def gen_key(k):
	return(((k << 0x1d) | (k >> 3)) & 0xffffffff)

#Unpacked of 32a683ac11d966d73fedf4e249573022891ac902086167e4d20b18be28bd2c1d
for addr in XrefsTo(0x40233e, flags=0):
	addr = addr.frm
	#print(hex(addr))
	addr = idc.PrevHead(addr)
	while GetMnem(addr) != "push":
		addr = idc.PrevHead(addr)
	print(hex(addr))
	#Get first param pushed which is address of domain
	data_addr = GetOperandValue(addr,0)
	
	xork_init = Dword(data_addr)
	data_addr += 4
	length_delta = Word(data_addr)
	data_addr += 2
	length = (xork_init ^ length_delta) & 0xffff
	out = ""
	xork = xork_init
	for i in range(length):
		xork = gen_key(xork)
		xork += i
		out += chr((Byte(data_addr) ^ (xork & 0xFF)) & 0xFF)
		data_addr += 1
	if out[-2:] == '\x00\x00':
		print(out.decode('utf16'))
	else:
		print(out)
	
	
def other_decode(data, key, l):
	out = ""
	for i in range(l):
		key = ror(key, 1)
		key = ~key
		key = ror(key,1)
		key -= 0x120
		key = rol(key, 1)
		key = ~key
		key -= 0x9101
		out += chr(Byte(data+i) ^ (key & 0xff))
	return out
	
	
	
def decode(data_addr):
	#data_addr = GetOperandValue(addr,0)
	xork_init = Dword(data_addr)
	data_addr += 4
	length_delta = Word(data_addr)
	data_addr += 2
	length = (xork_init ^ length_delta) & 0xffff
	out = ""
	xork = xork_init
	for i in range(length):
		xork = gen_key(xork)
		xork += i
		out += chr((Byte(data_addr) ^ (xork & 0xFF)) & 0xFF)
		data_addr += 1
	if out[-2:] == '\x00\x00':
		print(out.decode('utf16'))
	else:
		print(out)

Add IcedID downloader ida string decoding
Add IcedID downloader ida string decoding
