decrypt_satan.py

def decrypt_n_comment(func, func_name):
    """
    Decryption of Satan string
    """
    for xref in XrefsTo(LocByName(func_name)):
        # init retrieve arguments
        index_ea = search_inst(xref.frm, "push")
        index_op = GetOperandValue(index_ea, 0)

        buf = Appcall.buffer("\x00" * 512)

        # Call Satan's func
        res = func(index_op, buf)


        try:
            # Add comments
            MakeComm(xref.frm, "index[0x{:X}] : '{:s}'".format(index_op, buf.value.decode("utf-16").rstrip('\x00\x00'))) 
        except:
            continue

def search_inst(ea, inst):
    """
    Find first instruction before the given ea
    """
    while True:
        if GetMnem(ea) == inst:
            return ea
        ea = PrevHead(ea)

# Initialization ------------------------------------------
FUNC_NAME = "get_string"
PROTO = "int __usercall {:s}@<eax>(WORD index@<ecx>, PCHAR buf@<edx>);".format(FUNC_NAME)


# Execution -----------------------------------------------
decrypt_function = Appcall.proto(FUNC_NAME, PROTO)
decrypt_n_comment(decrypt_function, FUNC_NAME)