BASE64编码代码分析:
00401000 /$ 55 push ebp
00401001 |. 8BEC mov ebp,esp
00401003 |. 53 push ebx
00401004 |. 57 push edi
00401005 |. 56 push esi
00401006 |. 8B75 08 mov esi,[arg.1]
00401009 |. 8B7D 0C mov edi,[arg.2]
0040100C |> 33C0 /xor eax,eax
0040100E |. 837D 10 01 |cmp [arg.3],0x1 ;未编码的字符数为1,不跳转
00401012 |. 75 10 |jnz XTEST.00401024
00401014 |. AC |lods byte ptr ds:[esi]
00401015 |. B9 02000000 |mov ecx,0x2 ;只做两次循环
0040101A |. BA 3D3D0000 |mov edx,0x3D3D ;编码完成时末尾添加==
0040101F |. FF4D 10 |dec [arg.3]
00401022 |. EB 25 |jmp XTEST.00401049
00401024 |> 837D 10 02 |cmp [arg.3],0x2 ;未编码的字符数为2,不跳转
00401028 |. 75 12 |jnz XTEST.0040103C
0040102A |. 66:AD |lods word ptr ds:[esi]
0040102C |. B9 03000000 |mov ecx,0x3 ;只做三次循环
00401031 |. BA 3D000000 |mov edx,0x3D ;编码完成时末尾添加=
00401036 |. 836D 10 02 |sub [arg.3],0x2
0040103A |. EB 0D |jmp XTEST.00401049
0040103C |> AD |lods dword ptr ds:[esi]
0040103D |. B9 04000000 |mov ecx,0x4 ;未编码字符大等于3时,做四次循环
00401042 |. 33D2 |xor edx,edx
00401044 |. 4E |dec esi
00401045 |. 836D 10 03 |sub [arg.3],0x3
00401049 |> 86C4 |xchg ah,al ;eax中为未编码的字符
0040104B |. C1C0 10 |rol eax,0x10
0040104E |. 86C4 |xchg ah,al
00401050 |> 50 |/push eax
00401051 |. 25 000000FC ||and eax,0xFC000000
00401056 |. C1C0 06 ||rol eax,0x6 ;取得字节的前六位
00401059 |. 8A80 14304000 ||mov al,byte ptr ds:[eax+0x403014] ;查表
0040105F |. AA ||stos byte ptr es:[edi] ;保存查表得到的值
00401060 |. 58 ||pop eax
00401061 |. C1E0 06 ||shl eax,0x6 ;去掉已使