RunPE Embedded Executable Extractor

# Script used to extract embedded executable inside a RunPE executable.
# Blog Post: http://middleeastmalware.blogspot.com/2015/04/cyber-attack-7.html
import sys,os,time

def IsNonHexChar(CharX):
    if CharX != "0" and CharX != "1" and CharX != "2" and CharX != "3" and CharX != "4" and CharX != "5" and CharX != "6" and CharX != "7" and CharX != "8" and CharX != "9" and CharX != "A" and CharX != "a" and CharX != "B" and CharX != "b" and CharX != "C" and CharX != "c" and CharX != "D" and CharX != "d" and CharX != "E" and CharX != "e" and CharX != "F" and CharX != "f":
        return True
    return False


def Hexify(StuffX):
    if len(StuffX)==0:
        print "File is empty\r\n"
        return
    else:
        Second = False
        SkipNext = False
        FinalStr = ""
        NewStr = ""
        for X in StuffX:
            if SkipNext == True:
                SkipNext = False
                continue
            if IsNonHexChar(X)==True:
                SkipNext = True
                continue
            if Second == False:
                NewStr+=X
                Second = True
            else:
                NewStr+=X
                FinalStr += "\\x"
                FinalStr += NewStr
                NewStr = ""
                Second = False

        XXX = "\"" + FinalStr + "\""
        outputX =  eval(XXX)
        return outputX

def RevvAndThenHexify(InputFileX):
    if os.path.exists(InputFileX)==False:
        print "File does not exist\r\n"
        return
    fIn = open(InputFileX,"r")
    contentX = fIn.read()
    fIn.close()
    if len(contentX)==0:
        print "File is empty\r\n"
        return
    else:
        print "Processing input of length " + str(len(contentX))

    fOut = open("result.txt","wb")
    fIn_ = open(InputFileX,"r")
    for LinX in fIn_:
        PureStringX = LinX.rstrip("\r\n")
        PureStringX = PureStringX.rstrip("\r")
        PureStringX = PureStringX.rstrip("\n")
        print len(''.join(reversed(PureStringX)))
        Hexified = Hexify(''.join(reversed(PureStringX)))
        print "Line of Length: " + str(len(Hexified))
        fOut.write(Hexified)
    fIn_.close()
    fOut.close()
    return

def main():
    if len(sys.argv)!=2:
        print "Usage: Hexify.py input.txt\r\n"
        sys.exit(-1)
    else:
        RevvAndThenHexify(sys.argv[1])
        sys.exit(0)



if __name__ == "__main__":
    main()