Function at 0x1004fed0
Capabilities:
Encode data using xor
Get thread local storage value
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x34], eax
push edi
mov dword [ebp - 0x24], esi
cmp dword [esi + 0x1b410], 0
mov eax, dword [esi + 0x1b408]
je 0x1004ff1a
add dword [esi + 0x1b404], eax
mov eax, dword [esi + 0x1a3f8]
mov dword [esi + 0x1a3fc], eax
mov eax, 0x32
mov dword [esi + 0x1b408], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1005059f
mov ecx, dword [esi + 0x2c]
cdq
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x1004ff72
cmp dword [esi + 0x34], ecx
jne 0x1004ff72
mov edi, dword [esi + 0x6118]
mov eax, dword [esi + 0x611c]
add edi, ebx
adc eax, edx
cmp eax, dword [esi + 0x7134]
jl 0x1004ff72
mov eax, dword [esi + 0x7130]
jg 0x1004ff5b
cmp edi, eax
jbe 0x1004ff72
mov edx, dword [esi + 0x7134]
mov ebx, eax
sub ebx, dword [esi + 0x6118]
sbb edx, dword [esi + 0x611c]
mov dword [ebp - 4], edx
test edx, edx
jg 0x1004ffb4
jl 0x1004ff7c
test ebx, ebx
jne 0x1004ffb4
mov dword [esi + 4], 1
test ecx, ecx
jne 0x1004ff93
mov dword [esi + 0x20], 1
jmp 0x10050063
cmp dword [esi + 0x34], 0
je 0x1004ffa5
mov dword [esi + 0x20], 1
jmp 0x10050063
mov dword [esi + 0x1b410], 2
jmp 0x10050063
mov eax, dword [esi + 0x1a3f8]
mov edi, ebx
mov edx, dword [esi + 0x18344]
test edi, edi
je 0x1004fff0
mov esi, eax
jmp 0x1004ffd0
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100b0570]
sub edi, 1
jne 0x1004ffd0
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
cmp dword [esi + 0x6108], 0
mov dword [esi + 0x18344], edx
jne 0x100500a0
test ecx, ecx
jne 0x100500a8
cmp dword [esi + 0x34], ecx
jne 0x100500a0
mov edi, 0x14
mov dword [ebp - 0x24], ecx
lea esp, [esp]
test edi, edi
jle 0x10050053
push 0
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [esi + 0x1a400]
push dword [esi + 0x1b40c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [ebp - 0x24]
je 0x10050048
cmp eax, ebx
je case.0x100503f0.0
test eax, eax
jne 0x1005004f
dec edi
jmp 0x10050020
xor edi, edi
jmp 0x10050020
cmp dword [esi + 0x60fc], 0
je 0x100501c7
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x1b408]
add dword [esi + 0x1b404], eax
cmp dword [esi + 0x2c], 0
mov eax, dword [esi + 0x1a3f8]
mov dword [esi + 0x1b408], 0
mov dword [esi + 0x1a3fc], eax
je 0x10050423
mov edi, dword [esi + 0x68]
mov ebx, dword [esi + 0x6c]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ebx
jmp 0x10050476
test ecx, ecx
je 0x100501f3
cmp dword [esi + 0x30], 0
jne 0x100501f3
mov eax, dword [esi + 0x60]
add eax, dword [esi + 0x68]
mov edx, dword [esi + 0x70]
mov edi, dword [esi + 0x1a400]
mov ecx, dword [esi + 0x50]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x10], edx
add edx, dword [esi + 0x7130]
mov dword [ebp - 8], eax
adc eax, dword [esi + 0x7134]
cmp eax, dword [esi + 0x54]
jg 0x10050107
jl 0x100500e7
cmp edx, ecx
jae 0x10050107
mov eax, dword [ebp - 0x10]
sub eax, dword [esi + 0x58]
mov ecx, dword [ebp - 8]
sbb ecx, dword [esi + 0x5c]
add eax, dword [esi + 0x7130]
mov dword [ebp - 0x10], eax
adc ecx, dword [esi + 0x7134]
mov dword [ebp - 8], ecx
jmp 0x10050110
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov ecx, dword [esi + 0x7c]
mov eax, dword [esi + 0x78]
cmp ecx, dword [esi + 0x5c]
jl 0x1005018b
jg 0x10050125
cmp eax, dword [esi + 0x58]
jb 0x1005018b
mov eax, dword [esi + 0x54]
cmp dword [esi + 0x6c], eax
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x68]
jg 0x1005016c
jl 0x10050139
cmp eax, ecx
jae 0x1005016c
mov ecx, dword [ebp - 8]
cmp dword [esi + 0x6c], ecx
jg case.0x100503f0.1
jl 0x10050150
cmp eax, dword [ebp - 0x10]
jae case.0x100503f0.1
mov ecx, dword [ebp - 0x20]
mov al, byte [edi]
inc edi
mov byte [ecx], al
inc ecx
add dword [esi + 0x68], 1
mov dword [ebp - 0x20], ecx
adc dword [esi + 0x6c], 0
add ebx, 0xffffffff
adc edx, 0xffffffff
jmp 0x100501ac
mov eax, dword [esi + 0x1b408]
cdq
cmp dword [esi + 0x54], edx
jg 0x100501c7
jl 0x1005017e
cmp ecx, eax
ja 0x100501c7
xor ebx, ebx
mov dword [ebp - 0x34], 1
xor edx, edx
jmp 0x100501ac
add eax, 1
mov dword [esi + 0x78], eax
adc ecx, 0
mov dword [esi + 0x7c], ecx
test ecx, ecx
jg case.0x100503f0.1
jl 0x100501a5
cmp eax, dword [esi + 0x716e]
jae case.0x100503f0.1
add ebx, 0xffffffff
adc edx, 0xffffffff
inc edi
test edx, edx
jl 0x10050063
jg 0x10050113
test ebx, ebx
je 0x10050063
jmp 0x10050113
mov dword [esi + 0x1b410], 2
mov eax, 0x32
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x1b410], 3
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x34], 0
jne 0x10050203
cmp dword [esi + 0x30], 0
je case.0x100503f0.0
cmp dword [esi + 0x30], 0
mov edi, ebx
mov ecx, dword [esi + 0x1a400]
mov dword [ebp - 0x14], 3
mov dword [ebp - 8], ecx
je 0x10050381
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x70]
mov dword [ebp - 0x10], eax
mov eax, edx
add eax, dword [esi + 0x7130]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
adc eax, dword [esi + 0x7134]
cmp eax, dword [esi + 0x54]
jg 0x10050265
jl 0x1005024b
mov eax, dword [esi + 0x50]
cmp dword [ebp - 0x2c], eax
jae 0x10050268
sub edx, dword [esi + 0x58]
mov eax, dword [ebp - 0x10]
sbb eax, dword [esi + 0x5c]
add edx, dword [esi + 0x7130]
mov dword [ebp - 0x18], edx
adc eax, dword [esi + 0x7134]
jmp 0x1005026e
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], eax
test edi, edi
je case.0x100503f0.0
mov edx, dword [esi + 0x7c]
mov eax, dword [esi + 0x78]
cmp edx, dword [esi + 0x5c]
jl 0x1005034b
jg 0x100502a6
cmp eax, dword [esi + 0x58]
jb 0x1005034b
mov eax, dword [esi + 0x6c]
mov edx, dword [esi + 0x68]
cmp eax, dword [esi + 0x54]
jg 0x100501c7
jl 0x100502c0
cmp edx, dword [esi + 0x50]
jae 0x100501c7
xor eax, eax
mov dword [ebp - 0xc], edi
add dword [ebp - 0xc], edx
adc eax, dword [esi + 0x6c]
cmp eax, dword [ebp - 0x10]
jl 0x100502e5
mov eax, dword [ebp - 0x18]
jg 0x100502da
cmp dword [ebp - 0xc], eax
jbe 0x100502e5
mov edi, eax
mov dword [ebp - 0x14], 0
sub edi, edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], edi
push eax
push dword [esi + 0x7154]
lea eax, [ebp - 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [esi + 0x44]
push dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x7150]
push ecx
push 1
call eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cdq
add dword [esi + 0x68], eax
mov eax, dword [ebp - 0xc]
adc dword [esi + 0x6c], edx
cmp eax, edi
jae 0x10050331
add ecx, eax
sub edi, eax
add dword [ebp - 0x1c], eax
mov dword [ebp - 8], ecx
adc dword [ebp - 0x20], 0
jmp 0x10050338
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x14]
cmp eax, 3
ja case.0x100503f0.1
jmp dword [eax*4 + 0x100505a8]
add eax, 1
mov dword [esi + 0x78], eax
adc edx, 0
mov dword [esi + 0x7c], edx
test edx, edx
jg case.0x100503f0.1
jl 0x1005036d
cmp eax, dword [esi + 0x716e]
jae case.0x100503f0.1
dec edi
inc ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x2c], 0
je 0x10050284
jmp case.0x100503f0.0
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
test edi, edi
je case.0x100503f0.0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], edi
push ecx
push dword [esi + 0x7154]
mov ecx, dword [ebp - 8]
push eax
push edx
push dword [esi + 0x44]
lea eax, [ebp - 0xc]
push dword [esi + 0x40]
push eax
mov eax, dword [esi + 0x7150]
push ecx
push 1
call eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
cmp eax, edi
jae 0x100503dd
add dword [ebp - 8], eax
sub edi, eax
add edx, eax
mov dword [ebp - 0x20], edx
adc dword [ebp - 0x1c], 0
jmp 0x100503e4
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x14]
cmp eax, 3
ja case.0x100503f0.1
jmp dword [eax*4 + 0x100505b8]
cmp dword [ebp - 0x2c], 0
jne case.0x100503f0.0
mov eax, dword [ebp - 0x1c]
jmp 0x10050394
mov dword [esi + 0x1b410], 3
mov eax, 2
mov dword [esi + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x34], 0
je 0x10050466
cmp dword [esi + 0x30], 0
je 0x1005043d
mov edi, dword [esi + 0x68]
mov ebx, dword [esi + 0x6c]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ebx
jmp 0x10050476
mov edi, ebx
mov eax, edx
add edi, dword [esi + 0x6118]
adc eax, dword [esi + 0x611c]
add dword [esi + 0x48], ebx
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [esi + 0x611c], eax
mov eax, dword [esi + 0x4c]
adc eax, edx
mov dword [esi + 0x4c], eax
jmp 0x1005047c
mov edi, ebx
mov ebx, edx
add edi, dword [esi + 0x6118]
adc ebx, dword [esi + 0x611c]
mov dword [esi + 0x611c], ebx
push dword [0x100c7608]
mov dword [esi + 0x6118], edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1005058c
cmp dword [esi + 0x34], 0
jne 0x10050585
cmp dword [esi + 0x30], 0
jne 0x10050585
cmp dword [esi + 0x2c], 0
mov ecx, dword [esi + 0x70]
mov eax, dword [esi + 0x74]
je 0x100504c0
add ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
jmp 0x100504cc
add ecx, dword [esi + 0x7130]
mov edx, dword [esi + 0x7134]
adc edx, eax
mov dword [ebp - 0x20], ecx
mov eax, ecx
mov dword [ebp - 0x2c], edx
add eax, 0x3e8
mov dword [ebp - 0x1c], eax
mov eax, edx
adc eax, 0
cmp ebx, eax
jl 0x100504fc
jg 0x100504ee
cmp edi, dword [ebp - 0x1c]
jbe 0x100504fc
mov dword [esi + 4], 1
mov dword [esi + 0x20], 1
mov eax, dword [esi + 0x71b4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1005058c
mov eax, ecx
or eax, edx
jne 0x10050517
xor ecx, ecx
jmp 0x1005054e
push 0
push 0x64
push ebx
push edi
call fcn.1009d620
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push edx
push eax
call fcn.1009d8a0
mov ecx, eax
add ecx, 1
adc edx, 0
test edx, edx
jl 0x1005054e
jg 0x10050542
cmp ecx, 0x64
jbe 0x1005054e
mov ecx, 0x64
mov dword [ebp - 0x2c], 0
cmp dword [esi + 0x10], 0
mov eax, ecx
cdq
mov dword [esi + 0x60dc], edx
mov edx, dword [esi + 0x71b8]
push edx
mov dword [esi + 0x60d8], eax
lea eax, [esi + 0x6124]
push ecx
push eax
je 0x10050582
call dword [ebp - 0x1c]
test eax, eax
je 0x10050585
mov dword [esi + 4], 1
jmp 0x10050585
call dword [ebp - 0x1c]
mov ecx, esi
call fcn.1004cad0
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
and eax, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret