thunder_c

def hash_dll(x):
    if type(x) is str:
        x = x.encode('ascii')
    h = 0
    for i in x:
        h = ((h >> 0x0d) | (h << (32 - 0x0d))) & 0xffffffff
        if i >= 0x61:
            i -= 32
        h = h + (i & 0xff)
        h = h & 0xffffffff
    return h

def hash(x):
    if type(x) is str:
        x = x.encode('ascii')
    h = 0
    for i in x:
        h = ((h >> 0x0d) | (h << (32 - 0x0d))) & 0xffffffff
        h = h + (i & 0xff)
        h = h & 0xffffffff
    return h

def uni(x):
    return '\0'.join(x) + '\0'

dlls = [ 0x3CFA685D, 0x6A4ABC5B ]

for dll in open('dll_list.txt'):
    dll = dll.strip()
    h = hash_dll(uni(dll))
    if h in dlls:
        print(hex(h), dll)

hashes = [
    0x0EC0E4E8E,
    0x7C0DFCAA,
    0x91AFCA54,
    0x60E0CEEF,
    0x534C0AB8,
    0x0FF7F061A,
    0xEC0E4E8E,
    0x7C0DFCAA,
    0x91AFCA54,
    0x60E0CEEF
]

dll_funcs = set( line.split(' : ')[-1].strip() for line in open('thundercrypt_dll_funcs.txt') if 'Function Name' in line )

for name in dll_funcs:
        h = hash(name)
        if h in hashes:
            print(hex(h), name)

"""
6a4abc5b kernel32.dll
3cfa685d ntdll.dll
ec0e4e8e LoadLibraryA
7c0dfcaa GetProcAddress
91afca54 VirtualAlloc
534c0ab8 NtFlushInstructionCache
ff7f061a RtlExitUserThread
60e0ceef ExitThread
"""