/*
Posted to Reddit by JasonMaloney101.
jason[at]masterjason[dot]com

Below is the response to the password puzzle.
------------------------------------

in general, nextplease forces dynamic debugging.  The win32 api call to CryptGenRandom() and subsequent calls are designed to fail.  When they fail, the value of GetLastError() is predictable and used to modify value of the locally allocated DWORD.  When the math happens after the api calls, it appears it's used to step into the array of b64'd data blobs.  In reality, x is now zero.  The divide operation throws an exception and -- in the exception handler -- all the real work occurs.

If you found the answer with static analysis, you're the man.  But you worked
too hard.  Stepping through with a live debugger will be confusing without
symbols or an understanding of exception handlers, but if you're paying
attention the comparision of the input string to 'a' should be obvious.

Of course, you could just change the je at 0x00401279 to a jmp and
ignore everything else.

here's the relevant source:
*/
 __try
   {
       if( GetCurrentThreadId() > 0 )
       {
           DWORD    x = -88;

           if( !CryptGenRandom( NULL, sizeof dwIndex, (PBYTE)&dwIndex )) {
               x += GetLastError();
           }
           else {
               srand( rand() % GetTickCount() + (DWORD)time( (time_t)NULL ));
               x = rand() + GetCurrentThreadId() % 8;
           }

           DWORD y = dwIndex++ + x;

           if( y < 0 ) {
               dwIndex += rand() % 3;
           }

           DWORD z = GetTickCount();
           if( GetTickCount() >= z ) {
               z -= 10;
           }
           DWORD xxx = (DWORD)CreateFileA( "%windir%\\system32\\kernel32.dll.pdb.dbg", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL );
           x -= xxx;

           // the whole point of the above nonsense is to get x to be zero without making it deadly obvious
           // requires a bit of understanding of some basic win32 apis

           // now, attempt to divide by 0.  the idea is that the code doesn't flow (in IDA) from here to the
           // exception handler, where all the real work happens

           z += y / x;

           z = z % 10;

           dwIndex = z;

           // static reversing (from a simplistic pov) will look as though this is the magic password
           decode_base64( (PBYTE)pszDecryptedPassword, rgPasswords[dwIndex] );
           return;
       }
       else
       {
           DWORD x = GetCurrentProcessId();
           x <<= 2;
           x += GetCurrentProcessId();
           DWORD y = (DWORD)GetConsoleWindow();
           DWORD z = y + x / 2 + (DWORD)CryptGenRandom;
           dwIndex = z % 11;
       }
   }
   __except( EXCEPTION_EXECUTE_HANDLER )
   {
       pszDecryptedPassword[0] = 'a';
   }