The original Rich Signature write-up:
  http://www.ntcore.com/files/richsign.htm
searches 400 bytes for the "Rich" string.  The pefile module
searches 128 bytes for the string.  I have found that 128 is
sometimes not enough, and 400 feels rather large, so I have
choosen a round (hex) value in between.

I also take a lesson from the original write-up and search for
NULL values, but added a search for the PE header as well.

Note that because we rely on pefile module for the Rich Header
Values, that array will be incomplete, and thus differ from that
used for hash calculation, until pefile itself is fixed.

The latest version of pefile provides easy access to the
deobfuscated rich header by accessing the 'clear_data' key
of the parsed rich header.