Nullcon HackIM 2014 :: Reverse 1

For this particular challenge, we were given a file (which i've re-uploaded here) and the following clues.
"Find the flag hidden not so deep inside."

After opening up the .zip file, there is an easy.exe file within.
My initials gut feel is to simply step-debug this .exe file but realise that it's not doing anything interesting so i loaded it up into IDA Pro and found this interesting function that is never being called.

Let's extract out this function and form it back to C code like this here.

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

int main(int argc, char* argv[]){

  int v0 = strlen(")T(+,*'))$&T(Y)*#(+&#+)$%'T+&#(T");

  int v3 = v0 + 32;

  char *result = (char *)malloc(v0 + 32);

  char wtf[] = {")T(+,*'))$&T(Y)*#(+&#+)$%'T+&#(T"};

  int i;

  if ( result ){

 int v2 = 0;

 memset(result, 0, v3);

 

 for ( i = 0; i<strlen(")T(+,*'))$&T(Y)*#(+&#+)$%'T+&#(T"); ++i )

 *(result + i) = wtf[i] + 13;

 *(result + i) = 95;

 v2 = i + 1;

 *(result + v2++) = 65;

 *(result + v2++) = 78;

 *(result + v2++) = 68;

 *(result + v2++) = 95;

 *(result + v2++) = 77;

 *(result + v2++) = 79;

 *(result + v2++) = 79;

 *(result + v2) = 79;

 *(result + v2 + 1) = 79;

  }

  printf("%s", result);

  return 0;

}

We should have something like the file that i've attached here.

If you compile and run the program, you will get the key.
6a589746613a5f670583086124a8305a_AND_MOOOO


Have Phun
0x4a61636f62