new_contents: def gen_key(k):
  	return(((k << 0x1d) | (k >> 3)) & 0xffffffff)
  
  #Unpacked of 32a683ac11d966d73fedf4e249573022891ac902086167e4d20b18be28bd2c1d
  for addr in XrefsTo(0x40233e, flags=0):
  	addr = addr.frm
  	#print(hex(addr))
  	addr = idc.PrevHead(addr)
  	while GetMnem(addr) != "push":
  		addr = idc.PrevHead(addr)
  	print(hex(addr))
  	#Get first param pushed which is address of domain
  	data_addr = GetOperandValue(addr,0)
  	
  	xork_init = Dword(data_addr)
  	data_addr += 4
  	length_delta = Word(data_addr)
  	data_addr += 2
  	length = (xork_init ^ length_delta) & 0xffff
  	out = ""
  	xork = xork_init
  	for i in range(length):
  		xork = gen_key(xork)
  		xork += i
  		out += chr((Byte(data_addr) ^ (xork & 0xFF)) & 0xFF)
  		data_addr += 1
  	if out[-2:] == '\x00\x00':
  		print(out.decode('utf16'))
  	else:
  		print(out)
  	
  	
  def other_decode(data, key, l):
  	out = ""
  	for i in range(l):
  		key = ror(key, 1)
  		key = ~key
  		key = ror(key,1)
  		key -= 0x120
  		key = rol(key, 1)
  		key = ~key
  		key -= 0x9101
  		out += chr(Byte(data+i) ^ (key & 0xff))
  	return out
  	
  	
  	
  def decode(data_addr):
  	#data_addr = GetOperandValue(addr,0)
  	xork_init = Dword(data_addr)
  	data_addr += 4
  	length_delta = Word(data_addr)
  	data_addr += 2
  	length = (xork_init ^ length_delta) & 0xffff
  	out = ""
  	xork = xork_init
  	for i in range(length):
  		xork = gen_key(xork)
  		xork += i
  		out += chr((Byte(data_addr) ^ (xork & 0xFF)) & 0xFF)
  		data_addr += 1
  	if out[-2:] == '\x00\x00':
  		print(out.decode('utf16'))
  	else:
  		print(out)
  
subject: Add IcedID downloader ida string decoding