现IDA F5分析出一份类似字典压缩编码的函数算法，因自身能力不足无法看出是lzw还是lz77又或lz78之类的算法！ 但可以肯定是一个字典的压缩编码！
期望：能准确得知算法名称 若有源码 将追加悬赏！
贴出IDA F5 代码：
/*@参数大概说明这里的位置与实际参数可能不匹配只是大概参数。
1：待压缩的明文数据指针
2：待压缩的数据长度
3：提供一个空白指针压缩完成后会对此赋值
4：提供一个空白指针压缩完成后会对此赋值
5：提供一个空白指针压缩完成后会对此赋值
*/
void __usercall sub_100075E0(int a1@<edx>, unsigned __int8 *a2@<ecx>, int *a3, int *a4, _DWORD *a5)
{
int v5; // edi
int *v6; // eax
int *v7; // ebx
int v8; // eax
int *v9; // ecx
int v10; // esi
unsigned __int8 *v11; // ecx
int v12; // eax
int v13; // esi
int v14; // ecx
signed int v15; // edx
_DWORD *v16; // eax
int v17; // eax
int v18; // esi
int v19; // ecx
int v20; // [esp+10h] [ebp-3Ch]
int v21; // [esp+14h] [ebp-38h]
__int128 v22; // [esp+18h] [ebp-34h]
int *v23; // [esp+28h] [ebp-24h]
int v24; // [esp+2Ch] [ebp-20h]
int *v25; // [esp+30h] [ebp-1Ch]
unsigned __int8 *v26; // [esp+34h] [ebp-18h]
int v27; // [esp+38h] [ebp-14h]
int v28; // [esp+48h] [ebp-4h]
v24 = a1;
v26 = a2;
if ( !a2 || !a3 || a1 <= 0 || !a4 || !a5 )
return;
v5 = -1;
v27 = 9;
v6 = (int *)sub_1008C122(32772); //核心是RtlAllocateHeap相关 大概应该是malloc
v7 = v6;
v25 = v6;
v8 = 0;
*v25 = 256;
v9 = v7 + 2;
do
{
*v9 = v8;
v9 += 2;
*(v9 - 3) = -1;
++v8;
}
while ( v8 < *v7 );
v23 = v7;
v28 = 0;
v22 = xmmword_1010FE00;//此值 = 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
v10 = sub_10094C44(1024);//核心是RtlAllocateHeap相关 大概应该是malloc
sub_1008E920(v10, 0, 1024);//memset
v20 = v10;
v21 = 1024;
v11 = v26;
v25 = (int *)512;
LOWORD(v12) = v24;
LOBYTE(v28) = 1;
do
{
if ( !(v12 & 0x1FF) )
{
Sleep(1u);
v11 = v26;
}
v13 = *v11;
if ( v5 == -1 )
{
v14 = *v11;
}
else
{
v14 = 0;
if ( *v7 <= 0 )
goto LABEL_20;
v16 = v7 + 2;
while ( *(v16 - 1) != v5 || *v16 != v13 )
{
++v14;
v16 += 2;
if ( v14 >= *v7 )
goto LABEL_20;
}
}
if ( v14 != -1 )
{
v15 = v27;
v5 = v14;
goto LABEL_26;
}
LABEL_20:
sub_10007550(&v20, v5, v5 >> 31, v27);
v17 = *v7;
v15 = v27;
if ( (int *)*v7 != v25 || (v15 = v27 + 1, v27 = v15, v25 = (int *)__ROL4__(v25, 1), v15 <= 12) )
{
if ( v17 != 4096 )
{
v7[2 * v17 + 1] = v5;
v7[2 * (*v7)++ + 2] = v13;
}
}
else
{
v15 = 9;
*v7 = 256;
v27 = 9;
v25 = (int *)512;
}
v5 = v13;
LABEL_26:
v12 = v24 - 1;
v11 = v26 + 1;
v24 = v12;
++v26;
}
while ( v12 > 0 );
if ( v5 != -1 )
sub_10007550(&v20, v5, v5 >> 31, v15);
v18 = HIDWORD(v22);
v19 = SHIDWORD(v22) / 8 + 1;
if ( !(SHIDWORD(v22) % 8) )
v19 = SHIDWORD(v22) / 8;
*a4 = v19;
*a5 = v18;
*a3 = v20;
sub_1008C152(v7);//HeapFree free相关
}
char __thiscall sub_10007550(_DWORD *this, int a2, int a3, signed int a4)
{
unsigned int v4; // ebx
_DWORD *v5; // esi
signed int v6; // ecx
int v7; // edx
char v8; // dh
_BYTE *v9; // edi
char result; // al
int v11; // ecx
v4 = 0;
v5 = this;
if ( a4 > 0 )
{
do
{
v6 = 0;
if ( v4 >= 0x20 )
v6 = 1 << v4;
v7 = v6 ^ (1 << v4);
if ( v4 >= 0x40 )
v6 ^= 1 << v4;
if ( __PAIR__(a3 & (unsigned int)v6, a2 & (unsigned int)v7) )
v8 = -1;
else
v8 = 0;
v9 = (_BYTE *)(*v5 + v5[3]);
result = v8 & (1 << v5[4]) | *v9 & ~(1 << v5[4]);
*v9 = result;
++v5[5];
if ( ++v5[4] == 8 )
{
++v5[3];
v11 = v5[1];
v5[4] = 0;
if ( v5[3] == v11 )
result = sub_100074B0(8 * v11 * v5[2]);
}
++v4;
}
while ( (signed int)v4 < a4 );
}
return result;
}
int __thiscall sub_100074B0(int *this, int a2)
{
int v2; // edx
int *v3; // ebx
int v4; // edx
unsigned int v5; // ecx
int v6; // eax
int result; // eax
int v8; // esi
int v9; // edi
int v10; // [esp+4h] [ebp-4h]
void *v11; // [esp+10h] [ebp+8h]
v2 = 8;
if ( a2 > 0 )
v2 = a2;
v3 = this;
if ( v2 % 8 )
{
v4 = v2 - 1;
v5 = 1;
do
{
v6 = v4 >> v5;
v5 *= 2;
v4 |= v6;
}
while ( v5 < 0x20 );
v2 = v4 + 1;
}
result = v3[1];
v8 = v2 / 8;
v10 = result;
if ( v2 / 8 > result )
{
v11 = (void *)*v3;
v9 = sub_10094C44(v8);//核心是RtlAllocateHeap相关 大概应该是malloc
sub_1008E920(v9, 0, v8);//memset
result = (int)v11;
if ( v11 )
{
sub_1008E3A0(v9, v11, v10);//复制 拷贝相关
result = sub_1009470E(v11);////HeapFree free相关
}
*v3 = v9;
v3[1] = v8;
}
return result;
}
才疏学浅 希望师傅们多多提携
