in dridex/loader/dridex_loader.py [0:0]
def get_rc4_rva(self, p: ProcessMemory, rc4_decode: int) -> int | None:
zb = p.uint8v(rc4_decode + 8, True)
if zb:
return p.uint32v(rc4_decode + 5)
return p.uint32v(rc4_decode + 3)