from tests.pma_harness import IndicatorExpectations, PmaCase
from tests.pma_profiles import (
    profile_pma_0101_staged,
    profile_pma_0102,
    profile_pma_0104,
    profile_pma_0304_cc,
    profile_pma_0304_in,
    profile_pma_0304_probe,
    profile_pma_0304_re,
    profile_pma_1102_deep,
    profile_pma_1103_dll,
    profile_pma_1103_exe_missing_source,
    profile_pma_1201_deep,
    profile_pma_1202_deep,
    profile_pma_1203_deep,
    profile_pma_1204_deep,
    profile_pma_1402,
    profile_pma_1603,
    profile_pma_1702,
)

PMA_CASES: tuple[PmaCase, ...] = (
    PmaCase(
        name="pma-01-01-dll",
        sample="Practical Malware Analysis Lab 01-01.dll_",
        expected_apis=("KERNEL32.OpenMutexA", "WS2_32.WSAStartup"),
        allowed_entrypoint_errors=("max_api_count",),
    ),
    PmaCase(
        name="pma-01-01-exe",
        sample="Practical Malware Analysis Lab 01-01.exe_",
        expected_apis=("MSVCRT.__getmainargs", "MSVCRT.exit"),
    ),
    PmaCase(
        name="pma-01-01-exe-staged",
        sample="Practical Malware Analysis Lab 01-01.exe_",
        expected_apis=("KERNEL32.CreateFileMappingA", "KERNEL32.MapViewOfFile"),
        allowed_entrypoint_errors=("max_api_count", "invalid_read"),
        profile=profile_pma_0101_staged,
    ),
    PmaCase(
        name="pma-01-02-exe",
        sample="Practical Malware Analysis Lab 01-02.exe_",
        expected_apis=("KERNEL32.GetProcAddress", "WININET.InternetOpenUrlA"),
        indicators=IndicatorExpectations(
            domains=("www.malwareanalysisbook.com",),
            urls=("http://www.malwareanalysisbook.com",),
        ),
        allowed_entrypoint_errors=("max_api_count",),
        profile=profile_pma_0102,
    ),
    PmaCase(
        name="pma-01-04-exe",
        sample="Practical Malware Analysis Lab 01-04.exe_",
        expected_apis=("KERNEL32.LoadLibraryA", "KERNEL32.GetProcAddress"),
        profile=profile_pma_0104,
    ),
    PmaCase(
        name="pma-03-02-dll",
        sample="Practical Malware Analysis Lab 03-02.dll_",
        expected_apis=("ADVAPI32.OpenSCManagerA", "KERNEL32.GetModuleFileNameA"),
        indicators=IndicatorExpectations(
            registry_keys=("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost",),
            domains=("practicalmalwareanalysis.com",),
        ),
        allowed_entrypoint_errors=("max_api_count",),
    ),
    PmaCase(
        name="pma-03-03-exe",
        sample="Practical Malware Analysis Lab 03-03.exe_",
        expected_apis=("KERNEL32.HeapCreate", "KERNEL32.Sleep"),
    ),
    PmaCase(
        name="pma-03-04-exe",
        sample="Practical Malware Analysis Lab 03-04.exe_",
        expected_apis=("KERNEL32.GetVersionExA", "KERNEL32.SetHandleCount"),
    ),
    PmaCase(
        name="pma-03-04-probe",
        sample="Practical Malware Analysis Lab 03-04.exe_",
        expected_apis=("ADVAPI32.RegQueryValueExA", "KERNEL32.GetTimeZoneInformation"),
        profile=profile_pma_0304_probe,
    ),
    PmaCase(
        name="pma-03-04-in",
        sample="Practical Malware Analysis Lab 03-04.exe_",
        expected_apis=("ADVAPI32.ChangeServiceConfigA", "KERNEL32.CopyFileA", "ADVAPI32.RegSetValueExA"),
        profile=profile_pma_0304_in,
    ),
    PmaCase(
        name="pma-03-04-re",
        sample="Practical Malware Analysis Lab 03-04.exe_",
        expected_apis=("ADVAPI32.DeleteService", "KERNEL32.DeleteFileA", "ADVAPI32.RegDeleteValueA"),
        profile=profile_pma_0304_re,
    ),
    PmaCase(
        name="pma-03-04-cc",
        sample="Practical Malware Analysis Lab 03-04.exe_",
        expected_apis=("ADVAPI32.RegOpenKeyExA", "ADVAPI32.RegQueryValueExA", "KERNEL32.WriteFile"),
        profile=profile_pma_0304_cc,
    ),
    PmaCase(
        name="pma-05-01-dll",
        sample="Practical Malware Analysis Lab 05-01.dll_",
        expected_apis=("KERNEL32.CreateThread", "ADVAPI32.RegSetValueExA"),
        indicators=IndicatorExpectations(
            files=("C:\\Windows\\system32\\Practical Malware Analysis Lab 05-01.dll_",),
            registry_keys=("HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Irmon",),
        ),
        allowed_entrypoint_errors=("max_api_count", "invalid_read"),
    ),
    PmaCase(
        name="pma-06-03-exe",
        sample="Practical Malware Analysis Lab 06-03.exe_",
        expected_apis=(
            "WININET.InternetGetConnectedState",
            "WININET.InternetOpenUrlA",
            "KERNEL32.WriteFile",
            "KERNEL32.ExitProcess",
        ),
        indicators=IndicatorExpectations(
            domains=("www.practicalmalwareanalysis.com",),
            urls=("http://www.practicalmalwareanalysis.com/cc.htm",),
        ),
    ),
    PmaCase(
        name="pma-10-03-exe",
        sample="Practical Malware Analysis Lab 10-03.exe_",
        expected_apis=("ADVAPI32.CreateServiceA", "KERNEL32.DeviceIoControl", "ole32.CoCreateInstance"),
    ),
    PmaCase(
        name="pma-10-03-sys",
        sample="Practical Malware Analysis Lab 10-03.sys_",
        expected_apis=("ntoskrnl.IoCreateDevice", "ntoskrnl.IoDeleteDevice"),
    ),
    PmaCase(
        name="pma-11-01-exe",
        sample="Practical Malware Analysis Lab 11-01.exe_",
        expected_apis=("KERNEL32.FindResourceA", "ADVAPI32.RegSetValueExA"),
        indicators=IndicatorExpectations(
            files=("msgina32.dll",),
            registry_keys=("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",),
        ),
    ),
    PmaCase(
        name="pma-11-02-dll",
        sample="Practical Malware Analysis Lab 11-02.dll_",
        expected_apis=("KERNEL32.CreateToolhelp32Snapshot", "KERNEL32.VirtualProtect", "ADVAPI32.RegSetValueExA"),
        indicators=IndicatorExpectations(
            files=("C:\\Windows\\system32\\Lab11-02.ini",),
            registry_keys=("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows",),
        ),
        profile=profile_pma_1102_deep,
    ),
    PmaCase(
        name="pma-11-03-dll",
        sample="Practical Malware Analysis Lab 11-03.dll_",
        expected_apis=("KERNEL32.CreateThread", "USER32.GetAsyncKeyState", "KERNEL32.Sleep"),
        indicators=IndicatorExpectations(files=("C:\\WINDOWS\\System32\\kernel64x.dll",)),
        allowed_entrypoint_errors=("max_api_count",),
        profile=profile_pma_1103_dll,
    ),
    PmaCase(
        name="pma-11-03-exe",
        sample="Practical Malware Analysis Lab 11-03.exe_",
        expected_apis=("KERNEL32.CopyFileA", "KERNEL32.ExitProcess"),
        profile=profile_pma_1103_exe_missing_source,
    ),
    PmaCase(
        name="pma-12-01-dll",
        sample="Practical Malware Analysis Lab 12-01.dll_",
        expected_apis=("KERNEL32.TlsAlloc", "KERNEL32.InitializeCriticalSection"),
        allowed_entrypoint_errors=("max_api_count",),
    ),
    PmaCase(
        name="pma-12-01-exe",
        sample="Practical Malware Analysis Lab 12-01.exe_",
        expected_apis=("psapi.EnumProcesses", "KERNEL32.CreateRemoteThread", "kernel32.LoadLibraryA"),
        profile=profile_pma_1201_deep,
    ),
    PmaCase(
        name="pma-12-02-exe",
        sample="Practical Malware Analysis Lab 12-02.exe_",
        expected_apis=("KERNEL32.CreateProcessA", "KERNEL32.ResumeThread", "ntdll.NtUnmapViewOfSection"),
        allowed_entrypoint_errors=("invalid_fetch",),
        profile=profile_pma_1202_deep,
    ),
    PmaCase(
        name="pma-12-03-exe",
        sample="Practical Malware Analysis Lab 12-03.exe_",
        expected_apis=("USER32.SetWindowsHookExA", "USER32.CallNextHookEx", "USER32.UnhookWindowsHookEx"),
        indicators=IndicatorExpectations(files=("practicalmalwareanalysis.log",)),
        profile=profile_pma_1203_deep,
    ),
    PmaCase(
        name="pma-12-04-exe",
        sample="Practical Malware Analysis Lab 12-04.exe_",
        expected_apis=("KERNEL32.CreateRemoteThread", "KERNEL32.WinExec", "sfc_os.SfcTerminateWatcherThread"),
        profile=profile_pma_1204_deep,
    ),
    PmaCase(
        name="pma-14-01-exe",
        sample="Practical Malware Analysis Lab 14-01.exe_",
        expected_apis=("ADVAPI32.GetCurrentHwProfileA", "urlmon.URLDownloadToCacheFileA"),
        indicators=IndicatorExpectations(
            files=("C:\\Windows\\Temp\\a.png",),
            domains=("www.practicalmalwareanalysis.com",),
        ),
    ),
    PmaCase(
        name="pma-14-02-exe",
        sample="Practical Malware Analysis Lab 14-02.exe_",
        expected_apis=("KERNEL32.CreatePipe", "SHELL32.ShellExecuteExA", "SHELL32.SHChangeNotify"),
        allowed_entrypoint_errors=("max_api_count",),
        profile=profile_pma_1402,
    ),
    PmaCase(
        name="pma-16-01-exe",
        sample="Practical Malware Analysis Lab 16-01.exe_",
        expected_apis=("KERNEL32.GetVersionExA", "KERNEL32.GetCommandLineA"),
    ),
    PmaCase(
        name="pma-16-02-exe",
        sample="Practical Malware Analysis Lab 16-02.exe_",
        expected_apis=("USER32.FindWindowA", "KERNEL32.CreateThread"),
    ),
    PmaCase(
        name="pma-16-03-exe",
        sample="Practical Malware Analysis Lab 16-03.exe_",
        expected_apis=("KERNEL32.GetVersionExA", "KERNEL32.ExitProcess"),
        profile=profile_pma_1603,
    ),
    PmaCase(
        name="pma-17-02-dll",
        sample="Practical Malware Analysis Lab 17-02.dll_",
        expected_apis=("KERNEL32.CreateThread", "MSVCRT._strtime"),
        indicators=IndicatorExpectations(
            files=("C:\\Windows\\system32\\Practical Malware Analysis Lab 17-02.dll_",),
            registry_keys=("HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Irmon",),
        ),
        allowed_entrypoint_errors=("max_api_count", "invalid_read"),
        profile=profile_pma_1702,
    ),
    PmaCase(
        name="pma-17-03-exe",
        sample="Practical Malware Analysis Lab 17-03.exe_",
        expected_apis=("MSVCRT.__getmainargs", "KERNEL32.LoadLibraryA"),
        indicators=IndicatorExpectations(
            registry_keys=("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceClasses",),
        ),
    ),
    PmaCase(
        name="pma-18-01-exe",
        sample="Practical Malware Analysis Lab 18-01.exe_",
        expected_apis=("KERNEL32.LoadLibraryA", "KERNEL32.GetProcAddress"),
    ),
    PmaCase(
        name="pma-18-03-exe",
        sample="Practical Malware Analysis Lab 18-03.exe_",
        expected_apis=("KERNEL32.VirtualAlloc", "KERNEL32.GetProcAddress"),
    ),
    PmaCase(
        name="pma-19-02-exe",
        sample="Practical Malware Analysis Lab 19-02.exe_",
        expected_apis=("KERNEL32.GetVersionExA", "KERNEL32.GetStartupInfoA"),
        indicators=IndicatorExpectations(
            registry_keys=("HKEY_CLASSES_ROOT\\http\\shell\\open\\command",),
        ),
    ),
    PmaCase(
        name="pma-20-02-exe",
        sample="Practical Malware Analysis Lab 20-02.exe_",
        expected_apis=("KERNEL32.VirtualAlloc", "KERNEL32.GetStartupInfoA"),
    ),
    PmaCase(
        name="pma-21-01-exe",
        sample="Practical Malware Analysis Lab 21-01.exe_",
        expected_apis=("KERNEL32.GetTickCount", "KERNEL32.EncodePointer"),
    ),
)
