Function at 0x10229c00
Capabilities:
Encode data using xor
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x70], eax
push ebp
mov ebp, dword [esp + 0x80]
push esi
mov esi, dword [esp + 0x80]
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x68]
mov dword [esp + 0xc], 0
test al, 0x10
je 0x10229c44
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10311bec
add esp, 0x74
ret
test al, 4
je 0x10229c61
xor eax, eax
cmp dword [esi + 0x40], eax
pop esi
setle al
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10311bec
add esp, 0x74
ret
push edi
push dword [esi + 0x20]
push dword [esi + 0x24]
push dword [esi + 0x48]
call fcn.102225a0
push 0x2e
xorps xmm0, xmm0
lea eax, [esp + 0x48]
push 0
push eax
movq qword [esp + 0x30], xmm0
movq qword [esp + 0x38], xmm0
movq qword [esp + 0x40], xmm0
mov dword [esp + 0x48], 0
mov word [esp + 0x4c], 0
call sub.MSVCR110.dll_memset
mov edi, dword [sym.imp.MSVCR110.dll_strncpy]
push 4
xorps xmm0, xmm0
lea eax, [esp + 0x34]
push 0x104f4234
push eax
movq qword [esp + 0x8c], xmm0
movq qword [esp + 0x94], xmm0
mov word [esp + 0x9c], 0
call edi
push 4
lea eax, [esp + 0x60]
push 0x104f423c
push eax
call edi
movzx eax, word [esi + 0x10]
and eax, 0x1ff
mov ecx, eax
mov byte [esp + 0xa0], al
movsx eax, al
not eax
and eax, 0xff
shr ecx, 8
mov edx, dword [eax*4 + 0x10509758]
xor edx, 0xffffff
movsx eax, cl
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x10509758]
add esp, 0x30
not edx
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x6f], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x6e], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x6d], al
mov eax, dword [esi + 0x10]
mov word [esp + 0x56], 0x12
mov word [esp + 0x34], 0x12
mov dword [esp + 0x68], 0xe756e
mov byte [esp + 0x71], cl
mov byte [esp + 0x6c], dl
test eax, 0x1000
je 0x10229d79
mov word [esp + 0x42], 8
mov word [esp + 0x20], 8
test eax, 0x2000
je 0x10229d8e
mov word [esp + 0x42], 0xc
mov word [esp + 0x20], 0xc
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2a]
push eax
push dword [esi + 4]
call fcn.10229b70
movzx eax, word [esp + 0x32]
mov word [esp + 0x54], ax
movzx eax, word [esp + 0x34]
push dword [ebp]
mov word [esp + 0x5a], ax
mov eax, dword [esi + 0x68]
shr eax, 3
and eax, 1
add ax, word [esi + 0x20]
movzx ecx, ax
mov eax, ecx
shr eax, 8
mov byte [esp + 0x69], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x68], cl
mov byte [esp + 0x47], al
mov byte [esp + 0x46], cl
call sym.php5.dll__php_stream_tell
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x79], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x78], cl
mov ecx, eax
mov byte [esp + 0x76], al
mov eax, dword [esi + 0x68]
shr ecx, 8
add esp, 0x10
mov byte [esp + 0x67], cl
test al, 2
je 0x10229eae
test al, 8
je 0x10229e64
and eax, 0xfffffffd
cmp dword [esi + 0x28], 2
mov dword [esi + 0x68], eax
jne 0x1022a08e
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x38]
cmp eax, dword [ecx + 0xb0]
je 0x1022a08e
cmp eax, dword [ecx + 0xb4]
je 0x1022a08e
push 3
push eax
call sym.php5.dll__php_stream_free
add esp, 8
mov dword [esi + 0x38], 0
mov dword [esi + 0x28], 0
jmp 0x1022a08e
push 0
push dword [ebp + 0x14]
push esi
call fcn.10223850
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10229e89
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_open_file_contents_of_file___s__in_zip_based_phar___s_
jmp 0x1022a659
mov eax, dword [esi + 0x10]
test eax, 0xf000
je 0x10229f63
mov ecx, dword [esi + 0x14]
cmp ecx, eax
je 0x10229ea6
test ecx, ecx
jne 0x10229f63
mov dword [esp + 0x14], 1
mov ecx, dword [esi]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x57], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x56], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x55], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x34], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x33], al
mov byte [esp + 0x54], cl
mov byte [esp + 0x32], cl
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x53], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x52], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x51], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2f], al
mov eax, dword [ebp + 8]
mov byte [esp + 0x50], cl
mov byte [esp + 0x2e], cl
test eax, eax
je 0x1022a04d
push 0
push dword [esi + 0x2c]
push eax
call sym.php5.dll__php_stream_seek
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1022a04d
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_seek_to_start_of_file___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
push 0
push 0
push 0
push 0
push esi
call fcn.102230d0
add esp, 0x14
cmp eax, 0xffffffff
je 0x1022a18c
push 0
push esi
call fcn.102231c0
xor ebx, ebx
add esp, 8
or edi, 0xffffffff
mov dword [esp + 0x10], eax
cmp dword [esi], ebx
jbe 0x10229fba
mov ebp, eax
push ebp
call sym.php5.dll__php_stream_getc
xor eax, edi
and eax, 0xff
shr edi, 8
xor edi, dword [eax*4 + 0x10509758]
inc ebx
add esp, 4
cmp ebx, dword [esi]
jb 0x10229f97
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x57], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x56], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x55], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x34], al
mov eax, ecx
shr eax, 8
test dword [esi + 0x10], 0xf000
not edi
mov dword [esi + 0xc], edi
mov byte [esp + 0x54], cl
mov byte [esp + 0x33], al
mov byte [esp + 0x32], cl
jne 0x1022a104
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x53], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x52], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x51], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 8
mov dword [esi + 8], ecx
mov byte [esp + 0x50], cl
mov byte [esp + 0x2f], al
mov byte [esp + 0x2e], cl
mov ecx, dword [esi + 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x4f], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x4e], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x4d], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2d], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x4c], cl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2a], cl
cmp dword [esi + 0x18], 0
lea ebx, [esi + 0x18]
je 0x1022a302
cmp dword [esi + 0x4c], 0
lea edi, [esi + 0x4c]
je 0x1022a0c7
mov eax, dword [edi]
test eax, eax
je 0x1022a0b9
push eax
call sym.php5.dll__efree
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [esi + 0x50], 0
cmp dword [0x106618dc], 0
jne 0x1022a25b
mov ecx, dword [0x106618e4]
test ecx, ecx
je 0x1022a25b
mov eax, dword [0x106618e0]
inc ecx
mov dword [esp + 0x10], eax
mov dword [0x106618e4], ecx
jmp 0x1022a291
push 0
push 0
push 0
push esi
call fcn.10222560
add esp, 8
push eax
call sym.php5.dll_php_stream_filter_create
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1022a147
test dword [esi + 0x10], 0x1000
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
je 0x1022a13d
push str.unable_to_gzip_compress_file___s__to_zip_based_phar___s_
jmp 0x1022a659
push str.unable_to_bzip2_compress_file___s__to_zip_based_phar___s_
jmp 0x1022a659
push 0
call sym.php5.dll__php_stream_fopen_tmpfile
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x1022a16a
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_create_temporary_file_for_file___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
mov edi, dword [esp + 0x10]
push 0
push edi
call sym.php5.dll__php_stream_flush
push 0
push 0
push 0
push 0
push esi
call fcn.102230d0
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x1022a19e
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_seek_to_start_of_file___s__to_zip_based_phar___s_
jmp 0x1022a659
mov eax, dword [esi + 0x3c]
add eax, 0x14
push ebx
push eax
call sym.php5.dll__php_stream_filter_append
push 0
push dword [esi]
push dword [esi + 0x3c]
push edi
call sym.php5.dll__php_stream_copy_to_stream_ex
add esp, 0x18
test eax, eax
je 0x1022a1d1
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_copy_compressed_file_contents_of_file___s__while_creating_new_phar___s_
jmp 0x1022a659
push 1
push ebx
call sym.php5.dll__php_stream_filter_flush
push 0
push dword [esi + 0x3c]
call sym.php5.dll__php_stream_flush
push 1
push ebx
call sym.php5.dll_php_stream_filter_remove
push 2
push 0
push dword [esi + 0x3c]
call sym.php5.dll__php_stream_seek
push dword [esi + 0x3c]
call sym.php5.dll__php_stream_tell
mov ebx, eax
push 0
shr eax, 0x18
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
shr ecx, 8
push 0
push dword [esi + 0x3c]
mov dword [esi + 8], ebx
mov byte [esp + 0x87], al
mov byte [esp + 0x86], dl
mov byte [esp + 0x85], cl
mov byte [esp + 0x84], bl
mov byte [esp + 0x65], al
mov byte [esp + 0x64], dl
mov byte [esp + 0x63], cl
mov byte [esp + 0x62], bl
call sym.php5.dll__php_stream_seek
mov eax, dword [esi + 0x10]
add esp, 0x34
or dword [esi + 0x68], 2
mov dword [esi + 0x14], eax
jmp 0x1022a04d
push 0x28
call sym.php5.dll__emalloc
push 0
push 0
push 0xa
push eax
mov dword [esp + 0x24], eax
call sym.php5.dll__zend_hash_init
add esp, 0x14
cmp dword [0x106618dc], 0
jne 0x1022a291
mov eax, dword [esp + 0x10]
mov dword [0x106618e0], eax
mov dword [0x106618e4], 1
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call sym.php5.dll_php_var_serialize
add esp, 0xc
cmp dword [0x106618dc], 0
jne 0x1022a2dc
mov eax, dword [0x106618e4]
test eax, eax
je 0x1022a2dc
dec eax
mov dword [0x106618e4], eax
jne 0x1022a2f1
push dword [0x106618e0]
call sym.php5.dll_zend_hash_destroy
push dword [0x106618e0]
call sym.php5.dll__efree
mov dword [0x106618e0], 0
jmp 0x1022a2ee
push dword [esp + 0x10]
call sym.php5.dll_zend_hash_destroy
push dword [esp + 0x14]
call sym.php5.dll__efree
add esp, 8
movzx ecx, word [esi + 0x50]
mov eax, ecx
shr eax, 8
mov byte [esp + 0x5d], al
mov byte [esp + 0x5c], cl
push dword [ebp]
call sym.php5.dll__php_stream_tell
mov ecx, dword [esi + 0x68]
mov ebx, dword [esi + 0x20]
shr ecx, 3
and ecx, 1
mov dword [esi + 0x34], eax
add ecx, eax
push 0x1e
lea eax, [esp + 0x24]
push eax
push dword [ebp]
add ebx, 0x30
add ebx, ecx
call sym.php5.dll__php_stream_write
add esp, 0x10
cmp eax, 0x1e
je 0x1022a349
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_local_file_header_of_file___s__to_zip_based_phar___s_
jmp 0x1022a659
push 0x2e
lea eax, [esp + 0x40]
push eax
push dword [ebp + 4]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp eax, 0x2e
je 0x1022a372
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_central_directory_entry_for_file___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
test byte [esi + 0x68], 8
push dword [esi + 0x20]
push dword [esi + 0x24]
push dword [ebp]
je 0x1022a3f6
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp dword [esi + 0x20], eax
jne 0x1022a3a5
push 1
push 0x10622d94
push dword [ebp]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp eax, 1
je 0x1022a3b7
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_filename_to_local_directory_entry_for_directory___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
push dword [esi + 0x20]
push dword [esi + 0x24]
push dword [ebp + 4]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp dword [esi + 0x20], eax
jne 0x1022a3e4
push 1
push 0x10622d94
push dword [ebp + 4]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp eax, 1
je 0x1022a43d
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_filename_to_central_directory_entry_for_directory___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
mov edi, dword [esi + 0x20]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp edi, eax
je 0x1022a417
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_filename_to_local_directory_entry_for_file___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
push edi
push dword [esi + 0x24]
push dword [ebp + 4]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp dword [esi + 0x20], eax
je 0x1022a43d
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_filename_to_central_directory_entry_for_file___s__while_creating_zip_based_phar___s_
jmp 0x1022a659
push 0x12
lea eax, [esp + 0x70]
push eax
push dword [ebp]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp eax, 0x12
je 0x1022a466
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_local_extra_permissions_file_header_of_file___s__to_zip_based_phar___s_
jmp 0x1022a659
push 0x12
lea eax, [esp + 0x70]
push eax
push dword [ebp + 4]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp eax, 0x12
je 0x1022a48f
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_central_extra_permissions_file_header_of_file___s__to_zip_based_phar___s_
jmp 0x1022a659
cmp dword [esp + 0x14], 0
jne 0x1022a5fd
test byte [esi + 0x68], 2
je 0x1022a5fd
mov eax, dword [esi + 0x3c]
push 0
test eax, eax
je 0x1022a5a9
push dword [esi + 8]
push dword [ebp]
push eax
call sym.php5.dll__php_stream_copy_to_stream_ex
add esp, 0x10
test eax, eax
je 0x1022a4d6
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_compressed_contents_of_file___s__in_zip_based_phar___s_
jmp 0x1022a659
push 3
push dword [esi + 0x3c]
call sym.php5.dll__php_stream_free
add esp, 8
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x28], 2
jne 0x1022a517
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x38]
cmp eax, dword [ecx + 0xb0]
je 0x1022a517
cmp eax, dword [ecx + 0xb4]
je 0x1022a517
cmp dword [esi + 0x40], 0
jne 0x1022a517
push 3
push eax
call sym.php5.dll__php_stream_free
add esp, 8
and dword [esi + 0x68], 0xfffffffd
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x38], 0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], 0
test eax, eax
je 0x1022a6a3
push dword [esi + 0x50]
push eax
push dword [ebp + 4]
call sym.php5.dll__php_stream_write
add esp, 0xc
cmp dword [esi + 0x50], eax
je 0x1022a67e
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_metadata_as_file_comment_for_file___s__while_creating_zip_based_phar___s_
push 0
push dword [ebp + 0x14]
call sym.php5.dll_spprintf
mov eax, dword [esi + 0x4c]
add esp, 0x14
test eax, eax
je 0x1022a583
push eax
call sym.php5.dll__efree
add esp, 4
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
pop ebx
pop edi
pop esi
mov eax, 2
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10311bec
add esp, 0x74
ret
push dword [ebp + 0x14]
push esi
call fcn.10223850
add esp, 0xc
cmp eax, 0xffffffff
je 0x1022a591
push 0
push 0
push 0
push 0
push esi
call fcn.102230d0
add esp, 0x14
push 0
push dword [esi]
push dword [ebp]
push 0
push esi
call fcn.102231c0
add esp, 8
push eax
call sym.php5.dll__php_stream_copy_to_stream_ex
add esp, 0x10
test eax, eax
je 0x1022a4ea
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_write_contents_of_file___s__in_zip_based_phar___s_
jmp 0x1022a659
and dword [esi + 0x68], 0xfffffffd
cmp dword [esi + 0x40], 0
je 0x1022a61e
mov eax, dword [esi + 0x28]
sub eax, 0
je 0x1022a617
dec eax
jne 0x1022a61e
mov dword [ebp + 0x10], eax
jmp 0x1022a61e
mov dword [ebp + 0xc], 0
test byte [esi + 0x68], 8
jne 0x1022a51b
mov eax, dword [esi + 8]
test eax, eax
je 0x1022a51b
push 0
push eax
push dword [ebp]
push dword [ebp + 8]
call sym.php5.dll__php_stream_copy_to_stream_ex
add esp, 0x10
test eax, eax
je 0x1022a51b
mov eax, dword [esi + 0x48]
push dword [eax]
push dword [esi + 0x24]
push str.unable_to_copy_contents_of_file___s__while_creating_zip_based_phar___s_
push 0
push dword [ebp + 0x14]
call sym.php5.dll_spprintf
add esp, 0x14
mov eax, 2
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10311bec
add esp, 0x74
ret
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x1022a695
push eax
call sym.php5.dll__efree
add esp, 4
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov ecx, dword [esp + 0x80]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.10311bec
add esp, 0x74
ret