Parallax_pastebin_decoder.py

import base64
import glob
import os
import binascii
import struct


INPUT_DIRECTORY = "pastebins"
OUT_DIRECTORY = "bin"
PASTEBIN_URL_TEMP = "https://pastebin.com/raw/"


def xor(value, key):
    res = []
    for i in range(len(value)):
        res.append(value[i] ^ key[i % len(key)])
    return res


def decode_pastebin(file_path):
    with open(file_path) as f:
        r = f.read()

    base64decoded = base64.b64decode(r)
    pastebin_url = PASTEBIN_URL_TEMP + os.path.basename(file_path)[:-4]
    pastebin_crc32 = hex(binascii.crc32(str.encode(pastebin_url)))[2:]
    if len(pastebin_crc32) < 8:
        pastebin_crc32 = '0' + pastebin_crc32
    key = struct.unpack('>i', bytes.fromhex(pastebin_crc32))[0]

    exe = xor(base64decoded, [ord(i) for i in str(key)])

    with open(os.path.join(OUT_DIRECTORY, os.path.basename(file_path)[:-3] + "bin"), "wb") as f:
        f.write(bytearray(exe))


def main():
    for filepath in glob.iglob(os.path.join(INPUT_DIRECTORY, "*.txt")):
        decode_pastebin(filepath)


if __name__ == "__main__":
    main()