#!/usr/bin/python
# This IDAPython code can be used to de-obfuscate strings generated by
# CryptoWall version 3, as well as any other malware samples that make use of
# this technique. 

'''
Example disassembly:

	.text:00405D8B                 mov     [ebp+var_40], 68h ; http://ip-addr.es
	.text:00405D8F                 mov     [ebp+var_3F], 74h
	.text:00405D93                 mov     [ebp+var_3E], 74h
	.text:00405D97                 mov     [ebp+var_3D], 70h
	.text:00405D9B                 mov     [ebp+var_3C], 3Ah
	.text:00405D9F                 mov     [ebp+var_3B], 2Fh
	.text:00405DA3                 mov     [ebp+var_3A], 2Fh
	.text:00405DA7                 mov     [ebp+var_39], 69h
	.text:00405DAB                 mov     [ebp+var_38], 70h
	.text:00405DAF                 mov     [ebp+var_37], 2Dh
	.text:00405DB3                 mov     [ebp+var_36], 61h
	.text:00405DB7                 mov     [ebp+var_35], 64h
	.text:00405DBB                 mov     [ebp+var_34], 64h
	.text:00405DBF                 mov     [ebp+var_33], 72h
	.text:00405DC3                 mov     [ebp+var_32], 2Eh
	.text:00405DC7                 mov     [ebp+var_31], 65h
	.text:00405DCB                 mov     [ebp+var_30], 73h
	.text:00405DCF                 mov     [ebp+var_2F], 0 ;
'''

pos = here()
original_pos = pos
out = ""
while True:
	if GetMnem(pos) == "mov" and "[ebp" in GetOpnd(pos, 0):
		ordinal = GetOperandValue(pos,1)
		if ordinal == 0:
			MakeComm(og, out)
			print "Making String: %s" % out
			out = ""
			original_pos = pos
		else:
			out += chr(ordinal)
	else:
		break
	pos = NextHead(pos)