PHP Code:
_32bitMutation proc near
hash = dword ptr 4
//why is this named hash?
//it seems to be more or less the same as var_4 in the old version
//but positive of course
mov eax, [esp+4] //eax becomes equal to the 4th URL char
$eax = $url[3];
push esi //esi to stack
//esi is the result of the 4th XOR round of BJHash
//i havent seen the latest dump yet though so this could be wrong
push 0Dh // ecx = 13 }
pop ecx // ecx = 13 }
xor edx, edx // edx = 0
$edx = 0;
div ecx // ecx = ecx/13
$eax = (int)($eax/13);
mov eax, [esp+4+hash] //eax becomes equal to the 8th URL char
$eax = $url[7];
push 7 // esi = 7 }
pop esi // esi = 7 }
$esi = 7;
mov ecx, edx // ecx = remainder of the DIV
$ecx = $eax%13;
xor edx, edx // edx = 0
$edx = 0;
div esi // eax DIV 7
$eax = $eax/7;
and ecx, 7 // ecx AND 7
$ecx = $ecx & 7;
pop esi // return the value to esi we saved at the start
$esi = $BJHash[3][0];
shl eax, 2 //multiply eax by 8
$eax = ($eax << 2);
or eax, ecx //eax OR ecx
$eax = $eax | $ecx;
retn