Function at 0xc66dcd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
movzx eax, word [ecx]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
xor ebx, ebx
movzx edx, ax
mov dword [ebp - 0x10], eax
mov esi, ebx
mov dword [ebp - 4], edx
test ax, ax
je 0xc66e26
mov edx, dword [0xc78bf8]
lea eax, [edx - 0x3c6fa3b7]
inc esi
cmp word [ecx + esi*2], bx
jne 0xc66dff
mov ecx, dword [ebp - 4]
jmp 0xc66e20
cmp ecx, 0x124a
jne 0xc66e19
lea edx, [eax + 0x71f53f4e]
sub edx, 0x6cfc525a
inc ecx
cmp ecx, esi
jb 0xc66e0b
jmp 0xc66e2b
mov eax, dword [0xc78c9c]
mov edx, eax
mov esi, ebx
xor edx, 0x7f8bb3ea
cmp word [edi], bx
je 0xc66e64
and edx, 0xd3345d21
inc esi
cmp word [edi + esi*2], bx
jne 0xc66e3a
mov ecx, dword [ebp - 4]
jmp 0xc66e60
cmp ecx, 0x1771
jne 0xc66e5a
xor edx, 0xe8505a3d
or eax, 0xf81a3351
inc ecx
cmp ecx, esi
jb 0xc66e4c
push 0xb
pop ecx
mov esi, str.operation_would_block
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
push 0x77
pop esi
xor edi, edi
cmp si, word [ebp - 0x3c]
jne 0xc66ebb
mov ecx, edi
test si, si
je 0xc66e9c
cmp word [ebp + ecx - 0x3c], di
je 0xc66e9c
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + 0xc76620]
cmp si, word [ebp + ecx - 0x3c]
je 0xc66e7e
mov ecx, dword [ebp - 4]
jmp 0xc66eb7
cmp ecx, 0x24c4
jne 0xc66eae
sub eax, 0xacf58ae
mov edx, eax
and edx, 0xa978ceba
inc ecx
cmp ecx, ebx
jb 0xc66ea1
push 0x29
mov ebx, edi
mov esi, str.Did_NOT_process_ContentSnippet_for__s__Indexing_Content:__d__has_file_IFilter:__d
pop ecx
lea edi, [ebp - 0xe4]
rep movsd dword es:[edi], dword [esi]
push 0x65
pop esi
xor edi, edi
cmp si, word [ebp - 0xe4]
jne 0xc66f20
mov ecx, edi
test si, si
je 0xc66f01
cmp word [ebp + ecx - 0xe4], di
je 0xc66f01
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + str.ext_ms_win_ole32_bindctx_l1_1_0.dll]
cmp si, word [ebp + ecx - 0xe4]
je 0xc66edd
mov ecx, dword [ebp - 4]
jmp 0xc66f1c
cmp ecx, 0x377
jne 0xc66f15
mov eax, edx
and eax, 0x1b056c5e
lea edx, [eax - 0x17d06e7d]
inc ecx
cmp ecx, ebx
jb 0xc66f06
xor edx, 0x59b5b25d
mov eax, 0xc76620
lea ecx, [edx + 0x34b13823]
mov dword [ebp - 8], ecx
lea eax, [eax + 2]
add edx, 0x32ceb488
cmp word [eax], di
jne 0xc66f34
cmp word [ebp - 0x10], 0
je 0xc66f5d
mov eax, dword [ebp - 0xc]
lea eax, [eax + 2]
sub ecx, 0xb63a013
cmp word [eax], di
jne 0xc66f4c
mov dword [ebp - 8], ecx
push 0xc
mov ebx, edi
mov esi, 0xc6fe80
pop ecx
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
push 0x48
pop ecx
xor esi, esi
cmp cx, word [ebp - 0x40]
jne 0xc66fb9
mov eax, esi
test cx, cx
je 0xc66f97
cmp word [ebp + eax - 0x40], si
je 0xc66f97
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.HKEY_USERS]
cmp cx, word [ebp + eax - 0x40]
je 0xc66f79
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0xc66fb9
mov ecx, dword [ebp - 8]
cmp eax, 0x1d7a
jne 0xc66fae
lea ecx, [edx + 0x3f4e0904]
inc eax
lea edx, [ecx - 0x4bb5ef53]
cmp eax, ebx
jb 0xc66fa1
mov ebx, edx
mov eax, esi
and ebx, 0xf1b3b0f4
inc eax
cmp byte [eax + str.originatingContextMessage], 0
jne 0xc66fc3
mov ecx, dword [ebp - 4]
jmp 0xc66fe9
cmp ecx, 0xd9
jne 0xc66fe2
mov ebx, edx
and ebx, 0x4ad4759a
imul ebx, ebx, 0x3fb07161
inc ecx
cmp ecx, eax
jb 0xc66fd2
mov eax, esi
or ebx, 0xa33d212c
imul ebx, ebx, 0x3051966c
inc eax
cmp word [eax*2 + str.ext_ms_win_ole32_bindctx_l1_1_0.dll], si
jne 0xc66ff5
mov dword [ebp - 8], ebx
cmp eax, 0x134c
jae 0xc6701a
mov edx, ebx
and edx, 0x7af28f20
jmp 0xc67020
and edx, 0x4c56a7b8
mov eax, str.ext_ms_win_ole32_bindctx_l1_1_0.dll
lea eax, [eax + 2]
xor edx, 0xcf8cdfea
cmp word [eax], si
jne 0xc67025
mov eax, esi
mov dword [0xc78c9c], edx
push 7
pop ecx
mov esi, 0xc6ffe0
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0xc]
cmp cx, word [ebp - 0x30]
jne 0xc6707e
mov ecx, dword [ebp - 4]
movzx esi, cx
xor ecx, ecx
xor ebx, ebx
test si, si
je 0xc6707b
cmp word [ebp + ecx - 0x30], bx
je 0xc6707b
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + edi]
cmp si, word [ebp + ecx - 0x30]
je 0xc67060
mov ebx, dword [ebp - 8]
movzx ecx, byte [edi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x30]
sub ecx, eax
cmp ecx, 0x20a2
jbe 0xc67099
xor ebx, 0x5b5d53b4
jmp 0xc670a1
mov ebx, edx
or ebx, 0x45ee5d9f
pop edi
pop esi
mov dword [0xc78bf8], ebx
pop ebx
leave
ret