ktwr-

import binascii
import pefile
import ipaddress

from Crypto.Cipher import ARC4
from Crypto.Hash import SHA1

key = b'\\System32\\WindowsPowerShel1\\v1.0\\powershel1.exe'
#2fbafdc0451de65322a9aee65f28be319ad9574e

ktwr-

# Copyright (C) 2022 Kataware @ktwr-
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

ktwr-

import pefile

file ="filename"
pe = pefile.PE(file)
jack_entry = None

for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
	if str(entry.name) == "ASSEMBLY_LZMA":
		jack_entry = entry