[Kerlingen]

Yes, that's the normal way to go. Unless something really strange is going on, this executable will contain the decryption algorithm and (depending on what the encrypted data is used for) might also contain the key or something equivalent.