I have already used memory dumps and runtime hooks, injecting a trace script directly into the start-up routing of the malware payload but that only captures the components that I am looking out for. Suggestions to get the entire thing decrypted back to .pyc. i can take it from there. submitted by /u/fonzhy121 [link] [comments]