PhaseDump Python tool for decrypting W32/Phase modules, first 16-bytes is the MD5 hash of decrypted code, rest is PE file RC4 encrypted with "Phase" as the key.