Get config from unpacked trickbot

trick.py

import re
import sys
import pefile
from mlib.crypto import xor
from mlib.malware import trickbot
from mlib.struct import udword


def find_cfg_params(data):

	rgx = "\x83\x7D\x0C\x00\xBE(..\x00\x00)\x74.\xFF\x75\x0C.\x68(....)"
	hits = re.findall(rgx,data)
	ekey = map(udword,hits[0])
	cfg = map(udword,hits[1])
	return ekey,cfg


def get_xorkey(data):

	rgx = "\x8B\x3D(....)\x83\xE0\xFC\x03\xC1\xBE(....)\x8D"
	return map(udword,re.findall(rgx, data)[0])

pe = pefile.PE(sys.argv[1])
ekey,cfg = find_cfg_params(pe.__data__)
xkey_sa, xkey_a = get_xorkey(pe.__data__)
xkey_s = pe.get_dword_at_rva(xkey_sa  - pe.OPTIONAL_HEADER.ImageBase)
#print hex(xkey_a),xkey_s
xkey_data = pe.get_data(xkey_a - pe.OPTIONAL_HEADER.ImageBase, xkey_s)

ekey_data = xor(pe.get_data(ekey[1] - pe.OPTIONAL_HEADER.ImageBase,ekey[0]),xkey_data)
cfg_data  = xor(pe.get_data(cfg[1] - pe.OPTIONAL_HEADER.ImageBase,cfg[0]),xkey_data)
cfg_data = trickbot.decrypt(cfg_data)
size = udword(cfg_data[:4])
#x = udword(cfg_data[4:8])
print cfg_data[8:size+8]