kmdnet

def decode(arg):
    try:
        eax = arg
        ebp_38 = 0
        ebp_34 = 0

        while ebp_34 - 0x28 <= 0:
            ebp_30 = 0

            eax = ord(arg[ebp_34])

kmdnet

Private Function func1(arg_array As Variant, arg_int As Integer)
    Dim local_str1, local_str2 As String, local3, local4
    local_str2 = ActiveDocument.Variables("ppKzr").Value()
    local_str1 = ""
    local3 = 1
    While local3 < UBound(arg_array) + 2
        local4 = local3 Mod Len(local_str2): If local4 = 0 Then local4 = Len(local_str2)
        local_str1 = local_str1 + Chr(Asc(Mid(local_str2, local4 + arg_int, 1)) Xor CInt(arg_array(local3 - 1)))
        local3 = local3 + 1
    Wend

kmdnet

import base64

x = "MDgxOTE2MjMwZTMxMDIzMTNhNjk2YjA3NjgzNjM0MjE2YTJjMzA2ODJiNmIwNzBmMzA2ODA3MTMz\nNjY4MmYwNzJmMzA2YjJhNmI2YTM0Njg2ODMzMjU="
work = []
flag = ""

base = base64.b64decode(x)

for i in range(0,len(base),2):
    work.append(base[i:i+2])

kmdnet

password = [171,184,42,184,88,26,47,154,20,219,203,130,52,19,180,214,156,94,186,74,30,248,119,235,139,130,175,141,179,197,8,204,252]


def decode(strings):
    s = [178, 192, 199, 24, 97, 196, 254, 31, 188, 102, 214, 245, 205, 39, 211, 204, 21, 229, 253, 163, 115, \
     194, 154, 63, 37, 46, 209, 88, 66, 103, 19, 73, 130, 114, 158,78, 49, 92, 119, 146, 32, 12, 153, 203, \
     81, 242, 84, 239, 129, 34, 183, 43, 91, 171, 162, 71, 128, 218, 121, 137, 45, 85, 56, 233, 150, 151, \
     255, 167, 42, 35, 17, 133, 107, 185, 117, 200, 215, 210,13, 28, 8, 104, 74, 108, 244, 227, 54, 9, 68, \
     41, 64, 72, 106, 168, 61, 220, 186, 6, 93, 142, 157,57, 156, 248, 18, 232, 234, 181, 159, 110, 236, 126, \
     62, 70, 76, 138, 105, 155, 251, 177, 247, 22, 89, 176, 0, 182, 52, 27, 29, 216, 100, 206, 15, 195, 202, \

kmdnet

import base64
import re

lmark = "eval MIME::Base64::decode"
sp = 'decode.\"(.+)\".;'
output = ""
count2 = 0

with open("bowie.pl","r") as f:
	data = f.read()

kmdnet

import base64
import re

lmark = "eval MIME::Base64::decode"
sp = 'decode.\"(.+)\".;'

data = ""
output = ""
result = ""
p = re.compile(sp)

kmdnet

work = ["01010000","01000001",
        "01001110","01111011",
        "01010100","01101000",
        "00110011","01011111",
        "00100100","01110001",
        "01110101","01101001",
        "01110010","01110100",
        "01001100","00110011",
        "01011111","00100100",
        "01110001","01110101",

kmdnet

#include<Windows.h>
#include<winternl.h>
#include<stdio.h>


void GetKernel32BaseAddress() {
	PPEB pPeb;		// PEB
	PLDR_DATA_TABLE_ENTRY pLdrDataTableEntry;
	PLIST_ENTRY pListEntry;

kmdnet

import pefile
import sys
import os


def ror32(num,count):
    num1 = (num >> count) & 0xFFFFFFFF
    num2 = (num << (32 - count)) & 0xFFFFFFFF
    return num1 | num2

kmdnet

// EICAR_RULE              
                                                                      
rule Eicar_rule{                                                      
    meta:                                                             
        description = "Detects eicar file"                            
                                                                      
        author = "kmdnet"                                             
        date = "2016/10/24"                                           
        hash = "8a8f36de82e1278abb02f"