in nightMARE/src/nightmare/malware/remcos/configuration.py [0:0]
def read_encrypted_configuration(path: pathlib.Path) -> bytes | None:
"""
Read the encrypted configuration from the given file path.
:param path: The path to the configuration file.
:return: The encrypted configuration as bytes, or None if the file cannot be parsed or the configuration is not found.
"""
if not (pe := lief.parse(path)):
return None
for first_level_child in pe.resources.childs:
if first_level_child.id != 10:
continue
for second_level_child in first_level_child.childs:
if second_level_child.name == "SETTINGS":
return bytes(second_level_child.childs[0].content)