initial commit

original/extract_vars.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+import re
+from pathlib import Path
+
+content = Path('dontrunACTIVEmalware.bat.txt').read_text(encoding='utf-8', errors='ignore')
+lines = content.split('\n')
+
+variables = {}
+
+for i, line in enumerate(lines, 1):
+    for match in re.finditer(r'"([^"=]+)=([^"]*)"', line):
+        var_name = match.group(1).strip()
+        var_value = match.group(2).strip()
+        if var_name not in variables:
+            variables[var_name] = var_value
+    
+    for match in re.finditer(r'[sS][eE][tT]\s+([a-zA-Z0-9_\[\]\{\}\(\)]+)=([^\s&]+)', line, re.IGNORECASE):
+        var_name = match.group(1).strip()
+        var_value = match.group(2).strip()
+        if var_name not in variables and len(var_value) < 100:
+            variables[var_name] = var_value
+
+print(f"found {len(variables)} vars")
+
+bang_vars = {k: v for k, v in variables.items() if '!' in v}
+print(f"vars with !: {len(bang_vars)}")
+for k, v in bang_vars.items():
+    print(f"  {k} = {v}")
+
+line_42 = lines[41]
+print(f"\nline 42:")
+print(f"  {line_42[:200]}...")
+
+resolved = line_42
+for iteration in range(50):
+    old_resolved = resolved
+    matches = re.findall(r'%([^%]+)%', resolved)
+    for var_name in matches:
+        if var_name in variables:
+            resolved = resolved.replace(f'%{var_name}%', variables[var_name])
+    if old_resolved == resolved:
+        break
+
+print(f"\nresolved after {iteration+1} tries:")
+print(f"  {resolved[:500]}...")
+
+if '!' in resolved:
+    parts = [p.strip() for p in resolved.split('!') if p.strip()]
+    print(f"\ngot {len(parts)} parts")
+    
+    clean_parts = []
+    for part in parts:
+        cleaned = re.sub(r'%[^%]+%', '', part)
+        cleaned = cleaned.strip()
+        if cleaned:
+            clean_parts.append(cleaned)
+    
+    print(f"\ncleaned ({len(clean_parts)}):")
+    for idx, part in enumerate(clean_parts, 1):
+        print(f"  {idx:2d}. {part}")
+    
+    Path('order.txt').write_text('\n'.join(clean_parts))
+    print(f"\nsaved to order.txt")