Thread by @kienbigmummy

Diving into the #Lazarus sample that mentioned in nice blog tinyurl.com/mdyxr8m3. I recognized it uses 2 custom algorithms for decoding strings.
- 1st is modified RC4 to decrypt API functions name.
- 2nd is custom algo to decrypt C2 urls and user agent strings (1/4)

For decrypting API functions name, it decode base64 string and call modified rc4 algo to decrypt the decoded base64 string (2/4).

For decrypting C2 urls and user agent strings, it also decode base64 string and call the custom algo to decrypt the encoded base64 string (3/4).

I have tried to re-implement these algos, and with the help of idapython, fortunately my confusing code was successful 😂. (4/4).