from arc4 import ARC4
import pefile
import binascii
import json
import pprint as pp
 
secondstage = "d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6.bin"
 
try:
   pe
except NameError:
    pe = pefile.PE(secondstage)
 
key_len = 0x20
section_name = ".cfg"
 
# located in the .cfg section
for section in pe.sections:
    if bytes(section_name, 'utf-8') in section.Name:
        section_data = section.get_data()
 
key = section_data[:key_len]
crc = section_data[key_len:key_len+0x4]
config_len = int.from_bytes(section_data[key_len+0x4:key_len+0x8], "little")
print(hex(config_len))
data_3_hex = section_data[key_len+0x8:config_len+key_len+0x8]
 
print (len(data_3_hex))
 
cipher = ARC4(key)
dump = cipher.decrypt(data_3_hex)
 
# Store JSON to file
f = open("config_decoded.txt", "wb")
f.write(bytearray(dump))
f.close()
 
cfg = json.loads(dump[:-1])
pp.pprint(cfg)