Function at 0x1004f330
Capabilities:
Decode data using base64 via winapi
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10060910
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
mov eax, dword [0x1027ee34]
mov esi, dword [0x1027ee38]
mov ecx, eax
xor ecx, esi
not ecx
or eax, esi
and eax, ecx
imul eax, eax, 0xae33e3a7
add eax, 0x88efc331
mov dword [ebp - 0x30], eax
push eax
mov esi, esp
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov ecx, esp
mov dword [ebp - 0x34], ecx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x44], ebx
push eax
mov ebx, esp
mov dword [ebp - 0x40], ebx
push eax
mov ebx, esp
mov dword [ebp - 0x3c], ebx
sub esp, 0xc
mov ebx, esp
mov dword [ebp - 0x38], ebx
mov dword [esi], edi
mov dword [eax], edx
mov dword [ecx], 0
mov ecx, dword [eax]
call fcn.10008340
mov ecx, eax
mov eax, dword [ebp - 0x34]
xor edx, edx
sub esp, 0x1c
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, eax
mov eax, dword [ebp - 0x30]
cmp ecx, 0
setne cl
mov byte [ebp - 0x29], cl
cmp eax, 0xbe07bf61
ja 0x1004f36e
mov al, byte [ebp - 0x29]
test al, 1
jne 0x1004f49a
jmp 0x1004f43b
mov ecx, dword [str.7ntd]
sub ecx, dword [0x1027ee40]
and ecx, 0xe0526d7d
xor ecx, 0xec398ffe
mov eax, ecx
xor eax, 0xb8b79014
and eax, ecx
mov dword [ebp - 0x10], 0xffffffff
cmp eax, 0x9aea7186
jae 0x1004f6d5
mov ecx, dword [ebp - 0x44]
lea eax, str.Failed_to_calculate_base64_decoded_size.
sub esp, 4
mov dword [esp], eax
call fcn.1004f7c0
mov ecx, dword [ebp - 0x44]
lea eax, [0x1026a94c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.101ee0b1
mov ecx, dword [0x1027ee4c]
sub ecx, dword [0x1027ee50]
and ecx, 0x2ddf04f9
mov eax, ecx
and eax, 0xd24043de
xor ecx, 0xd24043de
or eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xbb846d79
mov ecx, eax
and ecx, 0x447b9286
imul ecx, edx
mov edx, eax
and edx, 0xbb846d79
or eax, 0xbb846d79
imul eax, edx
add eax, ecx
mov dword [ebp - 0x10], 0xffffffff
cmp eax, 0x807ad5ae
ja 0x1004f701
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov esi, dword [0x1027ee54]
and esi, dword [0x1027ee58]
mov edx, esi
add edx, 1
xor esi, 0xffffffff
or esi, 0x1f23436
add esi, edx
add esi, 0xf136319f
mov edx, esi
and edx, 0xf3d47ff1
or esi, 0xf3d47ff1
add edx, esi
mov dword [ebp - 0x50], edx
mov byte [eax], 0
call fcn.1004f950
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.1004fad0
mov ecx, dword [ebp - 0x28]
call fcn.1004fb20
mov ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], ecx
mov ecx, dword [eax]
call fcn.10008340
mov ecx, dword [ebp - 0x54]
mov edx, eax
mov eax, dword [ebp - 0x34]
xor esi, esi
sub esp, 0x1c
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, eax
mov eax, dword [ebp - 0x50]
cmp ecx, 0
setne cl
mov byte [ebp - 0x49], cl
cmp eax, 0xccfde9e
je 0x1004f4f5
mov al, byte [ebp - 0x49]
test al, 1
jne 0x1004f609
jmp 0x1004f5d0
mov ecx, dword [ebp - 0x38]
lea eax, str.Failed_to_decode_base64_string.
sub esp, 4
mov dword [esp], eax
call fcn.1004f7c0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x10], 0
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026a94c
call fcn.101ee0b1
add esp, 8
jmp 0x1004f6d5
mov ecx, dword [0x1027ee6c]
mov eax, dword [0x1027ee70]
xor eax, 0xffffffff
add ecx, eax
add ecx, 1
xor eax, eax
sub eax, ecx
add eax, 0xe09ee506
xor ecx, ecx
sub ecx, eax
sub ecx, 0x294c5bb1
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x435e8f61
xor ecx, 0xffffffff
and ecx, 0x435e8f61
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0x98dfc5ec
jb 0x1004f783
mov eax, dword [ebp - 0x40]
mov byte [eax], 1
test byte [eax], 1
jne 0x1004f6c0
mov edx, dword [0x1027ee7c]
sub edx, dword [0x1027ee80]
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0xabda9cdd
and edx, 0x54256322
or eax, edx
xor eax, 0xda4b6e0f
or ecx, 0x8e6e0d2d
xor ecx, 0xffffffff
or eax, ecx
mov ecx, eax
and ecx, 0x59bb7e1c
mov edx, eax
xor edx, 0xa64481e3
add eax, edx
sub eax, ecx
sub eax, 0xfd92504b
cmp eax, 0x384d8c87
jb 0x1004f78e
mov ecx, dword [ebp - 0x28]
call fcn.1004fcd0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x44]
lea eax, str.Failed_to_calculate_base64_decoded_size.
sub esp, 4
mov dword [esp], eax
call fcn.1004f7c0
mov ecx, dword [ebp - 0x44]
lea eax, [0x1026a94c]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.101ee0b1
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov byte [eax], 0
call fcn.1004f950
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov edx, dword [edx]
sub esp, 8
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.1004fad0
mov ecx, dword [ebp - 0x28]
call fcn.1004fb20
mov ecx, eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], ecx
mov ecx, dword [eax]
call fcn.10008340
mov ecx, dword [ebp - 0x58]
mov edx, eax
mov eax, dword [ebp - 0x34]
xor esi, esi
sub esp, 0x1c
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
jmp 0x1004f4f5
mov eax, dword [ebp - 0x40]
mov byte [eax], 1
jmp 0x1004f655
mov ecx, dword [ebp - 0x28]
call fcn.1004fcd0
jmp 0x1004f6b8