Function at 0xc68168
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x490
push esi
push edi
mov esi, str.SrchCollatorCxn
mov dword [ebp - 0x158], edx
lea edi, [ebp - 0x90]
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x38], 0x54d80043
mov dword [ebp - 0x34], 0xfe965122
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], 0x806d53d4
mov dword [ebp - 0x2c], 0xd2c35b43
mov dword [ebp - 0x28], 0x471044df
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x24], 0xa56a7cc6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x2d8], al
inc eax
cmp eax, 0x100
jb 0xc681ce
xor esi, esi
mov dword [ebp - 0x14], 0xf
xor edx, edx
mov cl, byte [ebp + esi - 0x2d8]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0x14]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x90]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x2d8]
mov byte [ebp + esi - 0x2d8], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x2d8], al
cmp esi, 0x100
jb 0xc681e6
mov esi, dword [0xc78ba0]
xor ecx, ecx
push 0x49
xor edi, edi
mov dword [ebp - 0xc], esi
and dword [ebp - 0x10], ecx
pop edx
lea eax, [ecx + 1]
mov esi, 0xc700e8
movzx eax, al
mov dword [ebp - 0x1c], eax
push 5
pop ecx
mov al, byte [ebp + eax - 0x2d8]
mov byte [ebp - 1], al
movzx eax, al
mov dword [ebp - 0x18], eax
add eax, edi
lea edi, [ebp - 0x98]
movzx eax, al
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x98], dl
jne 0xc682a7
mov cl, dl
test cl, cl
je 0xc682a7
cmp byte [ebp + eax - 0x98], 0
je 0xc682a7
call fcn.00c671ed
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov cl, byte [eax + str.IsWow64Process]
cmp cl, byte [ebp + eax - 0x98]
je 0xc6827e
mov ecx, str.IsWow64Process
call fcn.00c67462
mov ecx, dword [ebp - 8]
movzx eax, byte [ebp + ecx - 0x98]
movzx ecx, byte [ecx + str.IsWow64Process]
sub ecx, eax
cmp ecx, 0xf8f
jne 0xc682db
call fcn.00c671ed
add dword [ebp - 0xc], 0x6264605f
jmp 0xc682e7
call fcn.00c671ed
add dword [ebp - 0xc], 0x1420eae
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
push 0x49
mov al, byte [ebp + edi - 0x2d8]
mov byte [ebp + ecx - 0x2d8], al
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x2d8], al
movzx eax, byte [ebp + ecx - 0x2d8]
add eax, dword [ebp - 0x18]
movzx eax, al
mov al, byte [ebp + eax - 0x2d8]
xor al, byte [ebp + edx - 0x38]
mov byte [ebp + edx - 0x3f4], al
inc edx
mov dword [ebp - 0x10], edx
cmp edx, 0x18
pop edx
jb 0xc6823d
push 0x16
pop eax
push 5
pop ecx
mov esi, str.SrchCollatorProperties
mov byte [ebp - 0x3dc], 0
lea edi, [ebp - 0x98]
mov dword [ebp - 0x38], 0x5cc0b21f
rep movsd dword es:[edi], dword [esi]
mov ecx, str.IsWow64Process
mov word [ebp - 0x34], 0x8b49
mov byte [ebp - 0x32], 0xee
mov dword [ebp - 0x14], eax
movsw word es:[edi], word [esi]
mov byte [ebp - 0x31], al
mov dword [ebp - 0x30], 0xd32043db
mov dword [ebp - 0x2c], 0x7569228d
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x28], 0x589a843c
xor edi, edi
mov dword [ebp - 0x24], 0x7b279806
call fcn.00c67462
xor eax, eax
mov byte [ebp + eax - 0x2d8], al
inc eax
cmp eax, 0x100
jb 0xc68396
xor esi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0x2d8]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0x14]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x98]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x2d8]
mov byte [ebp + esi - 0x2d8], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x2d8], al
cmp esi, 0x100
jb 0xc683a7
add dword [ebp - 0xc], 0x8f84a26e
xor esi, esi
and dword [ebp - 8], 0
xor edi, edi
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + esi - 0x2d8]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x2d8]
mov byte [ebp + esi - 0x2d8], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x2d8], cl
movzx eax, byte [ebp + esi - 0x2d8]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x2d8]
xor al, byte [ebp + edi - 0x38]
mov byte [ebp + edi - 0x1d0], al
inc edi
cmp edi, 0x18
jb 0xc683fa
add dword [ebp - 0xc], 0x69094a30
lea edi, [ebp - 0x1b0]
and dword [ebp - 8], 0
mov esi, str.Processed_ContentSnippet_for__s__Indexing_Content:__d__has_file_IFilter:__d
push 0xf
pop eax
push 0x39
mov byte [ebp - 0x74], al
pop eax
push 0xe
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x3c], al
pop eax
push 0x13
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x2e], al
xor eax, eax
mov byte [ebp - 0x1b8], 0
mov dword [ebp - 0x78], 0x981a0761
mov dword [ebp - 0x73], 0xeee8ea6e
mov dword [ebp - 0x6f], 0xfb29c0d5
mov dword [ebp - 0x6b], 0xa280d173
mov dword [ebp - 0x67], 0x213ebe70
mov dword [ebp - 0x63], 0x58804993
mov dword [ebp - 0x5f], 0x10ac64d5
mov dword [ebp - 0x5b], 0x9e4df0e0
mov dword [ebp - 0x57], 0xe2d7641f
mov dword [ebp - 0x53], 0x71d452ac
mov dword [ebp - 0x4f], 0xcc9cde1f
mov dword [ebp - 0x4b], 0xe15925c6
mov dword [ebp - 0x47], 0x522210a7
mov dword [ebp - 0x43], 0xefed8242
mov word [ebp - 0x3f], 0x2faa
mov byte [ebp - 0x3d], 0xc7
mov dword [ebp - 0x3b], 0x746c7207
mov dword [ebp - 0x37], 0xc56b2bde
mov dword [ebp - 0x33], 0x85fe1c98
mov byte [ebp - 0x2f], 0xb6
mov dword [ebp - 0x2d], 0xb7cedab2
mov dword [ebp - 0x29], 0x2c92d588
mov dword [ebp - 0x25], 0x488ebcc
mov byte [ebp - 0x21], 0xfb
rep movsd dword es:[edi], dword [esi]
mov byte [ebp + eax - 0x2d8], al
inc eax
cmp eax, 0x100
jb 0xc6852c
mov esi, dword [ebp - 0xc]
xor edi, edi
mov dword [ebp - 0x10], edi
mov cl, byte [ebp + edi - 0x2d8]
mov eax, edi
push 0x4b
xor edx, edx
mov byte [ebp - 1], cl
pop edi
div edi
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x1b0]
add eax, dword [ebp - 8]
add ecx, eax
movzx eax, cl
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.00c670ac
mov edi, str.IsWow64Process
call fcn.00c66b7a
imul esi, esi, 0x99db9344
inc edi
cmp byte [edi], 0
jne 0xc68578
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
mov al, byte [ebp + ecx - 0x2d8]
mov byte [ebp + edi - 0x2d8], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + ecx - 0x2d8], al
mov dword [ebp - 0x10], edi
cmp edi, 0x100
jb 0xc68543
and dword [ebp - 8], 0
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + edi - 0x2d8]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x2d8]
mov byte [ebp + edi - 0x2d8], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x2d8], cl
movzx eax, byte [ebp + edi - 0x2d8]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x2d8]
xor al, byte [ebp + esi - 0x78]
mov byte [ebp + esi - 0x490], al
inc esi
cmp esi, 0x58
jb 0xc685be
mov esi, 0xc6f58c
mov byte [ebp - 0x438], 0
lea edi, [ebp - 0x90]
mov dword [ebp - 0x38], 0xc1f26c88
push 0xd
pop eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x2e], al
push 0x39
movsd dword es:[edi], dword [esi]
pop eax
mov byte [ebp - 0x28], al
mov dword [ebp - 0x34], 0x4e2e885
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x30], 0x1396
mov dword [ebp - 0x2d], 0x9a15aa2
mov byte [ebp - 0x29], 0xc9
movsw word es:[edi], word [esi]
mov dword [ebp - 0x27], 0xf6fadd58
mov word [ebp - 0x23], 0x2ee7
mov byte [ebp - 0x21], 0xc6
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x2d8], al
inc eax
cmp eax, 0x100
jb 0xc68674
xor esi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0x2d8]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0x14]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x90]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x2d8]
mov byte [ebp + esi - 0x2d8], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x2d8], al
cmp esi, 0x100
jb 0xc68685
and dword [ebp - 8], 0
xor eax, eax
mov esi, dword [ebp - 0xc]
xor edi, edi
inc eax
movzx eax, al
mov dword [ebp - 0x18], eax
mov cl, byte [ebp + eax - 0x2d8]
mov eax, dword [ebp - 8]
movzx edx, cl
add eax, edx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x18]
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x2d8]
mov byte [ebp + edx - 0x2d8], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x2d8], cl
mov eax, edx
movzx eax, byte [ebp + eax - 0x2d8]
add eax, dword [ebp - 0x14]
movzx eax, al
mov al, byte [ebp + eax - 0x2d8]
mov byte [ebp - 1], al
call fcn.00c6710f
xor eax, eax
mov dword [ebp - 0x10], eax
cmp byte [str.CallContext:__hs_], al
je 0xc6874d
imul esi, esi, 0xde8ad242
inc eax
cmp byte [eax + str.CallContext:__hs_], 0
jne 0xc6873a
mov dword [ebp - 0x10], eax
push str.ext_ms_win_imm_l1_1_1
mov ecx, str.CallContext:__hs_
call fcn.00c67921
cmp dword [ebp - 0x10], 0x2008
pop ecx
jbe 0xc68775
and esi, 0xa1f88625
mov ecx, esi
call fcn.00c670ac
jmp 0xc6877b
sub esi, 0x7519a066
mov al, byte [ebp + edi - 0x38]
xor al, byte [ebp - 1]
mov byte [ebp + edi - 0x410], al
inc edi
mov eax, dword [ebp - 0x18]
cmp edi, 0x18
jb 0xc686d4
push 0xb
pop eax
push 0xe
pop ecx
mov dword [ebp - 0xc], esi
lea edi, [ebp - 0x1a0]
and dword [ebp - 0x14], 0
mov esi, 0xc71764
mov byte [ebp - 0xf4], cl
rep movsd dword es:[edi], dword [esi]
push 0x16
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x13f], al
pop eax
mov byte [ebp - 0xc9], al
push 0x39
pop eax
mov byte [ebp - 0x3f8], 0
mov dword [ebp - 0x150], 0x1e7ac2f8
mov dword [ebp - 0x14c], 0x76e03831
mov dword [ebp - 0x148], 0x1ab02931
mov dword [ebp - 0x144], 0x56b19095
mov byte [ebp - 0x140], 0xf8
mov dword [ebp - 0x13e], 0xe0260103
mov dword [ebp - 0x13a], 0x94c02397
mov dword [ebp - 0x136], 0x205f3be5
mov dword [ebp - 0x132], 0xaf4ddc95
mov dword [ebp - 0x12e], 0x212e543b
mov dword [ebp - 0x12a], 0xcd3dc50a
mov dword [ebp - 0x126], 0x799043b2
mov dword [ebp - 0x122], 0x5f5a9123
mov dword [ebp - 0x11e], 0xa06fdcc8
mov dword [ebp - 0x11a], 0x9fb50579
mov dword [ebp - 0x116], 0xaa02dbd0
mov dword [ebp - 0x112], 0xad106875
mov dword [ebp - 0x10e], 0x4c1a7a5c
mov dword [ebp - 0x10a], 0x7bd8dbf0
mov dword [ebp - 0x106], 0x52c4b2d0
mov dword [ebp - 0x102], 0xe5304668
mov dword [ebp - 0xfe], 0xf9dc0c27
mov dword [ebp - 0xfa], 0x5033a887
mov word [ebp - 0xf6], 0x5be2
mov dword [ebp - 0xf3], 0x9da6620c
mov dword [ebp - 0xef], 0xb27de8c2
mov dword [ebp - 0xeb], 0xa173ac1d
mov dword [ebp - 0xe7], 0x252b68a6
mov dword [ebp - 0xe3], 0x3a304c77
mov dword [ebp - 0xdf], 0x2287893d
mov dword [ebp - 0xdb], 0x2545a6db
mov dword [ebp - 0xd7], 0x783b2ab
mov dword [ebp - 0xd3], 0x5b673802
mov dword [ebp - 0xcf], 0x332743fb
mov word [ebp - 0xcb], 0xd232
mov dword [ebp - 0xc8], 0x31b53d8a
mov dword [ebp - 0xc4], 0xdb222f9b
mov byte [ebp - 0xc0], al
mov dword [ebp - 0xbf], 0xe93d5181
mov dword [ebp - 0xbb], 0xcef5f880
mov dword [ebp - 0xb7], 0x20714c72
mov dword [ebp - 0xb3], 0xa1cf9479
mov dword [ebp - 0xaf], 0xfe4a36d1
mov dword [ebp - 0xab], 0xa87da62a
mov word [ebp - 0xa7], 0x48cd
mov byte [ebp - 0xa5], 0x6a
movsw word es:[edi], word [esi]
call fcn.00c671ed
mov cl, byte [str.RtlQueryFeatureConfiguration]
lea edi, [ebp - 0x30]
mov esi, str.not_supported
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp cl, byte [ebp - 0x30]
jmp 0xc689d0
test cl, cl
je 0xc689d5
cmp byte [ebp + eax - 0x30], 0
je 0xc689d5
call fcn.00c67b1d
mov eax, dword [ebp - 8]
inc eax
mov cl, byte [eax + str.RtlQueryFeatureConfiguration]
cmp cl, byte [ebp + eax - 0x30]
mov dword [ebp - 8], eax
je 0xc689b2
call fcn.00c66c96
mov edi, dword [ebp - 8]
cmp dword [ebp - 8], edi
jae 0xc68a12
mov esi, dword [ebp - 0xc]
call fcn.00c67f6c
cmp dword [ebp - 8], 0x545
jne 0xc689f9
xor esi, 0x7c35fb80
add esi, 0x23865dff
call fcn.00c66b7a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, edi
jb 0xc689e5
mov dword [ebp - 0xc], esi
xor eax, eax
mov byte [ebp + eax - 0x3d8], al
inc eax
cmp eax, 0x100
jb 0xc68a14
mov esi, dword [ebp - 0x14]
xor edi, edi
xor edx, edx
mov cl, byte [ebp + edi - 0x3d8]
mov eax, edi
mov byte [ebp - 1], cl
div dword [ebp - 0x1c]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x1a0]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x3d8]
mov byte [ebp + edi - 0x3d8], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + esi - 0x3d8], al
cmp edi, 0x100
jb 0xc68a28
imul esi, dword [ebp - 0xc], 0xab65ab8a
xor edx, edx
xor edi, edi
and dword [ebp - 0xc], edx
mov dword [ebp - 0x20], esi
lea eax, [edx + 1]
movzx eax, al
mov dword [ebp - 0x1c], eax
mov al, byte [ebp + eax - 0x3d8]
mov byte [ebp - 1], al
movzx eax, al
mov dword [ebp - 0x7c], eax
add eax, edi
movzx eax, al
mov dword [ebp - 0x14], eax
call fcn.00c671ed
xor edi, edi
cmp byte [str.CallContext:__hs_], 0
je 0xc68b1c
call fcn.00c67f6c
xor esi, 0x65e5dce0
inc edi
cmp byte [edi + str.CallContext:__hs_], 0
jne 0xc68aae
mov dword [ebp - 0x20], esi
cmp dword [ebp - 8], edi
jae 0xc68b1c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call fcn.00c671ed
cmp dword [ebp - 8], 0x270f
mov esi, dword [ebp - 0x10]
jne 0xc68afb
push 0xc736d0
mov ecx, str.RtlQueryFeatureConfiguration
call fcn.00c67921
mov esi, dword [ebp - 0x18]
pop ecx
and esi, 0x8a4d43ef
xor esi, 0xb9506c2b
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call fcn.00c671ed
mov eax, dword [ebp - 8]
mov ecx, esi
inc eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
cmp eax, edi
jb 0xc68ad1
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + edi - 0x3d8]
mov byte [ebp + edx - 0x3d8], al
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x3d8], al
movzx eax, byte [ebp + edx - 0x3d8]
add eax, dword [ebp - 0x7c]
movzx eax, al
mov al, byte [ebp + eax - 0x3d8]
xor al, byte [ebp + ecx - 0x150]
mov byte [ebp + ecx - 0x288], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, 0xac
jb 0xc68a7d
and dword [ebp - 0x7c], 0
lea edi, [ebp - 0x2c]
mov esi, str.file_exists
mov byte [ebp - 0x1dc], 0
push 0xb
pop eax
mov byte [ebp - 0x93], al
imul eax, dword [ebp - 0x20], 0x6d1d0ac8
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x98], 0xcbb15801
mov byte [ebp - 0x94], 0x3f
mov dword [ebp - 0x92], 0xd57c555d
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8e], 0xd75bf39a
mov dword [ebp - 0x8a], 0x4ca6eec9
mov dword [ebp - 0x86], 0xc82c2b5c
movsd dword es:[edi], dword [esi]
mov esi, 0x99f47e9c
mov word [ebp - 0x82], 0x1469
sub esi, eax
xor eax, eax
mov dword [ebp - 0x14], esi
mov dword [0xc78ba0], esi
mov byte [ebp + eax - 0x3d8], al
inc eax
cmp eax, 0x100
jb 0xc68bea
mov esi, dword [ebp - 0x7c]
xor edi, edi
xor edx, edx
mov cl, byte [ebp + edi - 0x3d8]
mov eax, edi
mov byte [ebp - 1], cl
div dword [ebp - 0x80]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x2c]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x3d8]
mov byte [ebp + edi - 0x3d8], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + esi - 0x3d8], al
cmp edi, 0x100
jb 0xc68bfe
and dword [ebp - 8], 0
xor eax, eax
and dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x14]
inc eax
movzx edi, al
mov eax, dword [ebp - 8]
mov dword [ebp - 0x7c], edi
mov cl, byte [ebp + edi - 0x3d8]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x3d8]
mov byte [ebp + edi - 0x3d8], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x3d8], cl
movzx eax, byte [ebp + edi - 0x3d8]
xor edi, edi
add eax, edx
cmp byte [str.CallContext:__hs_], 0
movzx eax, al
mov al, byte [ebp + eax - 0x3d8]
mov byte [ebp - 1], al
je 0xc68cec
call fcn.00c67f6c
and esi, 0x4014d783
inc edi
cmp byte [edi + str.CallContext:__hs_], 0
jne 0xc68ca1
mov eax, dword [ebp - 0x80]
mov dword [0xc78ba0], esi
cmp eax, edi
jae 0xc68cec
mov ecx, esi
mov edx, esi
cmp eax, 0xad0
jne 0xc68cd4
lea edx, [ecx + 0x90c759a]
imul esi, edx, 0xe53618ef
inc eax
mov dword [0xc78ba0], esi
mov ecx, esi
mov edx, ecx
cmp eax, edi
jb 0xc68cc7
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x10]
mov al, byte [ebp + ecx - 0x98]
xor al, byte [ebp - 1]
mov byte [ebp + ecx - 0x42c], al
inc ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10], ecx
cmp ecx, 0x18
jb 0xc68c4b
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x3f4]
mov byte [ebp - 0x414], 0
call fcn.00c4d02f
mov edi, eax
xor ecx, ecx
mov edx, edi
call fcn.00c4d470
mov ecx, dword [ebx + 0xc]
lea edx, [ebp - 0x1d0]
mov dword [ebp - 0x80], eax
call fcn.00c4d364
test eax, eax
jne 0xc68d52
mov edx, edi
xor ecx, ecx
call fcn.00c4d470
mov dword [ebp - 0x14], eax
mov edx, edi
xor ecx, ecx
call fcn.00c4d470
mov edx, edi
mov dword [ebp - 0x1c], eax
xor ecx, ecx
call fcn.00c4d470
mov edx, edi
xor ecx, ecx
mov esi, eax
call fcn.00c4d470
add dword [0xc78ba0], 0x4a790a59
mov ecx, edi
mov dword [ebp - 0x7c], eax
call fcn.00c4d309
push eax
push 0
push edi
call fcn.00c4cf49
add esp, 0xc
mov ecx, edi
call fcn.00c4ba07
mov ecx, esi
call fcn.00c4d5c1
mov esi, 0x208
mov dword [ebp - 0x1b4], eax
mov ecx, esi
call fcn.00c4b9d3
mov ecx, esi
mov dword [ebp - 0x20], eax
call fcn.00c4b9d3
mov ecx, esi
mov dword [ebp - 0xc], eax
call fcn.00c4b9d3
mov esi, eax
mov ecx, 0x800
mov dword [ebp - 0x18], esi
call fcn.00c4b9d3
mov edi, eax
mov ecx, 0x500000
mov dword [ebp - 0x154], edi
call fcn.00c4b9d3
cmp dword [ebp - 0xc], 0
mov dword [ebp - 8], eax
je 0xc692b7
test esi, esi
je 0xc692b7
test eax, eax
je 0xc692b7
test edi, edi
je 0xc692b7
cmp dword [ebp - 0x20], 0
je 0xc692b7
mov edx, dword [ebp - 0x80]
mov ecx, edx
call fcn.00c4d309
mov ecx, dword [ebp - 0xc]
push eax
call fcn.00c4d13f
mov edx, dword [ebp - 0x7c]
pop ecx
mov ecx, edx
call fcn.00c4d309
mov ecx, dword [ebp - 0x20]
push eax
call fcn.00c4d13f
pop ecx
lea ecx, [ebp - 0x490]
call fcn.00c4d02f
push dword [ebx + 8]
mov esi, eax
lea edx, [ebp - 0x410]
push dword [ebp - 0x1c]
push dword [ebp - 0x158]
push esi
push dword [ebx + 0x10]
push 2
pop ecx
call fcn.00c4ba1b
call eax
add esp, 0x14
mov ecx, esi
call fcn.00c4d309
push eax
push 0
push esi
call fcn.00c4cf49
add esp, 0xc
mov ecx, esi
call fcn.00c4ba07
mov esi, dword [ebx + 0x10]
mov ecx, esi
call fcn.00c4d309
mov edx, dword [ebx + 0x18]
push eax
call fcn.00c4a061
pop ecx
mov ecx, dword [ebp - 0x15c]
lea edx, [ebp - 0x288]
push 1
push dword [ebx + 0x18]
push dword [ebp - 8]
push esi
call fcn.00c4e687
push 0x100000
push 0
push esi
mov dword [ebp - 0x10], eax
call fcn.00c4cf49
add esp, 0x1c
cmp dword [ebp - 0x10], 0
jne 0xc691d7
mov esi, 0xc7253c
mov cl, byte [str.CallContext:__hs_]
lea edi, [ebp - 0x90]
mov dword [ebp - 0x190], 0x646808ec
xor eax, eax
mov dword [ebp - 0x18c], 0x48b82e2f
mov dword [ebp - 0x188], 0x5b305de5
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x184], 0xc46f3404
mov dword [ebp - 0x180], 0xfabb4149
mov dword [ebp - 0x17c], 0xc6cb08c9
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x178], 0x7b1fba4c
mov dword [ebp - 0x174], 0xd1148da8
mov dword [ebp - 0x170], 0x8b5564d2
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x16c], 0x751a70d8
mov dword [ebp - 0x168], 0x6ade254c
movsw word es:[edi], word [esi]
mov esi, 0xc6f308
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp cl, byte [ebp - 0x2c]
jne 0xc68fc7
test cl, cl
je 0xc68f83
cmp byte [ebp + eax - 0x2c], 0
je 0xc68f83
mov cl, byte [eax + 0xc78be1]
inc eax
cmp cl, byte [ebp + eax - 0x2c]
je 0xc68f6b
mov edi, dword [ebp - 0x154]
mov dword [ebp - 0x10], eax
cmp edi, eax
jae 0xc68fc7
mov esi, eax
mov edx, 0xc6f0d0
mov ecx, str.onecoreuap_base_appmodel_searchcommon_tracer_tracersecutil.h
call fcn.00c66dcd
mov eax, dword [0xc78ba0]
cmp edi, 0x18eb
jne 0xc68fb3
sub eax, 0x62dc34fd
add eax, 0xe22321d
mov dword [0xc78ba0], eax
call fcn.00c672a8
inc edi
cmp edi, esi
jb 0xc68f92
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x3d8], al
inc eax
cmp eax, 0x100
jb 0xc68fcb
xor esi, esi
xor edx, edx
mov cl, byte [ebp + esi - 0x3d8]
mov eax, esi
mov byte [ebp - 1], cl
div dword [ebp - 0x9c]
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x90]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x3d8]
mov byte [ebp + esi - 0x3d8], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x3d8], al
cmp esi, 0x100
jb 0xc68fdc
mov edx, dword [0xc78ba0]
mov ecx, 0xc6f1a0
and dword [ebp - 0x10], 0
and dword [ebp - 0x80], 0
mov dword [ebp - 0x9c], edx
call fcn.00c67de7
push 7
pop ecx
mov esi, 0xc760ec
lea edi, [ebp - 0x1d4]
rep movsd dword es:[edi], dword [esi]
push 0x49
xor eax, eax
pop ecx
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x1c], eax
cmp byte [ebp - 0x1d4], cl
jne 0xc69083
test cl, cl
je 0xc69080
cmp byte [ebp + eax - 0x1d4], 0
je 0xc69080
mov cl, byte [eax + 0xc768d5]
inc eax
cmp cl, byte [ebp + eax - 0x1d4]
je 0xc69062
mov dword [ebp - 0x1c], eax
call fcn.00c66b7a
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jae 0xc690d2
mov esi, dword [ebp - 0x9c]
cmp eax, 0x546
jne 0xc690b4
add esi, 0x6025ce49
push str._hs__u__hs__p:
push esi
mov ecx, esi
call fcn.00c67779
pop ecx
pop ecx
add esi, 0xf2a8026
mov ecx, esi
call fcn.00c670ac
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, edi
jb 0xc69098
mov dword [0xc78ba0], esi
mov edi, dword [ebp - 0x80]
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + edi - 0x3d8]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x10], eax
mov al, byte [ebp + eax - 0x3d8]
mov byte [ebp + edi - 0x3d8], al
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x3d8], cl
movzx eax, byte [ebp + edi - 0x3d8]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x3d8]
xor al, byte [ebp + esi - 0x190]
mov byte [ebp + esi - 0x50], al
inc esi
cmp esi, 0x2c
jb 0xc690d7
push 0x400
push dword [ebp - 0x18]
xor ecx, ecx
mov byte [ebp - 0x24], 0
push dword [ebp - 0xc]
lea edx, [ebp - 0x50]
inc ecx
call fcn.00c4ba1b
call eax
mov ecx, dword [0xc78ba0]
xor eax, eax
or ecx, 0xfb5477eb
inc eax
cmp byte [eax + str.IsWow64Process], 0
jne 0xc69153
mov edi, dword [ebp - 0x154]
mov dword [0xc78ba0], ecx
mov dword [ebp - 0x9c], eax
cmp edi, eax
jae 0xc691b1
call fcn.00c672a8
mov esi, dword [0xc78ba0]
cmp edi, 0x3d2
jne 0xc6919c
mov ecx, str.CallContext:__hs_
and esi, 0xe3a3f3d
call fcn.00c67462
xor esi, 0x79e50142
inc edi
mov dword [0xc78ba0], esi
cmp edi, dword [ebp - 0x9c]
jb 0xc69179
push dword [ebp - 0x20]
mov edx, dword [ebp - 8]
push dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebx + 0xc]
call fcn.00c5fed2
mov edi, dword [ebp - 0x154]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov esi, 0x208
push esi
push 0
push dword [ebp - 0x20]
call fcn.00c4cf49
add esp, 0xc
push esi
push 0
push dword [ebp - 0xc]
call fcn.00c4cf49
add esp, 0xc
push esi
push 0
push dword [ebp - 0x18]
call fcn.00c4cf49
add esp, 0xc
push 0x500000
push 0
push dword [ebp - 8]
call fcn.00c4cf49
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.00c4d02f
mov esi, eax
mov ecx, esi
call fcn.00c4d309
push eax
push esi
push edi
call fcn.00c4cef6
add esp, 0xc
mov ecx, esi
call fcn.00c4d309
push eax
push 0
push esi
call fcn.00c4cf49
add esp, 0xc
mov ecx, esi
call fcn.00c4ba07
mov ecx, edi
call fcn.00c4d309
mov edx, dword [ebx + 0x18]
push eax
call fcn.00c4a061
mov edx, dword [ebp - 0x158]
pop ecx
push dword [ebx + 0x18]
mov ecx, dword [ebp - 0x15c]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebp - 0x10]
push edi
push dword [ebx + 8]
call fcn.00c4faec
mov esi, 0x100000
push esi
push 0
push dword [ebx + 0x10]
call fcn.00c4cf49
add esp, 0x24
push esi
push 0
push dword [ebx + 0x18]
call fcn.00c4cf49
add esp, 0xc
push 0x800
push 0
push edi
call fcn.00c4cf49
mov esi, dword [ebp - 0x18]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
call fcn.00c4ba07
mov ecx, esi
call fcn.00c4ba07
mov ecx, dword [ebp - 0x20]
call fcn.00c4ba07
mov ecx, dword [ebp - 8]
call fcn.00c4ba07
mov ecx, edi
call fcn.00c4ba07
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret