Function at 0xc67b1d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0xc78b80]
sub esp, 0xc8
push ebx
xor ebx, ebx
xor edx, 0xf74de6b4
push esi
mov eax, ebx
add edx, 0xd3ccbfe7
inc eax
cmp byte [eax + str.HKEY_DYN_DATA], bl
jne 0xc67b38
mov ecx, dword [ebp - 8]
cmp ecx, eax
jae 0xc67b6c
mov esi, edx
and esi, 0xd284462a
cmp ecx, 0x7d1
cmovne esi, edx
inc ecx
lea edx, [esi + 0x7279fc63]
mov esi, edx
cmp ecx, eax
jb 0xc67b50
mov ecx, ebx
add edx, 0xf8dceebe
xor edx, 0x960cb954
inc ecx
cmp byte [ecx + str.SrchIndexerClient], bl
jne 0xc67b74
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0xc67ba6
mov esi, edx
cmp eax, 0x10d9
jne 0xc67b99
imul edx, esi, 0x5d3c8a4f
add edx, 0x6d6e352d
inc eax
mov esi, edx
cmp eax, ecx
jb 0xc67b8c
push edi
push 6
pop ecx
mov esi, 0xc75ec0
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push 0x65
mov eax, ebx
xor edi, edi
pop ebx
cmp bx, word [ebp - 0x20]
jne 0xc67c06
mov esi, ebx
mov ecx, edi
test si, si
je 0xc67be3
cmp word [ebp + ecx - 0x20], di
je 0xc67be3
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.ext_ms_win_imm_l1_1_0]
cmp si, word [ebp + ecx - 0x20]
je 0xc67bc5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
jmp 0xc67c02
cmp eax, 0xe30
jne 0xc67bfb
add edx, 0x4ea75e73
imul edx, edx, 0x3e8a89d4
inc eax
cmp eax, ecx
jb 0xc67bee
mov eax, edi
mov esi, 0xc70564
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 8], 0x53
jne 0xc67c52
mov cl, 0x53
test cl, cl
je 0xc67c34
cmp byte [ebp + eax - 8], 0
je 0xc67c34
mov cl, byte [eax + 0xc76559]
inc eax
cmp cl, byte [ebp + eax - 8]
je 0xc67c1c
mov ecx, dword [ebp - 8]
jmp 0xc67c4e
cmp ecx, 0xba3
jne 0xc67c47
or edx, 0x83f94a16
sub edx, 0x43c8df0a
inc ecx
cmp ecx, eax
jb 0xc67c39
xor esi, esi
mov eax, esi
add edx, 0xb5a9a5e8
inc eax
cmp byte [eax + str.SrchIndexerClient], 0
jne 0xc67c56
cmp eax, 0x180e
jbe 0xc67c75
and edx, 0xaaa5e4d1
jmp 0xc67c7b
imul edx, edx, 0xad045562
mov eax, esi
lea edi, [ebp - 0x28]
push 7
pop ecx
mov esi, str.file_too_large
or edx, 0x9582c028
rep movsd dword es:[edi], dword [esi]
xor edx, 0xc6375e86
movsw word es:[edi], word [esi]
xor esi, esi
cmp bx, word [ebp - 0x28]
jne 0xc67ccb
mov ecx, ebx
mov ebx, eax
test cx, cx
je 0xc67cc2
cmp word [ebp + eax - 0x28], si
je 0xc67cc2
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.ext_ms_win_imm_l1_1_0]
cmp cx, word [ebp + eax - 0x28]
je 0xc67ca4
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
push 0x65
pop ebx
movzx ecx, byte [eax*2 + str.ext_ms_win_imm_l1_1_0]
movzx eax, byte [ebp + eax*2 - 0x28]
sub ecx, eax
cmp ecx, 0x1d07
jbe 0xc67cea
or edx, 0x5ba1258d
jmp 0xc67cf0
or edx, 0xc944c058
mov eax, esi
imul edx, edx, 0x2d65fca9
push 0x24
pop ecx
mov esi, str.pfps__psProperty.ulKind_is_LPWSTR_but_psProperty.lpwstr_is_NULL_or_empty
mov dword [ebp - 8], eax
lea edi, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
or edx, 0x7dd4e89e
movsw word es:[edi], word [esi]
xor esi, esi
cmp bx, word [ebp - 0xc8]
jne 0xc67d52
mov ecx, ebx
mov eax, esi
mov ebx, dword [ebp - 8]
test cx, cx
je 0xc67d49
cmp word [ebp + eax - 0xc8], si
je 0xc67d49
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.ext_ms_win_imm_l1_1_0]
cmp cx, word [ebp + eax - 0xc8]
je 0xc67d25
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
push 0x65
pop ebx
movzx ecx, byte [eax*2 + str.ext_ms_win_imm_l1_1_0]
movzx eax, byte [ebp + eax*2 - 0xc8]
sub ecx, eax
cmp ecx, 0x1d96
jne 0xc67d74
or edx, 0xb2a63b7c
jmp 0xc67d7a
add edx, 0x75c74bc0
push 0xb
mov eax, esi
mov dword [0xc78b80], edx
pop ecx
mov esi, 0xc70060
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
pop edi
cmp bx, word [ebp - 0x34]
jne 0xc67de3
xor esi, esi
mov ecx, esi
test bx, bx
je 0xc67db8
cmp word [ebp + ecx - 0x34], si
je 0xc67db8
inc eax
lea ecx, [eax + eax]
movzx ebx, word [ecx + str.ext_ms_win_imm_l1_1_0]
cmp bx, word [ebp + ecx - 0x34]
je 0xc67d9a
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
jae 0xc67de3
cmp eax, 0x22fb
jne 0xc67dd2
imul edx, edx, 0xed6e4663
add edx, 0x536685af
inc eax
cmp eax, ecx
jb 0xc67dc5
mov dword [0xc78b80], edx
pop esi
pop ebx
leave
ret