malware-kitten · August 29, 2015 14:08
diff --git a/cohhoc_decode b/cohhoc_decode
 require 'base64'

 data = "3d3duIWRvYmVzZXJ2aWNlbi5ldE="
 decode = Base64.decode64(data)

 decode.each_byte do |b|
        #shr dl,6
        #shl al,2
        #or dl,al
        print (((b<<6)%0xff |(b>>2)%0xff)).chr
 end
	require 'base64'

	data = "3d3duIWRvYmVzZXJ2aWNlbi5ldE="
	decode = Base64.decode64(data)

	decode.each_byte do \|b\|
	#shr dl,6
	#shl al,2
	#or dl,al
	print (((b<<6)%0xff \|(b>>2)%0xff)).chr
	end