Add BabyShark cowboy malware decode snippet

[wesinator]

https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/

this is a cleaned up version of the code in the report appendix.

It would be great if you could provide cleaned, usable versions in future reports.