royal trojan overlay decoder

import struct
import pefile
import sys

addv = 305419896
xorv = 0x55aa9966

def manip(val):
	return ((val + addv) ^ xorv) & 0xffffffff

def decoder_overlay(key,data):
	(a,b,c,d) = struct.unpack_from('<IIII', key)
	val1 = b ^ c
	val2 = (a ^ d) + manip(val1)
	for i in range(7):
		nextval = val1 + manip(val2)
		val1 = val2
		temp = val2 & 0xffffffff
		val2 = nextval
	val1 = temp
	val2 = nextval
	out = ""
	for j in range(len(data)):
		nextval = val1 + manip(val2)
		out += chr((nextval ^ val2 ^ ord(data[j]))&0xff)
		val1 = val2  & 0xffffffff
		val2 = nextval
	return out


if __name__ == "__main__":
	pe = pefile.PE(sys.argv[1])
	blob = pe.get_overlay()
	key = blob[:16]
	t = decoder_overlay(key,blob[16:])
	open(sys.argv[1]+'_decoded_overlay','wb').write(t)