1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
...

undefined * FUN_001012f5(uint param_1,char **param_2)
{

...

// This function checks the integrity of its own code, so the presence
// of the breakpoint could mess things up - we can use hardware 
// breakpoints, or step over this function altogether.
  local_3c = FUN_00101102((ulong)param_1); 
  
  FUN_00100d6a();
  FUN_00100dcb(&DAT_0030238c,0x100);
  
// Decode a message about executable being expired  
  FUN_00100ec2(&DAT_003024d6,0x3c); 

// Decode a constant timestamp
  FUN_00100ec2(&DAT_00302572,0xb);
  
// Verify that the current time is older than the timestamp - jump over this code
  if (DAT_00302572 != '\0') {
    lVar2 = atoll(&DAT_00302572);
    tVar3 = time((time_t *)0x0);
    if (lVar2 < tVar3) {
      return &DAT_003024d6;
    }
  }

// Decode text '/bin/bash'
  FUN_00100ec2(&DAT_0030252b,10);
  
// Decode text '-c'
  FUN_00100ec2(&DAT_003024ad,3);
  
// Decode 'exec' command  
  FUN_00100ec2(&DAT_00302518,0xf);
  
  FUN_00100ec2(&DAT_00302514,1);
  
  FUN_00100ec2(&DAT_0030253b,0x16);
  
// Decode a sanity check constant 
  FUN_00100dcb(&DAT_0030253b,0x16);
  FUN_00100ec2(&DAT_00302557,0x16);
  iVar1 = memcmp(&DAT_0030253b,&DAT_00302557,0x16);
  if (iVar1 == 0) {
  
// Decode another sanity check
    FUN_00100ec2(&DAT_003024b4,0x13);
    if (local_3c < 0) {
      puVar4 = &DAT_003024b4;
    }
    else {
	
// At this point program starts to build external command to execute
      __argv = (char **)calloc((long)(int)(param_1 + 10),8);

...

          FUN_00100ec2(&DAT_00302513,1);
		  
// Decode the in-memory script that will help produce the flag (see below)		  
          if ((DAT_00302513 == '\0') && (iVar1 = FUN_00100fb6(&DAT_0030252b), iVar1 != 0)) {
            return &DAT_0030252b;
          }
		  
// Decode remaining pieces of the command to execute - at this point
// we can simply extract the script we need from memory and execute it
          FUN_00100ec2(&DAT_0030257f,1);
          FUN_00100ec2(&DAT_003020c3,0x283);
          FUN_00100ec2(&DAT_00302581,0x13);
          FUN_00100dcb(&DAT_00302581,0x13);
          FUN_00100ec2(&DAT_00302022,0x13);
          iVar1 = memcmp(&DAT_00302581,&DAT_00302022,0x13);
          if (iVar1 != 0) {
            return &DAT_00302581;
          }
          local_30 = (char *)malloc(0x1283);
          if (local_30 == (char *)0x0) {
            return (undefined *)0;
          }
          memset(local_30,0x20,0x1000);
          memcpy(local_30 + 0x1000,&DAT_003020c3,0x283);
        }
...