Detection of rich header offset should also check for valid Rich magic

[metthal]

Right now, valid rich magic Rich is not checked for when detecting rich header offset. In samples like 646679c8decab9e85874c306560e75df410013bf9de2aed17a3e92aedc7c6dad it causes issues because it detects rich header on lower offset than it really is. The real offset of rich header should be 0x90 but we detect it as 0x88.

[HoundThe]

I think this issue is also fixed by fixing the Rich header analysis algorithm, which also sets the offset to the actual start of the Rich header (The decoded sequence "DanS") #973