;This is the disassembled Nico program at the heart of 0x90.exe
;It is shown here in its fully decoded state.  Note that in its
;original for, everything from Program-End is encoded, and
;WelcomeMessage is doubly encoded.  Program-End is initially
;decoded by the loop at ProgramDecode and WelcomeMessage is
;finally decoded by the loop at MessageDecode

Start:
      load   R3,0x20E
      apush  Program
      pop    R0
      load   R2,0x53
ProgramDecode:
      xor.b  [R0],R2
      inc    R0
      dec    R3
      jnz    ProgramDecode
Program:
      load   R1,0x5CC80E31
      syscall GetCommandLineA
      scanb  0x20,0x255
      jz     FailedAuth
      load.d R2,[R0]
      add    R2,0x1D9BDC45
      add    R1,0x74519745
      sub    R2,0xAD45DFE2
      add    R1,0xDEADBEEF
      add    R2,0x68656C6C   ; "hell"
      sub    R1,0x17854165
      sub    R2,0x41776169   ; "Awai"
      add    R1,0x73686F77   ; "show"
      add    R2,0x69747320   ; "its "
      sub    R1,0x206E6F20   ; " no "
      add    R2,0x64726976   ; "driv"
      add    R1,0x6D657263   ; "merc"
      sub    R2,0x6E757473   ; "nuts"
      sub    R1,0x79212121   ; "y!!!" end of "show no mercy!!!"
      sub    R2,0x65683F21   ; "eh?!"
      test   R2,0xDFFFFFFF
      rpush  R2
      rpush  R1
      jmpeq  Success
      clear  R3
      jz     FailedAuth
Success:
      inc    R0
      add    R0,0x2
      inc    R0
      load.w R1,[R0]
      rpush  R1
      pop    R2
      rpush  R0
      apush  0xD8360D
      pop    R0
      add    R0,0x98548
      dec    R0
      xor.w  [R0],R2
      pop    R0
      load.b R2,[R0]
      add    R0,0x2
      load.b R1,[R0]
      add    R2,R1
      call   DoStage2
      nop    R3
      rpush  R3
      apush  WelcomeMessage
      syscall printf
      add_sp 0x8
      jmp    ExitProgram
FailedAuth:
      cpush  0x0
      apush  PleaseAuthenticate
      syscall printf
      add_sp 0x8
ExitProgram:
      halt
DoStage2:
      load   R1,0x4C
      inc    R1
      inc    R1
      add    R1,0x5
      dec    R1
      sub    R1,0x4
      sub    R2,0x5A
      cmp    R1,R2
      jnz    FailedAuth
      dec    R0
      load.b R2,[R0]
      add    R0,0x2
      load.b R1,[R0]
      add    R2,R1
      inc    R2
      sub    R2,0x4E
      apush  0xE0DD64
      pop    R0
      add    R0,0xDEAC
      inc    R0
      xor.b  [R0],R2
      load   R3,0x49
      apush  WelcomeMessage
      pop    R0
      inc    R2
MessageDecode:
      xor.b  [R0],R2
      inc    R0
      dec    R3
      jnz    MessageDecode
      ret
PleaseAuthenticate db "Please Authenticate!\r\n", 0
WelcomeMessage db "Welcome...\r\nExploit for it doesn't matter 1.x Courtesy of Nicolas Brulez", 0
End: