Question

This function is written in ActionScirpt. What kind of decryption this is? Is there existing function in PHP for this function?

function decrypt(str, key1, key2) {
  var v1 = [];
  var v3 = 0;
  while (v3 < str.length) {
    switch (str.charAt(v3)) {
      case '0':
        v1.push('0000');
        break;
      case '1':
        v1.push('0001');
        break;
      case '2':
        v1.push('0010');
        break;
      case '3':
        v1.push('0011');
        break;
      case '4':
        v1.push('0100');
        break;
      case '5':
        v1.push('0101');
        break;
      case '6':
        v1.push('0110');
        break;
      case '7':
        v1.push('0111');
        break;
      case '8':
        v1.push('1000');
        break;
      case '9':
        v1.push('1001');
        break;
      case 'a':
        v1.push('1010');
        break;
      case 'b':
        v1.push('1011');
        break;
      case 'c':
        v1.push('1100');
        break;
      case 'd':
        v1.push('1101');
        break;
      case 'e':
        v1.push('1110');
        break;
      case 'f':
        v1.push('1111');
    }
    ++v3;
  }
  v1 = (v1.join('')).split('');
  var v6 = [];
  v3 = 0;
  while (v3 < 384) {
    key1 = (key1 * 11 + 77213) % 81371;
    key2 = (key2 * 17 + 92717) % 192811;
    v6[v3] = (key1 + key2) % 128;
    ++v3;
  }
  v3 = 256;
  while (v3 >= 0) {
    var v5 = v6[v3];
    var v4 = v3 % 128;
    var v8 = v1[v5];
    v1[v5] = v1[v4];
    v1[v4] = v8;
    --v3;
  }
  v3 = 0;
  while (v3 < 128) {
    v1[v3] ^= v6[v3 + 256] & 1;
    ++v3;
  }
  var v12 = v1.join('');
  var v7 = [];
  v3 = 0;
  while (v3 < v12.length) {
    var v9 = v12.substr(v3, 4);
    v7.push(v9);
    v3 += 4;
  }
  var v2 = [];
  v3 = 0;
  while (v3 < v7.length) {
    switch (v7[v3]) {
      case '0000':
        v2.push('0');
        break;
      case '0001':
        v2.push('1');
        break;
      case '0010':
        v2.push('2');
        break;
      case '0011':
        v2.push('3');
        break;
      case '0100':
        v2.push('4');
        break;
      case '0101':
        v2.push('5');
        break;
      case '0110':
        v2.push('6');
        break;
      case '0111':
        v2.push('7');
        break;
      case '1000':
        v2.push('8');
        break;
      case '1001':
        v2.push('9');
        break;
      case '1010':
        v2.push('a');
        break;
      case '1011':
        v2.push('b');
        break;
      case '1100':
        v2.push('c');
        break;
      case '1101':
        v2.push('d');
        break;
      case '1110':
        v2.push('e');
        break;
      case '1111':
        v2.push('f');
    }
    ++v3;
  }
  return v2.join('');
}

Answer 1

It looks like its converting hexadecimal values in to single byte binary values and pushing them onto the stack (although those values are probably not actually stored as single bytes.) And then there’s second case statement doing the reverse operation.

There is also some scrambling or unscrambling (multiplying by a specified value adding a specified number and then the modular division); of the strings passed in. With the finally module 128 operation the joined string looks suspiciously like someone returning a valid ASCII code to write out to disk based on the hashed value of the joined strings. Though, it seems to me like you’d get a lot of collisions doing that; but maybe not. I suppose it might work well if you original data set only contains ASCII values.