r2pipe script

r2_decoder.py

import r2pipe

class test:
    def __init__(self):
        self.r2 = r2pipe.open("7410597531f22a3f89bb8d133488252360c5dc701862f86c4f60fd79722f7e37")
        self.r2.cmd("aaa")
        self.decode_addr = 0x40159d
        self.xrefs = self.r2.cmdj("axtj {}".format(self.decode_addr))

    def decode(self, string):
        string = [ord(c) for c in string]
        for i in range (0,len(string)):
            if string[i] < 97 or string[i] > 122:
                continue
            elif string[i] < 101 or string[i] > 106:
                if string[i] < 116 or string[i] > 121:
                    continue
                else:   
                    string[i] = string[i] - 15
            else:
                string[i] = string[i] + 15
        return ''.join([chr(i) for i in string])

    def get_string(self, addr):
        string = ""
        while True:
            search_str = int(self.r2.cmd("pxj 1 @ {}".format(addr))[1:-1])
            if search_str != 0:
                string += chr(search_str)
            else:
                break
            addr += 1
        return string

    def run(self):
        for xref in self.xrefs:
            data = self.r2.cmdj("pdj -3 @ {}".format(xref['from']))
            string_addr = data[0]

            if 'val' in string_addr:
                print("addr : {}\ndisasm : {}\nvalue : {}\n".format(hex(string_addr['offset']),
                                                                    string_addr['disasm'],
                                                                    self.decode(self.get_string(string_addr['val']))))

if __name__ == '__main__':
    a = test()
    a.run()

result.txt

addr : 0x40148d
disasm : push str.rtcg
value : recv

addr : 0x40149d
disasm : push str.stesockope
value : setsockopt

addr : 0x4014ad
disasm : push str.WSASearefp
value : WSAStartup

addr : 0x4014bd
disasm : push str.lxsetn
value : listen

addr : 0x4014cd
disasm : push str.swfedohn
value : shutdown

addr : 0x4014dd
disasm : push str.vtewosebjnamt
value : gethostbyname

addr : 0x4014ed
disasm : push str.acctpe
value : accept

addr : 0x401510
disasm : push str.clostsockte
value : closesocket

addr : 0x401520
disasm : push str.sockte
value : socket

addr : 0x401530
disasm : push str.weons
value : htons

addr : 0x401540
disasm : push str.stltce
value : select

addr : 0x401550
disasm : push str.stnd
value : send

addr : 0x401560
disasm : push str.WSAFDIsSte
value : __WSAFDIsSet

addr : 0x401570
disasm : push str.bxnd
value : bind

addr : 0x401621
disasm : push str.GteProctssTxmts
value : GetProcessTimes

addr : 0x401631
disasm : push str.Modflt32Fxrse
value : Module32First

addr : 0x401641
disasm : push str.WxnEitc
value : WinExec

addr : 0x401651
disasm : push str.FxndFxrseFxltA
value : FindFirstFileA

addr : 0x401661
disasm : push str.LocalAlloc
value : LocalAlloc

addr : 0x401671
disasm : push str.CrtaetTwrtad
value : CreateThread

addr : 0x401681
disasm : push str.RtadFxlt
value : ReadFile

addr : 0x401691
disasm : push str.GteFxltSxzt
value : GetFileSize

addr : 0x4016b4
disasm : push str.ClostHandlt
value : CloseHandle

addr : 0x4016c4
disasm : push str.GteTtmpFxltNamtA
value : GetTempFileNameA

addr : 0x4016d4
disasm : push str.Proctss32Fxrse
value : Process32First

addr : 0x4016e4
disasm : push str.DtltetFxltA
value : DeleteFileA

addr : 0x4016f4
disasm : push str.LoadLxbrarjA
value : LoadLibraryA

addr : 0x401704
disasm : push str.GteEixeCodtTwrtad
value : GetExitCodeThread

addr : 0x401714
disasm : push str.GteFxltTxmt
value : GetFileTime

addr : 0x401737
disasm : push str.LocalFrtt
value : LocalFree

addr : 0x401747
disasm : push str.WaxeForSxnvltObytce
value : WaitForSingleObject

addr : 0x401757
disasm : push str.GteModfltFxltNamtA
value : GetModuleFileNameA

addr : 0x401767
disasm : push str.WrxetFxlt
value : WriteFile

addr : 0x401777
disasm : push str.Proctss32Ntie
value : Process32Next

addr : 0x401787
disasm : push str.Slttp
value : Sleep

addr : 0x401797
disasm : push str.MapVxthOuFxlt
value : MapViewOfFile

addr : 0x4017ba
disasm : push str.CopjFxltA
value : CopyFileA

addr : 0x4017ca
disasm : push str.SteFxltPoxnetr
value : SetFilePointer

addr : 0x4017da
disasm : push str.GteFxltAeerxbfetsA
value : GetFileAttributesA

addr : 0x4017ea
disasm : push str.CrtaetToolwtlp32Snapswoe
value : CreateToolhelp32Snapshot

addr : 0x4017fa
disasm : push str.GteTtmpPaewA
value : GetTempPathA

addr : 0x40180a
disasm : push str.CrtaetProctssA
value : CreateProcessA

addr : 0x40181a
disasm : push str.GteLocalTxmt
value : GetLocalTime

addr : 0x40183d
disasm : push str.GteCfrrtneProctss
value : GetCurrentProcess

addr : 0x40184d
disasm : push str.UnmapVxthOuFxlt
value : UnmapViewOfFile

addr : 0x40185d
disasm : push str.GteVtrsxonEiA
value : GetVersionExA

addr : 0x40186d
disasm : push str.SteFxltTxmt
value : SetFileTime

addr : 0x40187d
disasm : push str.GteLovxcalDrxgts
value : GetLogicalDrives

addr : 0x40188d
disasm : push str.OptnProctss
value : OpenProcess

addr : 0x40189d
disasm : push str.CrtaetFxltA
value : CreateFileA

addr : 0x4018c0
disasm : push str.FrttLxbrarj
value : FreeLibrary

addr : 0x4018d0
disasm : push str.VxrefalProetceEi
value : VirtualProtectEx

addr : 0x4018e0
disasm : push str.WrxetProctssMtmorj
value : WriteProcessMemory

addr : 0x4018f0
disasm : push str.GteCompfetrNamtA
value : GetComputerNameA

addr : 0x401900
disasm : push str.FxndNtieFxltA
value : FindNextFileA

addr : 0x401910
disasm : push str.GteModfltHandltA
value : GetModuleHandleA

addr : 0x401920
disasm : push str.MogtFxltEiA
value : MoveFileExA

addr : 0x401943
disasm : push str.CrtaetFxltMappxnvA
value : CreateFileMappingA

addr : 0x401953
disasm : push str.VxrefalQftrjEi
value : VirtualQueryEx

addr : 0x401963
disasm : push str.GteDrxgtTjptA
value : GetDriveTypeA

addr : 0x4019e2
disasm : push str.RtvOptnKtjA
value : RegOpenKeyA

addr : 0x4019f2
disasm : push str.ConerolStrgxct
value : ControlService

addr : 0x401a02
disasm : push str.SteStrgxctSeaefs
value : SetServiceStatus

addr : 0x401a12
disasm : push str.ClostStrgxctHandlt
value : CloseServiceHandle

addr : 0x401a22
disasm : push str.AdyfseToktnPrxgxltvts
value : AdjustTokenPrivileges

addr : 0x401a32
disasm : push str.LookfpPrxgxltvtValftA
value : LookupPrivilegeValueA

addr : 0x401a42
disasm : push str.OptnStrgxctA
value : OpenServiceA

addr : 0x401a65
disasm : push str.DtltetStrgxct
value : DeleteService

addr : 0x401a75
disasm : push str.RtvDtltetValftA
value : RegDeleteValueA

addr : 0x401a85
disasm : push str.CwanvtStrgxctConuxv2A
value : ChangeServiceConfig2A

addr : 0x401a95
disasm : push str.OptnSCManavtrA
value : OpenSCManagerA

addr : 0x401aa5
disasm : push str.CrtaetStrgxctA
value : CreateServiceA

addr : 0x401ab5
disasm : push str.SeareStrgxctA
value : StartServiceA

addr : 0x401ac5
disasm : push str.RtvSteValftEiA
value : RegSetValueExA

addr : 0x401ae8
disasm : push str.RtvxsetrStrgxctCerlHandltrA
value : RegisterServiceCtrlHandlerA

addr : 0x401af8
disasm : push str.RtvCrtaetKtjA
value : RegCreateKeyA

addr : 0x401b08
disasm : push str.SeareStrgxctCerlDxspaecwtrA
value : StartServiceCtrlDispatcherA