Function at 0xc5eda6
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
push ebx
push esi
push edi
mov esi, 0xc700ac
mov dword [ebp - 0x94], ecx
lea edi, [ebp - 0x54]
mov dword [ebp - 0x84], 0xf1d8c11b
xor ecx, ecx
mov dword [ebp - 0x80], 0x597abdb3
mov dword [ebp - 0x7c], 0x147bfaf2
mov eax, ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x78], 0x620d47fa
mov dword [ebp - 0x74], 0x95cde5f8
mov dword [ebp - 0x70], 0x4d9e054c
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6c], 0xf28b1fcb
mov dword [ebp - 0x68], 0xbb0593fc
mov dword [ebp - 0x64], 0xfd7dcf31
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x60], 0xf7d989af
mov dword [ebp - 0x5c], 0x8120994f
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ecx
mov byte [ebp + eax - 0x194], al
inc eax
cmp eax, 0x100
jb 0xc5ee1c
mov esi, ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x194]
push 0x11
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x54]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x194]
mov byte [ebp + esi - 0x194], al
inc esi
mov byte [ebp + edi - 0x194], bl
cmp esi, 0x100
jb 0xc5ee2d
xor eax, eax
mov edx, eax
mov ecx, eax
mov ebx, eax
lea eax, [ecx + 1]
movzx ecx, al
push ecx
mov dword [ebp - 0x34], ecx
mov al, byte [ebp + ecx - 0x194]
mov byte [ebp - 0x35], al
movzx eax, al
mov dword [ebp - 0x3c], eax
add eax, edx
movzx eax, al
mov dword [ebp - 0x40], eax
mov al, byte [ebp + eax - 0x194]
mov byte [ebp + ecx - 0x194], al
call fcn.00c5e1b9
mov al, byte [str.SrchSamplePI]
lea edi, [ebp - 0x2c]
pop ecx
push 5
pop ecx
mov esi, str.result_out_of_range
xor edx, edx
rep movsd dword es:[edi], dword [esi]
cmp al, byte [ebp - 0x2c]
jne 0xc5eed9
test al, al
je 0xc5eed9
cmp byte [ebp + edx - 0x2c], 0
je 0xc5eed9
mov al, byte [edx + 0xc78915]
inc edx
cmp al, byte [ebp + edx - 0x2c]
je 0xc5eec1
movzx eax, byte [ebp + edx - 0x2c]
movzx ecx, byte [edx + str.SrchSamplePI]
sub ecx, eax
cmp ecx, 0x1c22
jae 0xc5ef08
mov ecx, dword [0xc7892c]
mov eax, ecx
or eax, 0xa239e867
mov dword [0xc78984], eax
call fcn.00c5e874
jmp 0xc5ef1c
mov eax, dword [0xc7892c]
or eax, 0x1f9941dd
mov dword [0xc78984], eax
call fcn.00c5ea8b
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
mov al, byte [ebp - 0x35]
mov byte [ebp + edx - 0x194], al
movzx eax, byte [ebp + ecx - 0x194]
add eax, dword [ebp - 0x3c]
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + ebx - 0x84]
mov byte [ebp + ebx - 0x250], al
inc ebx
cmp ebx, 0x2c
jb 0xc5ee72
push 5
pop ecx
mov esi, str.read_only_file_system
mov dword [ebp - 0x58], 0x656ce9a2
lea edi, [ebp - 0x30]
mov dword [ebp - 0x54], 0x61665d22
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 0x50], 0xbeb3c053
mov byte [ebp - 0x224], bl
mov dword [ebp - 0x4c], 0xd110e469
mov dword [ebp - 0x48], 0x32d6c6cd
mov dword [ebp - 0x44], 0x23f34867
movsw word es:[edi], word [esi]
call fcn.00c5e9ca
mov esi, 0xc6f51c
lea edi, [ebp - 0x90]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x90], 0x6f
jne 0xc5efe1
mov al, 0x6f
test al, al
je 0xc5efe1
cmp byte [ebp + ebx - 0x90], 0
je 0xc5efe1
push ecx
push ecx
call fcn.00c5e768
mov al, byte [ebx + 0xc74ad1]
inc ebx
pop ecx
pop ecx
cmp al, byte [ebp + ebx - 0x90]
je 0xc5efba
movzx eax, byte [ebp + ebx - 0x90]
movzx esi, byte [ebx + str.onecoreuap_baseAppModelSearchcommonincludeeventsem_common.hxx]
sub esi, eax
call fcn.00c5e5a4
cmp esi, 0x179d
jne 0xc5f018
mov eax, dword [0xc78984]
xor eax, 0x75d9a11e
mov dword [ebp - 0x34], eax
mov dword [0xc78984], eax
call fcn.00c5e28c
jmp 0xc5f034
mov ebx, dword [0xc7892c]
and ebx, 0x9bee9e17
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov dword [0xc78984], ebx
call fcn.00c5e874
xor eax, eax
mov edi, eax
mov ebx, eax
call fcn.00c5e9ca
mov byte [ebp + ebx - 0x194], bl
inc ebx
cmp ebx, 0x100
jb 0xc5f03a
push 0x15
xor esi, esi
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x194]
mov eax, esi
div ecx
movzx ecx, bl
push 0x15
movzx eax, byte [ebp + edx - 0x30]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x194]
mov byte [ebp + esi - 0x194], al
inc esi
mov byte [ebp + edi - 0x194], bl
cmp esi, 0x100
jb 0xc5f054
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x194]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x194]
mov byte [ebp + edi - 0x194], al
mov byte [ebp + ebx - 0x194], cl
movzx eax, byte [ebp + edi - 0x194]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + esi - 0x58]
mov byte [ebp + esi - 0x1e8], al
inc esi
cmp esi, 0x18
jb 0xc5f099
mov esi, str.interrupted
mov dword [ebp - 0x30], 0x28bb1591
lea edi, [ebp - 0x90]
mov dword [ebp - 0x2c], 0x3a63eafd
xor ecx, ecx
mov dword [ebp - 0x28], 0xba132853
mov byte [ebp - 0x1d0], cl
mov eax, ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x24], 0xd2483495
mov dword [ebp - 0x20], 0xe4089d75
mov dword [ebp - 0x1c], 0xae29ee43
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov byte [ebp + eax - 0x194], al
inc eax
cmp eax, 0x100
jb 0xc5f12d
push 0xb
mov esi, ecx
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x194]
mov eax, esi
div ecx
movzx ecx, bl
push 0xb
movzx eax, byte [ebp + edx - 0x90]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x194]
mov byte [ebp + esi - 0x194], al
inc esi
mov byte [ebp + edi - 0x194], bl
cmp esi, 0x100
jb 0xc5f141
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x194]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x194]
mov byte [ebp + edi - 0x194], al
mov byte [ebp + ebx - 0x194], cl
movzx eax, byte [ebp + edi - 0x194]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + esi - 0x30]
mov byte [ebp + esi - 0x74], al
inc esi
cmp esi, 0x18
jb 0xc5f189
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
mov byte [ebp - 0x5c], bl
mov eax, ebx
imul esi, ecx, 0xae64fa93
inc eax
cmp word [eax*2 + 0xc74bd0], bx
jne 0xc5f1e6
cmp eax, 0x103
jae 0xc5f215
mov eax, ecx
push ecx
or eax, 0xb337c3b0
push ecx
mov dword [0xc7892c], eax
call fcn.00c5e2ec
mov esi, dword [0xc78984]
pop ecx
pop ecx
jmp 0xc5f221
or esi, 0xf0d2b423
mov dword [0xc78984], esi
push ecx
push ecx
call fcn.00c5e768
pop ecx
or esi, 0x510a79ae
mov edi, str.onecoreuap_baseAppModelSearchcommonincludeeventsem_common.hxx
pop ecx
mov dword [0xc7892c], esi
call fcn.00c5e06e
inc edi
cmp byte [edi], bl
jne 0xc5f23b
mov dword [ebp - 0x47c], 0x22c
call fcn.00c5e396
lea eax, [esi - 0x31e336c4]
mov dword [0xc78984], eax
xor eax, eax
inc ebx
cmp word [ebx*2 + 0xc74bd0], ax
jne 0xc5f261
mov edi, dword [ebp - 0x94]
cmp edi, ebx
jae 0xc5f298
imul eax, esi, 0x94d222cd
mov dword [0xc78984], eax
call fcn.00c5e06e
cmp edi, 0x2162
jne 0xc5f293
call fcn.00c5e06e
inc edi
cmp edi, ebx
jb 0xc5f281
xor ebx, ebx
lea edx, [ebp - 0x250]
xor ecx, ecx
push ebx
push 2
inc ecx
call fcn.00c4ba1b
call eax
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x3c], eax
push ecx
xor ecx, ecx
lea edx, [ebp - 0x1e8]
push eax
inc ecx
call fcn.00c4ba1b
call eax
cmp eax, 1
jne 0xc5f6c3
push 0xb
pop eax
push 6
pop ecx
mov esi, 0xc7109c
mov byte [ebp - 0x1f], al
lea edi, [ebp - 0x1b0]
mov byte [ebp - 0x1e], al
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], 0x89362dcd
mov eax, ebx
mov dword [ebp - 0x2c], 0xa373ae6a
mov dword [ebp - 0x28], 0xcc390665
movsw word es:[edi], word [esi]
mov dword [ebp - 0x24], 0x4fda7b47
mov edi, ebx
mov byte [ebp - 0x20], 0x34
mov dword [ebp - 0x1d], 0x92fd64c1
mov byte [ebp - 0x19], 0xbb
mov byte [ebp + eax - 0x194], al
inc eax
cmp eax, 0x100
jb 0xc5f31b
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x194]
push 0x19
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x1b0]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x194]
mov byte [ebp + esi - 0x194], al
inc esi
mov byte [ebp + edi - 0x194], bl
cmp esi, 0x100
jb 0xc5f32c
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
mov eax, dword [0xc78984]
add eax, 0x6a3606ab
mov dword [0xc7892c], eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x194]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x194]
mov byte [ebp + edi - 0x194], al
mov byte [ebp + ebx - 0x194], cl
movzx eax, byte [ebp + edi - 0x194]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + esi - 0x30]
mov byte [ebp + esi - 0x1cc], al
inc esi
cmp esi, 0x18
jb 0xc5f383
xor ebx, ebx
mov byte [ebp - 0x1b4], bl
jmp 0xc5f6a0
mov ecx, dword [ebp - 0x94]
call fcn.00c4d317
cmp eax, 4
jbe 0xc5f404
mov edx, ecx
lea ecx, [ebp - 0x458]
call fcn.00c4d387
mov edi, eax
jmp 0xc5f588
mov esi, 0xc6f258
mov dword [ebp - 0x18], 0xeeb9edf7
lea edi, [ebp - 0x90]
mov byte [ebp - 0x14], 0xaa
push 0xb
pop eax
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x13], al
mov eax, ebx
mov dword [ebp - 0x12], 0xe538e4dc
mov dword [ebp - 0xe], 0x89f5bfbc
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa], 0x3a632e26
mov dword [ebp - 6], 0xd987fd32
mov word [ebp - 2], 0x28ca
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x40], ebx
mov byte [ebp + eax - 0x194], al
inc eax
cmp eax, 0x100
jb 0xc5f44a
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov bl, byte [str.SrchSamplePI]
mov esi, 0xc6fec8
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x2c]
jne 0xc5f4ab
xor eax, eax
mov esi, eax
test bl, bl
je 0xc5f4a2
cmp byte [ebp + esi - 0x2c], 0
je 0xc5f4a2
push dword [0xc7892c]
push ecx
call fcn.00c5e2ec
mov bl, byte [esi + 0xc78915]
inc esi
pop ecx
pop ecx
cmp bl, byte [ebp + esi - 0x2c]
je 0xc5f47c
mov bl, byte [str.SrchSamplePI]
mov ecx, dword [ebp - 0x34]
mov dl, byte [ebp + ecx - 0x194]
and ecx, 7
movzx eax, byte [ebp + ecx - 0x90]
add eax, dword [ebp - 0x40]
movzx ecx, dl
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], esi
mov al, byte [ebp + esi - 0x194]
mov byte [ebp + ecx - 0x194], al
inc ecx
mov byte [ebp + esi - 0x194], dl
mov dword [ebp - 0x34], ecx
cmp ecx, 0x100
jb 0xc5f464
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x194]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x194]
mov byte [ebp + edi - 0x194], al
mov byte [ebp + ebx - 0x194], cl
movzx eax, byte [ebp + edi - 0x194]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x204], al
inc esi
cmp esi, 0x18
jb 0xc5f4fb
xor ebx, ebx
lea ecx, [ebp - 0x204]
mov byte [ebp - 0x1ec], bl
call fcn.00c4d05e
mov esi, eax
lea ecx, [ebp - 0x458]
mov edx, esi
call fcn.00c4d387
mov ecx, esi
mov edi, eax
call fcn.00c4d317
push eax
push ebx
push esi
call fcn.00c4cf49
add esp, 0xc
mov ecx, esi
call fcn.00c4ba07
test edi, edi
jne 0xc5f6a0
mov esi, str.TelemetryAssert
mov dword [ebp - 0x18], 0x7b18c5e9
lea edi, [ebp - 0x50]
mov dword [ebp - 0x14], 0x1bcf7b84
mov dword [ebp - 0x10], 0xfa7a5ca9
mov eax, ebx
mov dword [ebp - 0xc], 0xfa530167
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x5c847925
mov dword [ebp - 4], 0xf06046d8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ebx
mov byte [ebp + eax - 0x194], al
inc eax
cmp eax, 0x100
jb 0xc5f5ca
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x194]
push 0xf
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x50]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x194]
mov byte [ebp + esi - 0x194], al
inc esi
mov byte [ebp + edi - 0x194], bl
cmp esi, 0x100
jb 0xc5f5db
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x194]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x194]
mov byte [ebp + edi - 0x194], al
mov byte [ebp + ebx - 0x194], cl
movzx eax, byte [ebp + edi - 0x194]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x220], al
inc esi
cmp esi, 0x18
jb 0xc5f620
push dword [ebp - 0x474]
xor ebx, ebx
lea edx, [ebp - 0x220]
xor ecx, ecx
mov byte [ebp - 0x208], bl
push ebx
push 0x1fffff
inc ecx
call fcn.00c4ba1b
call eax
mov dword [ebp - 0x40], eax
test eax, eax
je 0xc5f6a0
cmp eax, 0xffffffff
jne 0xc5f6db
lea eax, [ebp - 0x47c]
xor ecx, ecx
push eax
push dword [ebp - 0x3c]
lea edx, [ebp - 0x1cc]
inc ecx
call fcn.00c4ba1b
call eax
cmp eax, 1
je 0xc5f3e0
push dword [ebp - 0x3c]
xor ecx, ecx
lea edx, [ebp - 0x74]
inc ecx
call fcn.00c4ba1b
call eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
or dword [0xc7892c], 0xfe00305b
lea edi, [ebp - 0x90]
mov esi, 0xc6f4ec
mov dword [ebp - 0x18], 0x84a4c7e4
push 0xf
pop eax
mov byte [ebp - 3], al
mov eax, ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0x6f8f1ffd
mov dword [ebp - 0x10], 0xcc907ed6
mov dword [ebp - 0xc], 0x104cfef6
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x89810e5e
mov byte [ebp - 4], 0xf4
mov word [ebp - 2], 0x5236
movsd dword es:[edi], dword [esi]
mov edi, ebx
mov byte [ebp + eax - 0x194], al
inc eax
cmp eax, 0x100
jb 0xc5f72a
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x194]
push 0xb
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x90]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x194]
mov byte [ebp + esi - 0x194], al
inc esi
mov byte [ebp + edi - 0x194], bl
cmp esi, 0x100
jb 0xc5f73b
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x194]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x194]
mov byte [ebp + edi - 0x194], al
mov byte [ebp + ebx - 0x194], cl
movzx eax, byte [ebp + edi - 0x194]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x194]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1b0], al
inc esi
cmp esi, 0x18
jb 0xc5f783
push dword [ebp - 0x3c]
xor ecx, ecx
lea edx, [ebp - 0x1b0]
xor eax, eax
inc ecx
mov byte [ebp - 0x198], al
call fcn.00c4ba1b
call eax
mov eax, dword [ebp - 0x40]
jmp 0xc5f6d6