xc73f14
mov ecx, 0xc6f3d0
call fcn.00c5623d
pop ecx
add ebx, 0x64050eb6
jmp 0xc5a843
call fcn.00c56a87
imul ebx, ebx, 0x664f59c8
mov ecx, dword [ebp - 0x224]
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x24c]
movzx eax, byte [ebp + ecx - 0x368]
add eax, dword [ebp - 0x248]
movzx eax, al
mov al, byte [ebp + eax - 0x368]
xor al, byte [ebp + edx - 0x50]
mov byte [ebp + edx - 0x3b0], al
inc edx
mov dword [ebp - 8], edx
cmp edx, 0x40
jb 0xc5a76b
mov esi, 0xc700ac
mov dword [ebp - 8], ebx
lea edi, [ebp - 0x238]
mov byte [ebp - 0x370], 0
mov dword [ebp - 0x6c], 0xe2b4d829
mov dword [ebp - 0x68], 0x3e58cfb8
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x64], 0x352b6f9
mov dword [ebp - 0x60], 0x5f105be8
mov dword [ebp - 0x5c], 0x8c90f995
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x58], 0x7cab265b
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x368], al
inc eax
cmp eax, 0x100
jb 0xc5a8cb
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x368]
push 0x11
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x238]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x368]
mov byte [ebp + esi - 0x368], al
inc esi
mov byte [ebp + edi - 0x368], bl
cmp esi, 0x100
jb 0xc5a8dc
mov eax, dword [ebp - 8]
xor ebx, ebx
xor edi, edi
xor esi, esi
add eax, 0x15f018f8
mov dword [0xc786f4], eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x368]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x368]
mov byte [ebp + edi - 0x368], al
mov byte [ebp + ebx - 0x368], cl
movzx eax, byte [ebp + edi - 0x368]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x368]
xor al, byte [ebp + esi - 0x6c]
mov byte [ebp + esi - 0x268], al
inc esi
cmp esi, 0x18
jb 0xc5a92f
push 0xe
pop ecx
mov esi, str.onecoreuap_baseAppModelSearchcommoninclude_tpslist.hxx
mov byte [ebp - 0x250], 0
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x234], 0x2ccda63d
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x230], 0x911050f3
mov dword [ebp - 0x22c], 0xd5522ebb
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x368], al
inc eax
cmp eax, 0x100
jb 0xc5a9b8
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x368]
push 0x3a
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x4c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x368]
mov byte [ebp + esi - 0x368], al
inc esi
mov byte [ebp + edi - 0x368], bl
cmp esi, 0x100
jb 0xc5a9c9
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x368]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x368]
mov byte [ebp + edi - 0x368], al
mov byte [ebp + ebx - 0x368], cl
movzx eax, byte [ebp + edi - 0x368]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x368]
xor al, byte [ebp + esi - 0x234]
movzx eax, al
mov word [ebp + esi*2 - 0x6c], ax
inc esi
cmp esi, 0xc
jb 0xc5aa0c
xor eax, eax
mov word [ebp - 0x54], ax
call fcn.00c48e35
lea ecx, [ebp - 0x560]
mov dword [ebp - 4], eax
call fcn.00c4d05e
lea ecx, [ebp - 0x3b0]
mov edi, eax
call fcn.00c4d05e
mov ecx, 0x1000
mov esi, eax
call fcn.00c4b9d3
mov edx, dword [ebp - 4]
mov ebx, eax
lea eax, [ebp - 0x6c]
push dword [edx + 0x1468]
lea ecx, [edx + 0x1e94]
push dword [ebp + 0xc]
push ecx
lea ecx, [edx + 0x1a84]
push ecx
lea ecx, [edx + 0x1674]
push ecx
push eax
lea eax, [edx + 0x146c]
push eax
push dword [edx + 0x1460]
lea eax, [edx + 0x1050]
push eax
push dword [edx + 0x1464]
lea eax, [edx + 0xc40]
push eax
lea eax, [edx + 0x830]
push eax
lea eax, [edx + 0x420]
push eax
lea eax, [edx + 0x10]
push eax
push dword [edx + 8]
push dword [edx + 4]
push dword [edx]
lea edx, [ebp - 0x268]
push esi
push dword [ebp + 8]
push edi
push ebx
push 2
pop ecx
call fcn.00c4ba1b
call eax
or dword [0xc786f4], 0xd0432573
add esp, 0x54
mov ecx, ebx
call fcn.00c4d317
mov ecx, dword [ebp - 0x240]
mov edx, ebx
push eax
call fcn.00c4d11c
mov dword [esp], 0x1000
push 0
push ebx
call fcn.00c4cf49
mov ecx, dword [ebp - 0x240]
add esp, 0xc
call fcn.00c4d309
mov edx, dword [ebp - 0x244]
push eax
call fcn.00c4a061
pop ecx
mov ecx, edi
call fcn.00c4d317
push eax
push 0
push edi
call fcn.00c4cf49
add esp, 0xc
mov ecx, esi
call fcn.00c4d317
push eax
push 0
push esi
call fcn.00c4cf49
add esp, 0xc
mov ecx, edi
call fcn.00c4ba07
mov ecx, esi
call fcn.00c4ba07
mov esi, dword [ebp - 4]
push 0x22a4
push 0
push esi
call fcn.00c4cf49
add esp, 0xc
mov ecx, esi
call fcn.00c4ba07
mov ecx, ebx
call fcn.00c4ba07
pop edi
pop esi
pop ebx
leave
ret