Flare-On 2014 Chellage 3

This challenge is about analyzing a binary file. Using IDA. we see here a sort of “obfuscation” where the actual code (payload) is moved into the stack by the loader and executed from there:

img

The payload is actually a multi-stage xor based, self decrypting code which in our case has various funny sentences revealed in every decrypted part:

Stage Result
img img
img img

I hope, you’ve got the idea here. I’ll omit several stages and come straight to the last meaningful stage where the email we’ve been looking for is revealed: