# Path: malwareconfig/crypto.py
# def decrypt_rsa(key, data):
# def decrypt_xor(key, data):
# def decrypt_arc4(key, data):
# def decrypt_des_ecb(key, data, iv=None):
# def decrypt_des_cbc(key, data, iv=None):
# def decrypt_des3(key, data):
# def decrypt_aes(key, data):
# def decrypt_aes_cbc_iv(key, iv, data):
# def decrypt_blowfish(key, data):
# def decrypt_RC6(key, encrypted, P, Q, rounds):
#     def rol(a, i):
#     def ror(a, i):
#     def to_int(bytestring):
#     def decrypt_block(block, S):
# def derive_pbkdf2(key, salt, iv_length, key_length, iterations=8):
#     T = 2 * rounds + 4
#     L = to_int(key)
#     S = []
#     S = [0 for i in range(T)]
#     S[0] = P
#     A = 0
#     B = 0
#         A = S[i] = rol((S[i] + A + B), 3)
#         B = L[j] = rol((L[j] + A + B), (A + B))
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


import re
from struct import unpack
from malwareconfig import crypto
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
        for config in config_list:
            config_dict['{}_Domain'.format(counter)] = config[0].rstrip(b'V')
            config_dict['{}_URI GET1 Folder'.format(counter)] = config[1].rstrip(b'V')
            config_dict['{}_URI GET3 File'.format(counter)] = config[2].rstrip(b'V')
            config_dict['{}_URI GET2 File'.format(counter)] = config[3].rstrip(b'V')
            config_dict['{}_URI GET3 Arg'.format(counter)] = config[4].rstrip(b'V')
            config_dict['{}_Copy File Name'.format(counter)] = config[5].rstrip(b'V')
            config_dict['{}_AutoRun Key'.format(counter)] = config[6].rstrip(b'V')
            config_dict['{}_Copy File Path'.format(counter)] = config[7].rstrip(b'V')
            config_dict['{}_Campaign ID'.format(counter)] = config[8].rstrip(b'V')
            config_dict['{}_Waiting Time'.format(counter)] = unpack('<H', config[9][:2].rstrip(b'V'))[0]
            counter += 1
        return config_dict


    def get_config(self):
        '''
        This is the main entry
        :return:
        '''

        config_dict = {}

        file_data = self.file_info.file_data

        # RE for 1.0 and 1.1
        re_pattern1 = b'([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})(.{12}\x77\x77\x77\x77)'
        # RE for 1.2, 1.3, 1.4
        re_pattern2 = b'([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{12})(0uVVVVVV)'


# Path: malwareconfig/crypto.py
# def decrypt_rsa(key, data):
# def decrypt_xor(key, data):
# def decrypt_arc4(key, data):
# def decrypt_des_ecb(key, data, iv=None):
# def decrypt_des_cbc(key, data, iv=None):
# def decrypt_des3(key, data):
# def decrypt_aes(key, data):
# def decrypt_aes_cbc_iv(key, iv, data):
# def decrypt_blowfish(key, data):
# def decrypt_RC6(key, encrypted, P, Q, rounds):
#     def rol(a, i):
#     def ror(a, i):
#     def to_int(bytestring):
#     def decrypt_block(block, S):
# def derive_pbkdf2(key, salt, iv_length, key_length, iterations=8):
#     T = 2 * rounds + 4
#     L = to_int(key)
#     S = []
#     S = [0 for i in range(T)]
#     S[0] = P
#     A = 0
#     B = 0
#         A = S[i] = rol((S[i] + A + B), 3)
#         B = L[j] = rol((L[j] + A + B), (A + B))
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


# Path: malwareconfig/decoders/sakula.py
import re
from struct import unpack
from malwareconfig import crypto
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable

        for config in config_list:
            config_dict['{}_Domain'.format(counter)] = config[0].rstrip(b'V')
            config_dict['{}_URI GET1 Folder'.format(counter)] = config[1].rstrip(b'V')
            config_dict['{}_URI GET3 File'.format(counter)] = config[2].rstrip(b'V')
            config_dict['{}_URI GET2 File'.format(counter)] = config[3].rstrip(b'V')
            config_dict['{}_URI GET3 Arg'.format(counter)] = config[4].rstrip(b'V')
            config_dict['{}_Copy File Name'.format(counter)] = config[5].rstrip(b'V')
            config_dict['{}_AutoRun Key'.format(counter)] = config[6].rstrip(b'V')
            config_dict['{}_Copy File Path'.format(counter)] = config[7].rstrip(b'V')
            config_dict['{}_Campaign ID'.format(counter)] = config[8].rstrip(b'V')
            config_dict['{}_Waiting Time'.format(counter)] = unpack('<H', config[9][:2].rstrip(b'V'))[0]
            counter += 1
        return config_dict


    def get_config(self):
        '''
        This is the main entry
        :return:
        '''

        config_dict = {}

        file_data = self.file_info.file_data

        # RE for 1.0 and 1.1
        re_pattern1 = b'([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})([ -~\x88]{100})(.{12}\x77\x77\x77\x77)'
        # RE for 1.2, 1.3, 1.4
        re_pattern2 = b'([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{50})([ -~]{12})(0uVVVVVV)'


        xor_data = crypto.decrypt_xor('\x88', file_data)