# Path: malwareconfig/crypto.py
# def decrypt_arc4(key, data):
#     cipher = ARC4.new(key)
#     return cipher.decrypt(data)
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


from malwareconfig.crypto import decrypt_arc4
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
from binascii import hexlify
import re

class Remcos(Decoder):
    decoder_name = "Remcos"
    decoder__version = 1
    decoder_author = "@kevthehermit"
    decoder_description = "Remcos Decoder"

    def __init__(self):
        self.config = {}



    def get_config(self):
        '''
        This is the main entry
        :return:
        '''
        # Use file data to get version number

        version_string = "Unknown"
        ascii_strings = self.file_info.ascii_strings()
        for s in ascii_strings:
            if re.search(b'^[12]\.\d+\d{0,1}.*[FPL].*', s):
                version_string = s
            
        res_data = self.file_info.pe_resource_by_name("SETTINGS")
        key_length_byte = res_data[0]
        key_length = key_length_byte
        key = res_data[1:key_length+1]
        encrypted_config = res_data[key_length+1:]

# Path: malwareconfig/crypto.py
# def decrypt_arc4(key, data):
#     cipher = ARC4.new(key)
#     return cipher.decrypt(data)
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


# Path: malwareconfig/decoders/remcos.py
from malwareconfig.crypto import decrypt_arc4
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
from binascii import hexlify
import re


class Remcos(Decoder):
    decoder_name = "Remcos"
    decoder__version = 1
    decoder_author = "@kevthehermit"
    decoder_description = "Remcos Decoder"

    def __init__(self):
        self.config = {}



    def get_config(self):
        '''
        This is the main entry
        :return:
        '''
        # Use file data to get version number

        version_string = "Unknown"
        ascii_strings = self.file_info.ascii_strings()
        for s in ascii_strings:
            if re.search(b'^[12]\.\d+\d{0,1}.*[FPL].*', s):
                version_string = s
            
        res_data = self.file_info.pe_resource_by_name("SETTINGS")
        key_length_byte = res_data[0]
        key_length = key_length_byte
        key = res_data[1:key_length+1]
        encrypted_config = res_data[key_length+1:]

        decrypted_config = decrypt_arc4(key, encrypted_config)