def get_encrypted_string()

in tools/latrodectus/latro_str_decrypt.py [0:0]


def get_encrypted_string(xrefs: list) -> list[bytes]:
    encrypted_strings = []
    for xref in xrefs:
        push_ea = idc.prev_head(xref)
        arg_ea = idc.get_operand_value(push_ea, 1)

        if idc.is_loaded(arg_ea):
            byte_list = []
            i = 0

            while True:
                byte1 = idc.get_wide_byte(arg_ea + i)
                byte2 = idc.get_wide_byte(arg_ea + i + 1)

                if byte1 == 0 and byte2 == 0:
                    break

                byte_list.append(byte1)
                byte_list.append(byte2)
                i += 2

        encrypted_strings.append((xref, bytes(byte_list)))

    return encrypted_strings