As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag.

I used GHIDRA to decompile the binary.

The encryption function seems pretty basic, it is just the following line inside a while loop repeated until all bytes of the file have been xored : `local_111c[local_1120] = local_111c[local_1120] ^ *(byte *)(param_2 + local_1120 % 0x20);`

Where `local_1120` is the loop counter, `local_111c` is a buffer where the file to encrypt is read into, and `param_2` is an integer that seems to be always 0, the function is called like the following `FUN_00401000((LPCSTR)0x0,0)`, with both parameters set to 0;

What does `*(byte *)(param_2 + local_1120 % 0x20` refer to? As far as I understand it, it would be the value at the address pointed to by an integer cast to a byte pointer, but the modulo makes it so the adress can't be above 32?

I need to understand what could the value pointed to could have been in order to xor back the file to its original state.