def parse_rokrat_lnk_file(lnk_path, out_path):    # 尝试解析 LNK 文件，获取 lnk_command    try:        with open(lnk_path, 'rb') as lnk_file_handle:            lnk = LnkParse3.lnk_file(lnk_file_handle)            lnk_command = lnk.lnk_command    except Exception as e:        print(f"无法读取 LNK 文件：{e}")        return    # 匹配特定的命令模式    pattern = re.compile(        r'$lnkFile.Seek((0x[0-9A-F]+),s*[System.IO.SeekOrigin]::Begin);'        r'.*?New-Object byte[] (0x[0-9A-F]+);'        r'.*?$(w+)Path',        re.DOTALL | re.IGNORECASE    )    matches = pattern.findall(lnk_command)    # 读取 LNK 文件内容    try:        with open(lnk_path, 'rb') as lnk_handle:            lnk_content = bytearray(lnk_handle.read())    except Exception as e:        print(f"无法读取 LNK 文件内容：{e}")        return    exe_content = None    key_match = []    # 处理匹配结果，提取文件内容    for match in matches:        seek = int(match[0], 16)        length = int(match[1], 16)        filename = match[2]        file_content = lnk_content[seek:seek + length]        # 判断是否为可执行文件内容        if len(str(len(file_content))) == 6:            exe_content = file_content        # 检查文件内容中是否包含 "bxor"        if b"bxor" in file_content:            try:                key_pattern = re.compile(                    r"$w+s*=s*['"]([^'"]+)['"];s*fors*([^)]*)s*{[^=]+=[^-]+-bxor",                    re.DOTALL | re.IGNORECASE                )                decoded_content = file_content.decode('utf-8', errors='ignore')                key_match = key_pattern.findall(decoded_content)            except Exception as e:                print(f"处理文件内容时发生错误：{e}")        # 保存提取的文件        try:            os.makedirs(out_path, exist_ok=True)            with open(os.path.join(out_path, filename), 'wb') as f:                f.write(file_content)            print(f"已提取文件：{filename}")        except Exception as e:            print(f"写入文件时发生错误：{e}")    # 如果找到可执行内容和密钥，则进行解密    if exe_content and key_match:        decrypted_data = bytearray()        key_char = key_match[0]        try:            for byte in exe_content:                decrypted_data.append(byte ^ ord(key_char))            with open(os.path.join(out_path, "rokrat_shellcode"), 'wb') as f:                f.write(decrypted_data)            print("已解密并保存 RokRat Shellcode")            try:                offset = 0x58b                if len(decrypted_data) >= offset + 5:  # 确保有足够的数据                    # 提取 XOR 密钥                    xor_key = decrypted_data[offset]                    # 提取加密数据的长度（4 个字节，假设为小端序）                    encrypted_length_bytes = decrypted_data[offset + 1:offset + 5]                    encrypted_length = int.from_bytes(encrypted_length_bytes, byteorder='little')                    # 提取加密数据                    encrypted_data = decrypted_data[offset + 5:offset + 5 + encrypted_length]                    if len(encrypted_data) == encrypted_length:                        # 使用提取的 XOR 密钥解密数据                        final_decrypted_data = bytearray()                        for byte in encrypted_data:                            final_decrypted_data.append(byte ^ xor_key)                        # 将解密后的数据写入指定文件                        with open(os.path.join(out_path, "rokrat"), 'wb') as f:                            f.write(final_decrypted_data)                        print("已解密并保存 RokRat")                    else:                        print("加密数据的实际长度与提取的长度不匹配。")                else:                    print("解密数据长度不足，无法提取密钥和长度信息。")            except Exception as e:                print(f"在偏移 0x58b 处解密数据时发生错误：{e}")        except Exception as e:            print(f"解密数据时发生错误：{e}")else:  print("未找到可执行内容或密钥，解密步骤被跳过。")