stubs decode script for EndCLient RAT

stubs_decode.py

#!/usr/bin/env python3
import base64, pathlib

out = pathlib.Path("stubs_bin"); out.mkdir(exist_ok=True)

def w(name, data: bytes):
    p = out / name
    p.write_bytes(data)
    print(f"{p}  {len(data)} bytes")

def fromhex(s): 
    return bytes.fromhex(s)

def fromb64(s):
    pad = (-len(s)) % 4
    if pad: s += "=" * pad
    return base64.b64decode(s)

memsearch_x64_hex = (
""
""
)
memsearch_x86_hex = (
""
""
)
b64dec_x64_hex = (
""
)
b64dec_x86_hex = (
""
)
b64enc_x64_b64 = (
""
)
b64enc_x86_b64 = (
""
)
lzma_x64_b64 = (
""
)
lzma_x86_b64 = (
""
)

w("memsearch_x64.bin", fromhex(memsearch_x64_hex))
w("memsearch_x86.bin", fromhex(memsearch_x86_hex))

w("base64decode_x64.bin", fromhex(b64dec_x64_hex))
w("base64decode_x86.bin", fromhex(b64dec_x86_hex))

w("base64encode_x64.bin", fromb64(b64enc_x64_b64))
w("base64encode_x86.bin", fromb64(b64enc_x86_b64))

w("lzmadecompress_x64.bin", fromb64(lzma_x64_b64))
w("lzmadecompress_x86.bin", fromb64(lzma_x86_b64))

print(f"Done -> {out.resolve()}")