# Path: malwareconfig/crypto.py
# def decrypt_arc4(key, data):
#     cipher = ARC4.new(key)
#     return cipher.decrypt(data)
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


import pefile
import yara
import struct
from malwareconfig.crypto import decrypt_arc4
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
        return domain_list


    def get_config(self):
        '''
        This is the main entry
        :return:
        '''

        file_data = self.file_info.file_data

        pe = pefile.PE(data=file_data, fast_load=False)

        data = self.yara_scan(file_data, '$opcodes03')

        try:
            key_va = struct.unpack('i', data[0][19:23])[0]
        except:
            data = self.yara_scan(file_data, '$opcodes05')
            key_va = struct.unpack('<i', data[0][23:27])[0]
        key_hex = self.pe_data(pe, key_va, 16)


        data_2 = self.yara_scan(file_data, '$opcodes04')

        config_list = []
        for section in data_2:
            length = struct.unpack('i', section[9:13])[0]
            data_va = struct.unpack('i', section[17:21])[0]
            sec_data = self.pe_data(pe, data_va, length)

# Path: malwareconfig/crypto.py
# def decrypt_arc4(key, data):
#     cipher = ARC4.new(key)
#     return cipher.decrypt(data)
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


# Path: malwareconfig/decoders/netwire.py
import pefile
import yara
import struct
from malwareconfig.crypto import decrypt_arc4
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable

        return domain_list


    def get_config(self):
        '''
        This is the main entry
        :return:
        '''

        file_data = self.file_info.file_data

        pe = pefile.PE(data=file_data, fast_load=False)

        data = self.yara_scan(file_data, '$opcodes03')

        try:
            key_va = struct.unpack('i', data[0][19:23])[0]
        except:
            data = self.yara_scan(file_data, '$opcodes05')
            key_va = struct.unpack('<i', data[0][23:27])[0]
        key_hex = self.pe_data(pe, key_va, 16)


        data_2 = self.yara_scan(file_data, '$opcodes04')

        config_list = []
        for section in data_2:
            length = struct.unpack('i', section[9:13])[0]
            data_va = struct.unpack('i', section[17:21])[0]
            sec_data = self.pe_data(pe, data_va, length)

            dec = decrypt_arc4(key_hex, sec_data)