[Reverse] Hitcon 2018 - EOP

Reverse exceptions, hitcon2018, ida, reverse Comments

EOP

EOP.

eop-811afa1b9fb0c0719a75afd316ea2c57
Author: david942j
29 Teams solved.

Quite challenging reverse engineering, well at least it was for me, the binary wasn’t very hard to understand perhaps it had some strange exceptions “mechanics” which were being to used to jump to other parts of the code in a sequence order.

Using IDA for this challenge was crucial for me at first I was just trying to use radare2 and gdb but I got quickly overwhelmed by the code, both static and dynamic analysis were made with IDA, IDA is good because you can easily navigate through control flow graphs while debugging and it’s very easy to change the views, one thing that really helped me was to create a view to keep track of some global variables that were being used for encryption in this challenge.

You must be asking how I debugged an elf while using IDA on Windows, this can be done via remote debugging (the elf runs on an external linux machine) which is supported by IDA if you want to know how to do this.

This binary is using multiple exceptions to manage the control flow of the program identifying this isn’t very hard after some trial and error I easily found where the exceptions were being thrown I just setted up alot of breakpoints while observing some global variables changes. The real deal in this challenge was to deal with the extensive encryption function I ended up very tired until I figured out the function.
The ida pseudo c code converter wasn’t working at all so I needed to read pure assembly which isn’t a big problem for me but it definitively takes more time to read, luckily after fully understanding the encrypting function writing the code to reverse it was very easy.

Identifying the size of the flag and extract

By opening the main function in IDA we can quickly see how much the size is the flag:

Scrolling down a little bit we can quickly find where the binary is checking if the flag we inserted had the correct size, The encrypted flag is already stored in a global var, we can extract it using ida, you can do this by double clicking on the offset and then edit -> export data (or shift + e while selecting it ) and you can select it to export to c like I did, you then can just adapt to other languages if you are using a different language like me (in my case python).

Some Globals already showing up in the main function graph:

Exporting it:

Keep in mind that I renamed some functions and vars in ida so it might be a little different from yours (if you
want to check my idb ask it on the comments and I’ll upload it), Still looking at the main function, we can notice after the cmp [rbp+var_1C], 0x2f, the first 16 bytes of the string are extracted to two global variables flaginput and flaginput2 (renamed by me in IDA):

As you notice from the image above after the split it’s going to call Alloc_throw_catch (renamed) this is where all the exception magic is going to happen:

Keep in mind that begin_catch actually updates the value on the heap before we jump in CALL RAX so I assumed that begin does something besides limiting the limits of the catch. Putting a break on CALL RAX is smart because this is going to be executed multiple times and it’s from here we are going to jump into the encryption functions.

Encryption Functions

After jumping from CALL RAX we are going to jump into 1st encrytion function, the encryption process is separated in a lot of function, but they are very similar to each other some times they are even equal, the process is resumed in the box bellow:

1
2
3
4
5
6
7
8
9
10
11
XorInputFlag
|
ReverveXoredString 
|
Repeat 8 times
ShrAddXor -> AddAddXor -> Ror -> Rol -> AddAddXor(Slighty different from the 1st AddAddXor)
End Repeat
|
Xor
|
ExchangeByteOrders

XorInputFlag

It simply xors the first 8 bytes (inputflag) with key which is stored in a global variable (does the same for the next 8 too “inputflag2”), for the first 16 bytes (Round 1) the key is zero and when you xor something with a zero it does absolutely nothing the value remains the same. The xor key is zero because the globals are set to zero, for the next rounds they are going to filled.

On the image bellow I created a view (Views -> Open subviews -> Disassembly) so I can track all of this Globals so I know when they are going to be modified (helped me alot for debugging the entire process).

This function aplies to both inputflag and inputflag2.

ReverveXoredString

Receives a string of 8 bytes ()

This function reverses the 1st 4 bytes of the string (returned from XorInputFlag) and then uses xor with a key stored in a global which IDA names it off_5604E325B150 (the last numbers should differ because PIE is enabled), once again you can export it to later use it for reversing, this variable is a huge table with multiple values and is constantly used by the binary. The process is repeated again for the last 4 bytes but with a different offset from the xor key table.

if you are confused with all the shift lefts in assembly don’t be the shifts are only used to change the order of the bytes of the input for example:

1
2
3
4
5
String -> 'AA'
String in hex -> 0x4141
Shift left on 'AA' -> 0x414100
and now a simple OR operation can be used to insert a character in the beginning of the string:
0x414100 | 0x45 =  0x414145 -> 'EAA'

The first 4 bytes of string returned from XorInputFlag:

The last 4 bytes of string returned XorInputFlag:

Resuming it the the result of the first bytes are saved on dword_560CC63C71C0 and the last ones are saved on dword_560CC63C71C4.

ShrAddXor -> AddAddXor -> Ror -> Rol -> AddAddXor(Slighty diferent from the 1st AddAddXor)

This process is going to be repeated 8 times! And they only difference on each interaction is the offsets to the xor key table is increases 0x10.

ShrAddXor

This function does a bunch of operations to calculate the index of 4 xor keys from the global array, it then applies 3 sequential xors as explained bellow, the result is saved in a new variable dword_560CC63C71D0 .

The Function Applied to the first 4 bytes (Value coming from dword_5604E325B1C0)

The function applied to the last 4 bytes are coming from the global dword_5604E325B1C4 and is going to be stored on dword_560CC63C71D4 the is the same but the order of the bytes extracted are different in this case the is
4th byte, 1st byte, 2nd byte, 3rd byte and the final result is in a new variable dword_560CC63C71D4 .

The Function applied to the last 4 bytes (Value coming from dword_5604E325B1C4)

AddAddXor

This one is really simple but they differ from interaction to interaction regarding to the offsets, and as I said above the process is going to be repeated 8 times and the offset increases 0x10 on each operation as explained in the image bellow for the first 4 bytes:

Ror

This one is even simpler i just uses ror operation:

the 4 bytes are extracted from dword_5604E325B1C0 and then saved to dword_5604E325B1C0 again.

Rol

This one is simple too it just uses rol operation:

the 4 bytes are extracted from dword_5604E325B1C4 and then saved to dword_5604E325B1C4 again.

AddAddXor

Almost the same as the previous AddAddXor but this one has this tricky operation lea edx, [rax + rax] which is equivalent to:

1
edx = (rax + rax) & 0xffffffff

The mask (0xffffffff) must be applied because edx is a 32 bit register, this is a little thing you need to keep in mind while writing the reverse script. The index offset to each iteration will also change here (increasing 0x10 as I mention before). The results of this function are saved in dword_560CC63C71C4

The examples given above are related to the second chunk of 8 bytes.
Now for the 1st chunk of 8 bytes will run this same functions with only some differences in the offsets and the values will be saved in different globals dword_560CC63C71C8, dword_560CC63C71CC, dword_560CC63C71D8 and dword_560CC63C71DC.

Xor & ExchangeByteOrders

Xor just xors the bytes by a key coming from the xor offset table the offsets are always the same (0x10,0x14,0x18,0x1c) for the 3 rounds after the xors and the result is stored in a new global dword_560CC63C71B0, ExchangeByteOrders will once again exchange bytes do some summations and the result is stored in a new global dword_560CC63C71B8. Bellow is the code equivalent to the assembly that comes after, since I’m running out of time I’ll post the python code now and then later I’ll post the assembly.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# Xor
dword_560CC63C71C8 = dword_560CC63C71C8 ^ access_offstream(off_560CC63C7150, 0x10)
dword_560CC63C71CC = dword_560CC63C71CC ^ access_offstream(off_560CC63C7150, 0x14)
dword_560CC63C71C0 = dword_560CC63C71C0 ^ access_offstream(off_560CC63C7150, 0x18)
dword_560CC63C71C4 = dword_560CC63C71C4 ^ access_offstream(off_560CC63C7150, 0x1c)
dword_560CC63C71B0 = []

# ExchangeByteOrders
for dword in [dword_560CC63C71C8, dword_560CC63C71CC]:
  dword_560CC63C71B0 = [dword & 0xff] +dword_560CC63C71B0
  eax = dword >> 8
  dword_560CC63C71B0 = [eax & 0xff] +dword_560CC63C71B0
  eax = dword >> 0x10
  dword_560CC63C71B0 = [eax & 0xff] +dword_560CC63C71B0
  eax = dword >> 0x18
  dword_560CC63C71B0 = [eax & 0xff] +dword_560CC63C71B0

dword_560CC63C71B8 = []
for dword in [dword_560CC63C71C0, dword_560CC63C71C4]:
  dword_560CC63C71B8 = [dword & 0xff] +dword_560CC63C71B8
  eax = dword >> 8
  dword_560CC63C71B8 = [eax & 0xff] +dword_560CC63C71B8
  eax = dword >> 0x10
  dword_560CC63C71B8 = [eax & 0xff] +dword_560CC63C71B8
  eax = dword >> 0x18
  dword_560CC63C71B8 = [eax & 0xff] +dword_560CC63C71B8

Joining dword_560CC63C71B0 and dword_560CC63C71B8

In the end of every encryption we end up returning to the main function and the globals dword_560CC63C71B0 and dword_560CC63C71B8 are stored next to each other in the memory which will be used to compare to the other encrypted flag. This is just for the first chunk of 16 bytes this, there is more 2 rounds to do for the rest of the characters but luckily they just repeat the same before the only thing that changes is on the first encryption function which now since the globals no longer are 0 the XorInputFlag function will make the difference.

Joinining dword_560CC63C71B0 and dword_560CC63C71B8 into memory ill be the start of encrypted string we inserted

Writing the reverse script

Write the reverse string is like writing the script from the bottom of the page to the top, it’s like rewinding a VHS tape back to the beginning of the movie, in our case we want to convert the encrypted flag value to the original flag.

I wrote my script in python

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
from struct import *

max_bits = 32

off_560CC63C7150 = [0x6E, 0x4D, 0x1A, 0xC0, 0x36, 0x66, 0xCB, 0xA4, 0xA1, 0x5B, 0x0F, 0x5B, 0x26, 0x69, 0x26, 0x2B, 0x8F, 0xCB, 0x75, 0xEF, 0x2A, 0x22, 0x37, 0xA0, 0x9A, 0x61, 0x69, 0xBA, 0x32, 0x89, 0x79, 0x60, 0x59, 0xA8, 0x6E, 0x02, 0x93, 0x58, 0x31, 0xF1, 0xA6, 0x33, 0x59, 0x8B, 0x67, 0xAC, 0x2B, 0xE7, 0x04, 0x89, 0xCC, 0x1A, 0xEF, 0xD1, 0x48, 0x2E, 0xAB, 0xD5, 0x21, 0x3F, 0x1F, 0x5A, 0x33, 0x69, 0xF0, 0x68, 0x83, 0xBE, 0xC3, 0x84, 0xF7, 0xF1, 0x90, 0x49, 0x20, 0x18, 0x68, 0xA1, 0xCE, 0x18, 0x57, 0x91, 0x96, 0x33, 0x47, 0xF1, 0xEB, 0x21, 0x72, 0xF8, 0x7A, 0xFA, 0x6C, 0xBE, 0xE6, 0xAB, 0x7E, 0x61, 0x4E, 0x51, 0xC2, 0x3F, 0x77, 0xEC, 0x6A, 0xC3, 0x18, 0xC6, 0xA4, 0xF7, 0xCE, 0xF9, 0x01, 0xB3, 0xDC, 0x75, 0x7A, 0x8C, 0xE1, 0xAE, 0x69, 0x26, 0xF2, 0x24, 0x5F, 0x35, 0xDB, 0x9A, 0x23, 0xE1, 0x4E, 0x77, 0xA0, 0x34, 0xF4, 0xC8, 0xEF, 0x97, 0x7E, 0xF4, 0xF7, 0x7D, 0x79, 0x43, 0x45, 0x6A, 0xE4, 0xF6, 0xD5, 0x80, 0xB7, 0x05, 0x40, 0xBF, 0xE1, 0xE3, 0x32, 0x75, 0xDD, 0x54, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0xE7, 0x56, 0x56, 0x17, 0xFC, 0x43, 0x43, 0x71, 0x37, 0xBB, 0xBB, 0x85, 0xFE, 0x08, 0x08, 0xD3, 0x09, 0xD4, 0xD4, 0xFB, 0x2B, 0xE2, 0xE2, 0x1E, 0xAD, 0xA2, 0xA2, 0xB2, 0x2A, 0x73, 0x73, 0xF4, 0xC9, 0xB3, 0xB3, 0x3C, 0x33, 0x2D, 0x2D, 0xD0, 0xE4, 0x8C, 0x8C, 0x02, 0xB6, 0xB7, 0xB7, 0x59, 0x15, 0x8D, 0x8D, 0x8D, 0xF4, 0x06, 0x06, 0x5D, 0x10, 0x8A, 0x8A, 0x75, 0x32, 0xBC, 0xBC, 0xCB, 0x17, 0xC6, 0xC6, 0xC7, 0x18, 0xCF, 0xCF, 0x3E, 0x85, 0x9A, 0x9A, 0x9B, 0x53, 0xAA, 0xAA, 0x1F, 0xF6, 0x4D, 0x4D, 0x7E, 0xD5, 0xEA, 0xEA, 0x60, 0x78, 0x48, 0x48, 0x80, 0xA0, 0xE0, 0xE0, 0xCE, 0x49, 0x2E, 0x2E, 0x24, 0x2D, 0x3F, 0x3F, 0xB4, 0x99, 0xC3, 0xC3, 0x95, 0xEA, 0x14, 0x14, 0x94, 0xB1, 0xFB, 0xFB, 0x3F, 0xDE, 0x75, 0x75, 0x1D, 0x40, 0xFA, 0xFA, 0x05, 0x5E, 0xE8, 0xE8, 0x4E, 0xE9, 0xCE, 0xCE, 0x47, 0xB8, 0x2F, 0x2F, 0x4F, 0xB2, 0x21, 0x21, 0x07, 0xE8, 0x5F, 0x5F, 0xB6, 0x2F, 0x74, 0x74, 0x39, 0x6D, 0xC5, 0xC5, 0x2D, 0x7C, 0xDE, 0xDE, 0x1B, 0xF3, 0x4A, 0x4A, 0x8C, 0xAF, 0xE9, 0xE9, 0x79, 0x3D, 0xB5, 0xB5, 0x44, 0x55, 0x77, 0x77, 0x8F, 0x42, 0xB1, 0xB1, 0x04, 0x05, 0x07, 0x07, 0x9F, 0x56, 0xAD, 0xAD, 0x86, 0x13, 0x50, 0x50, 0x9A, 0x08, 0x45, 0x45, 0x98, 0xBE, 0xF2, 0xF2, 0xBC, 0x93, 0xCD, 0xCD, 0x54, 0x41, 0x6B, 0x6B, 0xC3, 0x1D, 0xC8, 0xC8, 0x4D, 0x04, 0x96, 0x96, 0xAE, 0x31, 0x66, 0x66, 0x83, 0x4D, 0xB8, 0xB8, 0x91, 0xEF, 0x13, 0x13, 0x3D, 0x68, 0xC2, 0xC2, 0xBB, 0x7B, 0x92, 0x92, 0xCA, 0x4C, 0x29, 0x29, 0xE4, 0xDD, 0xAF, 0xAF, 0x0E, 0xB9, 0xBE, 0xBE, 0xA9, 0xD9, 0x39, 0x39, 0xD2, 0x52, 0x3B, 0x3B, 0xB9, 0xCD, 0x25, 0x25, 0xE3, 0x35, 0xF0, 0xF0, 0x64, 0x7D, 0x4F, 0x4F, 0x38, 0x36, 0x2A, 0x2A, 0x19, 0x45, 0xFD, 0xFD, 0x3A, 0x80, 0x9D, 0x9D, 0xAC, 0x87, 0xD1, 0xD1, 0xD7, 0x0C, 0xD3, 0xD3, 0xD4, 0xE1, 0x8B, 0x8B, 0x8B, 0x47, 0xB6, 0xB6, 0x7B, 0x8B, 0x02, 0x02, 0x13, 0xF9, 0x44, 0x44, 0x41, 0x0B, 0x9F, 0x9F, 0x09, 0x51, 0xE1, 0xE1, 0x6C, 0x77, 0x41, 0x41, 0x50, 0x44, 0x6C, 0x6C, 0x2C, 0x27, 0x31, 0x31, 0x6B, 0x9F, 0x1E, 0x1E, 0x14, 0x11, 0x1B, 0x1B, 0x45, 0x0E, 0x98, 0x98, 0xF5, 0x92, 0x5C, 0x5C, 0x34, 0x39, 0x23, 0x23, 0x7A, 0xD0, 0xED, 0xED, 0xEE, 0x61, 0x16, 0x16, 0x90, 0xB4, 0xFC, 0xFC, 0xDC, 0xEB, 0x85, 0x85, 0xF3, 0x21, 0xEC, 0xEC, 0xAB, 0x6F, 0x8E, 0x8E, 0xB1, 0xC7, 0x2B, 0x2B, 0xED, 0x8C, 0x4E, 0x4E, 0x77, 0x84, 0x0B, 0x0B, 0xC4, 0xF5, 0x97, 0x97, 0x03, 0xED, 0x58, 0x58, 0xDE, 0x5D, 0x32, 0x32, 0xE1, 0x83, 0x47, 0x47, 0x89, 0xF1, 0x01, 0x01, 0x6D, 0x2C, 0xAE, 0xAE, 0x76, 0xDF, 0xE4, 0xE4, 0x48, 0x5A, 0x7E, 0x7E, 0x49, 0x01, 0x91, 0x91, 0xE7, 0x30, 0xF7, 0xF7, 0xC5, 0xAE, 0x78, 0x78, 0xCC, 0xFF, 0x99, 0x99, 0xD9, 0xB5, 0x6D, 0x6D, 0x1A, 0xA8, 0xA5, 0xA5, 0x55, 0x1A, 0x84, 0x84, 0xA8, 0x82, 0xD6, 0xD6, 0x6E, 0xC1, 0xF6, 0xF6, 0xAA, 0x34, 0x61, 0x61, 0x73, 0x81, 0x0C, 0x0C, 0x37, 0xD4, 0x7B, 0x7B, 0x53, 0xA9, 0x34, 0x34, 0xF1, 0x97, 0x5B, 0x5B, 0x96, 0x07, 0x4C, 0x4C, 0xDF, 0x06, 0xDD, 0xDD, 0x00, 0x00, 0x00, 0x00, 0x6F, 0x9A, 0x19, 0x19, 0x33, 0xD1, 0x7C, 0x7C, 0x32, 0x8A, 0x93, 0x93, 0x16, 0xA7, 0xAC, 0xAC, 0x81, 0xFB, 0x0F, 0x0F, 0x9C, 0xBB, 0xF5, 0xF5, 0xC1, 0xAB, 0x7F, 0x7F, 0x5F, 0xA6, 0x3D, 0x3D, 0xE6, 0x6B, 0x18, 0x18, 0x30, 0x3C, 0x24, 0x24, 0xF8, 0xC6, 0xBA, 0xBA, 0xE9, 0x89, 0x49, 0x49, 0xBF, 0x7E, 0x95, 0x95, 0x58, 0x4E, 0x62, 0x62, 0xBD, 0xC8, 0x22, 0x22, 0x5B, 0xA3, 0x3A, 0x3A, 0xF0, 0xCC, 0xB4, 0xB4, 0x5E, 0xFD, 0xD2, 0xD2, 0x01, 0x5B, 0xEF, 0xEF, 0x22, 0x9E, 0x8F, 0x8F, 0xA4, 0x8D, 0xDF, 0xDF, 0x97, 0x5C, 0xA3, 0xA3, 0xA7, 0x60, 0x87, 0x87, 0x99, 0xE5, 0x1D, 0x1D, 0xB7, 0x74, 0x9B, 0x9B, 0xAF, 0x6A, 0x89, 0x89, 0x78, 0x66, 0x5A, 0x5A, 0x29, 0x79, 0xD9, 0xD9, 0xEC, 0xD7, 0xA1, 0xA1, 0xEA, 0x64, 0x11, 0x11, 0xE2, 0x6E, 0x1F, 0x1F, 0x62, 0xCE, 0xFF, 0xFF, 0xC8, 0xFA, 0x9E, 0x9E, 0xE5, 0x86, 0x40, 0x40, 0x56, 0xF7, 0xDC, 0xDC, 0x4B, 0xB7, 0x26, 0x26, 0xF9, 0x9D, 0x55, 0x55, 0x74, 0x69, 0x53, 0x53, 0x1C, 0x1B, 0x15, 0x15, 0x61, 0x23, 0xA7, 0xA7, 0x7C, 0x63, 0x5D, 0x5D, 0xCF, 0x12, 0xC1, 0xC1, 0xC0, 0xF0, 0x90, 0x90, 0x4A, 0xEC, 0xC9, 0xC9, 0xFD, 0x98, 0x52, 0x52, 0x65, 0x26, 0xA0, 0xA0, 0x35, 0x62, 0xCC, 0xCC, 0xB5, 0xC2, 0x2C, 0x2C, 0x2A, 0x94, 0x81, 0x81, 0xEB, 0x3F, 0xFE, 0xFE, 0x43, 0xBD, 0x28, 0x28, 0x20, 0x28, 0x38, 0x38, 0x67, 0x90, 0x17, 0x17, 0x8A, 0x1C, 0x59, 0x59, 0xF6, 0x7F, 0x04, 0x04, 0x42, 0xE6, 0xC7, 0xC7, 0x0D, 0x54, 0xE6, 0xE6, 0x63, 0x95, 0x10, 0x10, 0x72, 0xDA, 0xE3, 0xE3, 0xCD, 0xA4, 0x76, 0x76, 0xD6, 0x57, 0x3C, 0x3C, 0x0A, 0xBC, 0xB9, 0xB9, 0x40, 0x50, 0x70, 0x70, 0xDB, 0x03, 0xDA, 0xDA, 0xA3, 0x65, 0x80, 0x80, 0xFE, 0x75, 0x0A, 0x0A, 0xAD, 0xDC, 0x3E, 0x3E, 0xB3, 0x71, 0x9C, 0x9C, 0xF7, 0x24, 0xEB, 0xEB, 0xA0, 0x88, 0xD8, 0xD8, 0x28, 0x22, 0x36, 0x36, 0x7F, 0x8E, 0x05, 0x05, 0xDD, 0xB0, 0x6A, 0x6A, 0x68, 0x72, 0x46, 0x46, 0xA5, 0xD6, 0x30, 0x30, 0x92, 0x02, 0x4B, 0x4B, 0xD1, 0xBF, 0x63, 0x63, 0x52, 0xF2, 0xDB, 0xDB, 0x2E, 0x91, 0x86, 0x86, 0x57, 0xAC, 0x33, 0x33, 0x9D, 0xE0, 0x1A, 0x1A, 0x46, 0xE3, 0xC0, 0xC0, 0xC9, 0xA1, 0x71, 0x71, 0x70, 0x6C, 0x54, 0x54, 0x2B, 0xCF, 0x6E, 0x6E, 0x66, 0xCB, 0xF8, 0xF8, 0xC2, 0x46, 0x27, 0x27, 0x26, 0x9B, 0x88, 0x88, 0xD8, 0xEE, 0x82, 0x82, 0x36, 0x8F, 0x94, 0x94, 0x23, 0xC5, 0x60, 0x60, 0x5A, 0xF8, 0xD5, 0xD5, 0x25, 0x76, 0xD0, 0xD0, 0x82, 0x16, 0x57, 0x57, 0xC6, 0x43, 0x20, 0x20, 0x84, 0xA5, 0xE7, 0xE7, 0x06, 0xB3, 0xB0, 0xB0, 0x9E, 0x0D, 0x42, 0x42, 0x4C, 0x5F, 0x79, 0x79, 0xBA, 0x20, 0x7D, 0x7D, 0xE0, 0xD8, 0xA8, 0xA8, 0xB0, 0x9C, 0xC4, 0xC4, 0x93, 0x59, 0xA4, 0xA4, 0x27, 0xC0, 0x67, 0x67, 0x08, 0x0A, 0x0E, 0x0E, 0x12, 0xA2, 0xAB, 0xAB, 0x3B, 0xDB, 0x72, 0x72, 0xFC, 0xC3, 0xBD, 0xBD, 0xB8, 0x96, 0xCA, 0xCA, 0xFA, 0x70, 0x0D, 0x0D, 0xEF, 0x3A, 0xF9, 0xF9, 0x0F, 0xE2, 0x51, 0x51, 0x6A, 0xC4, 0xF1, 0xF1, 0x2F, 0xCA, 0x69, 0x69, 0x15, 0x4A, 0xF4, 0xF4, 0xDA, 0x58, 0x35, 0x35, 0x10, 0x14, 0x1C, 0x1C, 0x88, 0xAA, 0xEE, 0xEE, 0xA1, 0xD3, 0x37, 0x37, 0xBE, 0x25, 0x7A, 0x7A, 0xF2, 0x7A, 0x03, 0x03, 0x21, 0x73, 0xD7, 0xD7, 0x5C, 0x4B, 0x65, 0x65, 0x0C, 0x0F, 0x09, 0x09, 0xFF, 0x2E, 0xE5, 0xE5, 0x31, 0x67, 0xCB, 0xCB, 0xA6, 0x3B, 0x68, 0x68, 0xD5, 0xBA, 0x64, 0x64, 0x7D, 0x38, 0xB2, 0xB2, 0x11, 0x4F, 0xF3, 0xF3, 0x87, 0x48, 0xBF, 0xBF, 0x51, 0x1F, 0x83, 0x83, 0x18, 0x1E, 0x12, 0x12, 0xE8, 0xD2, 0xA6, 0xA6, 0x8E, 0x19, 0x5E, 0x5E, 0x69, 0x29, 0xA9, 0xA9, 0xA2, 0x3E, 0x6F, 0x6F, 0x07, 0x07, 0x05, 0x04, 0x6C, 0x6C, 0x44, 0x50, 0xC1, 0xC1, 0x12, 0xCF, 0x28, 0x28, 0xBD, 0x43, 0xF6, 0xF6, 0xC1, 0x6E, 0x84, 0x84, 0x1A, 0x55, 0x3D, 0x3D, 0xA6, 0x5F, 0xBD, 0xBD, 0xC3, 0xFC, 0x9E, 0x9E, 0xFA, 0xC8, 0x48, 0x48, 0x78, 0x60, 0xD2, 0xD2, 0xFD, 0x5E, 0xD0, 0xD0, 0x76, 0x25, 0x5F, 0x5F, 0xE8, 0x07, 0x06, 0x06, 0xF4, 0x8D, 0xCC, 0xCC, 0x62, 0x35, 0xD7, 0xD7, 0x73, 0x21, 0x7A, 0x7A, 0x25, 0xBE, 0xBA, 0xBA, 0xC6, 0xF8, 0x87, 0x87, 0x60, 0xA7, 0x2E, 0x2E, 0x49, 0xCE, 0x11, 0x11, 0x64, 0xEA, 0x65, 0x65, 0x4B, 0x5C, 0x81, 0x81, 0x94, 0x2A, 0xB3, 0xB3, 0xC9, 0xF4, 0xBE, 0xBE, 0xB9, 0x0E, 0x59, 0x59, 0x1C, 0x8A, 0x41, 0x41, 0x77, 0x6C, 0x2A, 0x2A, 0x36, 0x38, 0x90, 0x90, 0xF0, 0xC0, 0xE2, 0xE2, 0x2B, 0xFB, 0x18, 0x18, 0x6B, 0xE6, 0xA4, 0xA4, 0x59, 0x93, 0xA9, 0xA9, 0x29, 0x69, 0x1A, 0x1A, 0xE0, 0x9D, 0x93, 0x93, 0x8A, 0x32, 0x1C, 0x1C, 0x14, 0x10, 0x6B, 0x6B, 0x41, 0x54, 0x0C, 0x0C, 0x81, 0x73, 0x37, 0x37, 0xD3, 0xA1, 0x4E, 0x4E, 0x8C, 0xED, 0x0B, 0x0B, 0x84, 0x77, 0x05, 0x05, 0x8E, 0x7F, 0x0F, 0x0F, 0xFB, 0x81, 0x5D, 0x5D, 0x63, 0x7C, 0xD3, 0xD3, 0x0C, 0xD7, 0x32, 0x32, 0x5D, 0xDE, 0x96, 0x96, 0x04, 0x4D, 0xF4, 0xF4, 0x4A, 0x15, 0x1E, 0x1E, 0x9F, 0x6B, 0xAD, 0xAD, 0x56, 0x9F, 0xC8, 0xC8, 0x1D, 0xC3, 0xF5, 0xF5, 0xBB, 0x9C, 0xBF, 0xBF, 0x48, 0x87, 0x3A, 0x3A, 0xA3, 0x5B, 0x98, 0x98, 0x0E, 0x45, 0x2D, 0x2D, 0x33, 0x3C, 0xB8, 0xB8, 0x4D, 0x83, 0xC2, 0xC2, 0x68, 0x3D, 0xA3, 0xA3, 0x5C, 0x97, 0x68, 0x68, 0x3B, 0xA6, 0xC6, 0xC6, 0x17, 0xCB, 0xEE, 0xEE, 0xAA, 0x88, 0xA6, 0xA6, 0xD2, 0xE8, 0xE1, 0xE1, 0x51, 0x09, 0xA8, 0xA8, 0xD8, 0xE0, 0xD8, 0xD8, 0x88, 0xA0, 0xD1, 0xD1, 0x87, 0xAC, 0x04, 0x04, 0x7F, 0xF6, 0xE5, 0xE5, 0x2E, 0xFF, 0xF1, 0xF1, 0xC4, 0x6A, 0xBC, 0xBC, 0x32, 0x75, 0xFD, 0xFD, 0x45, 0x19, 0x27, 0x27, 0x46, 0xC2, 0x3C, 0x3C, 0x57, 0xD6, 0x50, 0x50, 0x13, 0x86, 0x8B, 0x8B, 0xE1, 0xD4, 0x79, 0x79, 0x5F, 0x4C, 0xFB, 0xFB, 0xB1, 0x94, 0x76, 0x76, 0xA4, 0xCD, 0x21, 0x21, 0xB2, 0x4F, 0x35, 0x35, 0x58, 0xDA, 0x19, 0x19, 0x9A, 0x6F, 0xB2, 0xB2, 0x38, 0x7D, 0x3F, 0x3F, 0x2D, 0x24, 0x1D, 0x1D, 0xE5, 0x99, 0x99, 0x99, 0xFF, 0xCC, 0x42, 0x42, 0x0D, 0x9E, 0x0E, 0x0E, 0x0A, 0x08, 0x57, 0x57, 0x16, 0x82, 0x13, 0x13, 0xEF, 0x91, 0xFC, 0xFC, 0xB4, 0x90, 0x4F, 0x4F, 0x7D, 0x64, 0xA1, 0xA1, 0xD7, 0xEC, 0xB9, 0xB9, 0xBC, 0x0A, 0x00, 0x00, 0x00, 0x00, 0xCB, 0xCB, 0x67, 0x31, 0x63, 0x63, 0xBF, 0xD1, 0x15, 0x15, 0x1B, 0x1C, 0x44, 0x44, 0xF9, 0x13, 0xCA, 0xCA, 0x96, 0xB8, 0x78, 0x78, 0xAE, 0xC5, 0x6F, 0x6F, 0x3E, 0xA2, 0xE3, 0xE3, 0xDA, 0x72, 0x54, 0x54, 0x6C, 0x70, 0x8F, 0x8F, 0x9E, 0x22, 0x9F, 0x9F, 0x0B, 0x41, 0x3B, 0x3B, 0x52, 0xD2, 0x4D, 0x4D, 0xF6, 0x1F, 0x33, 0x33, 0xAC, 0x57, 0xDA, 0xDA, 0x03, 0xDB, 0x34, 0x34, 0xA9, 0x53, 0xB6, 0xB6, 0x47, 0x8B, 0xFF, 0xFF, 0xCE, 0x62, 0xB0, 0xB0, 0xB3, 0x06, 0x4A, 0x4A, 0xF3, 0x1B, 0x4C, 0x4C, 0x07, 0x96, 0x0D, 0x0D, 0x70, 0xFA, 0xA5, 0xA5, 0xA8, 0x1A, 0xA7, 0xA7, 0x23, 0x61, 0xAE, 0xAE, 0x2C, 0x6D, 0x2F, 0x2F, 0xB8, 0x47, 0x92, 0x92, 0x7B, 0xBB, 0x73, 0x73, 0x2A, 0xB2, 0xC4, 0xC4, 0x9C, 0xB0, 0x9A, 0x9A, 0x85, 0x3E, 0x83, 0x83, 0x1F, 0x51, 0x40, 0x40, 0x86, 0xE5, 0xB4, 0xB4, 0xCC, 0xF0, 0x14, 0x14, 0xEA, 0x95, 0x6A, 0x6A, 0xB0, 0xDD, 0xE4, 0xE4, 0xDF, 0x76, 0x89, 0x89, 0x6A, 0xAF, 0x66, 0x66, 0x31, 0xAE, 0x0A, 0x0A, 0x75, 0xFE, 0xC0, 0xC0, 0xE3, 0x46, 0x8C, 0x8C, 0xE4, 0xD0, 0x62, 0x62, 0x4E, 0x58, 0x60, 0x60, 0xC5, 0x23, 0x94, 0x94, 0x8F, 0x36, 0xF8, 0xF8, 0xCB, 0x66, 0x36, 0x36, 0x22, 0x28, 0x72, 0x72, 0xDB, 0x3B, 0x49, 0x49, 0x89, 0xE9, 0x8D, 0x8D, 0x15, 0x59, 0x7F, 0x7F, 0xAB, 0xC1, 0xB5, 0xB5, 0x3D, 0x79, 0x17, 0x17, 0x90, 0x67, 0xD6, 0xD6, 0x82, 0xA8, 0x9D, 0x9D, 0x80, 0x3A, 0x52, 0x52, 0x98, 0xFD, 0x5C, 0x5C, 0x92, 0xF5, 0x97, 0x97, 0xF5, 0xC4, 0x8E, 0x8E, 0x6F, 0xAB, 0xED, 0xED, 0xD0, 0x7A, 0x71, 0x71, 0xA1, 0xC9, 0x4B, 0x4B, 0x02, 0x92, 0xAA, 0xAA, 0x53, 0x9B, 0xE9, 0xE9, 0xAF, 0x8C, 0xEA, 0xEA, 0xD5, 0x7E, 0x56, 0x56, 0xE7, 0x0B, 0x39, 0x39, 0xD9, 0xA9, 0xDD, 0xDD, 0x06, 0xDF, 0x10, 0x10, 0x95, 0x63, 0xC3, 0xC3, 0x99, 0xB4, 0x75, 0x75, 0xDE, 0x3F, 0xF9, 0xF9, 0x3A, 0xEF, 0x8A, 0x8A, 0x10, 0x5D, 0x88, 0x88, 0x9B, 0x26, 0xF7, 0xF7, 0x30, 0xE7, 0x61, 0x61, 0x34, 0xAA, 0x6E, 0x6E, 0xCF, 0x2B, 0x77, 0x77, 0x55, 0x44, 0x26, 0x26, 0xB7, 0x4B, 0x02, 0x02, 0x8B, 0x7B, 0xB7, 0xB7, 0xB6, 0x02, 0x7E, 0x7E, 0x5A, 0x48, 0x24, 0x24, 0x3C, 0x30, 0x1B, 0x1B, 0x11, 0x14, 0xDF, 0xDF, 0x8D, 0xA4, 0x80, 0x80, 0x65, 0xA3, 0xAF, 0xAF, 0xDD, 0xE4, 0xA2, 0xA2, 0xAD, 0x1E, 0x86, 0x86, 0x91, 0x2E, 0x43, 0x43, 0xFC, 0x17, 0x91, 0x91, 0x01, 0x49, 0xCD, 0xCD, 0x93, 0xBC, 0xBB, 0xBB, 0x37, 0x71, 0x46, 0x46, 0x72, 0x68, 0x2B, 0x2B, 0xC7, 0xB1, 0xE0, 0xE0, 0xA0, 0x80, 0x09, 0x09, 0x0F, 0x0C, 0xAC, 0xAC, 0xA7, 0x16, 0x01, 0x01, 0xF1, 0x89, 0xA0, 0xA0, 0x26, 0x65, 0x85, 0x85, 0xEB, 0xDC, 0x3E, 0x3E, 0xDC, 0xAD, 0x58, 0x58, 0xED, 0x03, 0x25, 0x25, 0xCD, 0xB9, 0xF2, 0xF2, 0xBE, 0x98, 0xB1, 0xB1, 0x42, 0x8F, 0xAB, 0xAB, 0xA2, 0x12, 0xDB, 0xDB, 0xF2, 0x52, 0x9B, 0x9B, 0x74, 0xB7, 0x23, 0x23, 0x39, 0x34, 0x5B, 0x5B, 0x97, 0xF1, 0x2C, 0x2C, 0xC2, 0xB5, 0xCE, 0xCE, 0xE9, 0x4E, 0xD5, 0xD5, 0xF8, 0x5A, 0x38, 0x38, 0x28, 0x20, 0x69, 0x69, 0xCA, 0x2F, 0x30, 0x30, 0xD6, 0xA5, 0xC7, 0xC7, 0xE6, 0x42, 0x31, 0x31, 0x27, 0x2C, 0x67, 0x67, 0xC0, 0x27, 0xEF, 0xEF, 0x5B, 0x01, 0xE8, 0xE8, 0x5E, 0x05, 0x7C, 0x7C, 0xD1, 0x33, 0x20, 0x20, 0x43, 0xC6, 0x29, 0x29, 0x4C, 0xCA, 0x70, 0x70, 0x50, 0x40, 0xF3, 0xF3, 0x4F, 0x11, 0xFE, 0xFE, 0x3F, 0xEB, 0x55, 0x55, 0x9D, 0xF9, 0xE7, 0xE7,
                    0xA5, 0x84, 0x16, 0x16, 0x61, 0xEE, 0xDC, 0xDC, 0xF7, 0x56, 0x47, 0x47, 0x83, 0xE1, 0x95, 0x95, 0x7E, 0xBF, 0x08, 0x08, 0xFE, 0x85, 0xCF, 0xCF, 0x18, 0xC7, 0x03, 0x03, 0x7A, 0xF2, 0x64, 0x64, 0xBA, 0xD5, 0xF0, 0xF0, 0x35, 0xE3, 0xDE, 0xDE, 0x7C, 0x2D, 0x12, 0x12, 0x1E, 0x18, 0x53, 0x53, 0x69, 0x74, 0xC9, 0xC9, 0xEC, 0x4A, 0x82, 0x82, 0xEE, 0xD8, 0x5E, 0x5E, 0x19, 0x8E, 0x7D, 0x7D, 0x20, 0xBA, 0xD9, 0xD9, 0x79, 0x29, 0x45, 0x45, 0x08, 0x9A, 0xC5, 0xC5, 0x6D, 0x39, 0x6D, 0x6D, 0xB5, 0xD9, 0xFA, 0xFA, 0x40, 0x1D, 0x74, 0x74, 0x2F, 0xB6, 0x7B, 0x7B, 0xD4, 0x37, 0x5A, 0x5A, 0x66, 0x78, 0x1F, 0x1F, 0x6E, 0xE2, 0xEC, 0xEC, 0x21, 0xF3, 0xEB, 0xEB, 0x24, 0xF7, 0x22, 0x22, 0xC8, 0xBD, 0x9C, 0x9C, 0x71, 0xB3, 0xD4, 0xD4, 0x09, 0xD3, 0x51, 0x51, 0xE2, 0x0F, 0xE6, 0xE6, 0x54, 0x0D, 0xB9, 0xBE, 0x0E, 0xBE, 0xC8, 0x22, 0xBD, 0x22, 0x4C, 0x29, 0xCA, 0x29, 0xB1, 0xFB, 0x94, 0xFB, 0xF3, 0x4A, 0x1B, 0x4A, 0xD1, 0x7C, 0x33, 0x7C, 0xB4, 0xFC, 0x90, 0xFC, 0x95, 0x10, 0x63, 0x10, 0x16, 0x57, 0x82, 0x57, 0xA6, 0x3D, 0x5F, 0x3D, 0xF6, 0x4D, 0x1F, 0x4D, 0x32, 0xBC, 0x75, 0xBC, 0x31, 0x66, 0xAE, 0x66, 0xC0, 0x67, 0x27, 0x67, 0xFC, 0x43, 0x17, 0x43, 0x0D, 0x42, 0x9E, 0x42, 0xDA, 0xE3, 0x72, 0xE3, 0xE7, 0x56, 0x0B, 0x56, 0x94, 0x81, 0x2A, 0x81, 0x0C, 0xD3, 0xD7, 0xD3, 0x1B, 0x15, 0x1C, 0x15, 0x08, 0x45, 0x9A, 0x45, 0x8E, 0x05, 0x7F, 0x05, 0x2D, 0x3F, 0x24, 0x3F, 0xFA, 0x9E, 0xC8, 0x9E, 0x5B, 0xEF, 0x01, 0xEF, 0xE0, 0x1A, 0x9D, 0x1A, 0xAE, 0x78, 0xC5, 0x78, 0x2A, 0x73, 0xB2, 0x73, 0x48, 0xBF, 0x87, 0xBF, 0x12, 0xC1, 0xCF, 0xC1, 0x77, 0x41, 0x6C, 0x41, 0x19, 0x5E, 0x8E, 0x5E, 0x3C, 0x24, 0x30, 0x24, 0xBC, 0xB9, 0x0A, 0xB9, 0xDF, 0xE4, 0x76, 0xE4, 0x7F, 0x04, 0xF6, 0x04, 0xB3, 0xB0, 0x06, 0xB0, 0x3E, 0x6F, 0xA2, 0x6F, 0xC5, 0x60, 0x23, 0x60, 0x7D, 0x4F, 0x64, 0x4F, 0xA5, 0xE7, 0x84, 0xE7, 0xE1, 0x8B, 0xD4, 0x8B, 0x8A, 0x93, 0x32, 0x93, 0xBD, 0x28, 0x43, 0x28, 0x76, 0xD0, 0x25, 0xD0, 0x4D, 0xB8, 0x83, 0xB8, 0x9D, 0x55, 0xF9, 0x55, 0x47, 0xB6, 0x8B, 0xB6, 0x1D, 0xC8, 0xC3, 0xC8, 0x09, 0xD4, 0xD3, 0xD4, 0xC7, 0x2B, 0xB1, 0x2B, 0x84, 0x0B, 0x77, 0x0B, 0x63, 0x5D, 0x7C, 0x5D, 0xEC, 0xC9, 0x4A, 0xC9, 0x97, 0x5B, 0xF1, 0x5B, 0x9F, 0x1E, 0x6B, 0x1E, 0x9B, 0x88, 0x26, 0x88, 0x5E, 0xE8, 0x05, 0xE8, 0x62, 0xCC, 0x35, 0xCC, 0x50, 0x70, 0x40, 0x70, 0x87, 0xD1, 0xAC, 0xD1, 0x0E, 0x98, 0x45, 0x98, 0xC6, 0xBA, 0xF8, 0xBA, 0xF5, 0x97, 0xC4, 0x97, 0x4E, 0x62, 0x58, 0x62, 0xA1, 0x71, 0xC9, 0x71, 0x7A, 0x03, 0xF2, 0x03, 0xBF, 0x63, 0xD1, 0x63, 0x45, 0xFD, 0x19, 0xFD, 0x20, 0x7D, 0xBA, 0x7D, 0x6A, 0x89, 0xAF, 0x89, 0x30, 0xF7, 0xE7, 0xF7, 0x3D, 0xB5, 0x79, 0xB5, 0x60, 0x87, 0xA7, 0x87, 0x0B, 0x9F, 0x41, 0x9F, 0x52, 0x3B, 0xD2, 0x3B, 0x86, 0x40, 0xE5, 0x40, 0xD3, 0x37, 0xA1, 0x37, 0xAF, 0xE9, 0x8C, 0xE9, 0x6D, 0xC5, 0x39, 0xC5, 0x61, 0x16, 0xEE, 0x16, 0x82, 0xD6, 0xA8, 0xD6, 0xD7, 0xA1, 0xEC, 0xA1, 0xC2, 0x2C, 0xB5, 0x2C, 0xBB, 0xF5, 0x9C, 0xF5, 0xB0, 0x6A, 0xDD, 0x6A, 0x41, 0x6B, 0x54, 0x6B, 0xEE, 0x82, 0xD8, 0x82, 0xB6, 0xB7, 0x02, 0xB7, 0xAD, 0xA2, 0x1E, 0xA2, 0xE9, 0xCE, 0x4E, 0xCE, 0x70, 0x0D, 0xFA, 0x0D, 0x51, 0xE1, 0x09, 0xE1, 0x2C, 0xAE, 0x6D, 0xAE, 0xF7, 0xDC, 0x56, 0xDC, 0xD0, 0xED, 0x7A, 0xED, 0x89, 0x49, 0xE9, 0x49, 0x72, 0x46, 0x68, 0x46, 0xD8, 0xA8, 0xE0, 0xA8, 0x26, 0xA0, 0x65, 0xA0, 0x83, 0x47, 0xE1, 0x47, 0xFE, 0x08, 0x85, 0x08, 0xB7, 0x26, 0x4B, 0x26, 0xE8, 0x5F, 0x07, 0x5F, 0x49, 0x2E, 0xCE, 0x2E, 0xF8, 0xD5, 0x5A, 0xD5, 0x0F, 0x09, 0x0C, 0x09, 0xD5, 0xEA, 0x7E, 0xEA, 0x05, 0x07, 0x04, 0x07, 0xFB, 0x0F, 0x81, 0x0F, 0xE5, 0x1D, 0x99, 0x1D, 0x28, 0x38, 0x20, 0x38, 0x2E, 0xE5, 0xFF, 0xE5, 0xDC, 0x3E, 0xAD, 0x3E, 0x44, 0x6C, 0x50, 0x6C, 0x38, 0xB2, 0x7D, 0xB2, 0x6F, 0x8E, 0xAB, 0x8E, 0xF4, 0x06, 0x8D, 0x06, 0x54, 0xE6, 0x0D, 0xE6, 0x5A, 0x7E, 0x48, 0x7E, 0xA7, 0xAC, 0x16, 0xAC, 0x34, 0x61, 0xAA, 0x61, 0x79, 0xD9, 0x29, 0xD9, 0xDB, 0x72, 0x3B, 0x72, 0xF0, 0x90, 0xC0, 0x90, 0x93, 0xCD, 0xBC, 0xCD, 0xC9, 0xB3, 0xF4, 0xB3, 0xCF, 0x6E, 0x2B, 0x6E, 0x6C, 0x54, 0x70, 0x54, 0xAB, 0x7F, 0xC1, 0x7F, 0x85, 0x9A, 0x3E, 0x9A, 0xF2, 0xDB, 0x52, 0xDB, 0x42, 0xB1, 0x8F, 0xB1, 0xAA, 0xEE, 0x88, 0xEE, 0x69, 0x53, 0x74, 0x53, 0xB2, 0x21, 0x4F, 0x21, 0x67, 0xCB, 0x31, 0xCB, 0x74, 0x9B, 0xB7, 0x9B, 0x46, 0x27, 0xC2, 0x27, 0x5D, 0x32, 0xDE, 0x32, 0xD4, 0x7B, 0x37, 0x7B, 0x71, 0x9C, 0xB3, 0x9C, 0x59, 0xA4, 0x93, 0xA4, 0xFD, 0xD2, 0x5E, 0xD2, 0xCE, 0xFF, 0x62, 0xFF, 0xCD, 0x25, 0xB9, 0x25, 0xB5, 0x6D, 0xD9, 0x6D, 0x4A, 0xF4, 0x15, 0xF4, 0xD6, 0x30, 0xA5, 0x30, 0x06, 0xDD, 0xDF, 0xDD, 0x4B, 0x65, 0x5C, 0x65, 0x78, 0x48, 0x60, 0x48, 0x55, 0x77, 0x44, 0x77, 0x27, 0x31, 0x2C, 0x31, 0xE2, 0x51, 0x0F, 0x51, 0x2B, 0xE2, 0xFB, 0xE2, 0x65, 0x80, 0xA3, 0x80, 0xA8, 0xA5, 0x1A, 0xA5, 0x02, 0x4B, 0x92, 0x4B, 0x11, 0x1B, 0x14, 0x1B, 0x9C, 0xC4, 0xB0, 0xC4, 0x2F, 0x74, 0xB6, 0x74, 0xBE, 0xF2, 0x98, 0xF2, 0xEF, 0x13, 0x91, 0x13, 0x3A, 0xF9, 0xEF, 0xF9, 0xD9, 0x39, 0xA9, 0x39, 0x57, 0x3C, 0xD6, 0x3C, 0xEA, 0x14, 0x95, 0x14, 0x24, 0xEB, 0xF7, 0xEB, 0xA2, 0xAB, 0x12, 0xAB, 0x0A, 0x0E, 0x08, 0x0E, 0x5F, 0x79, 0x4C, 0x79, 0xFF, 0x99, 0xCC, 0x99, 0x01, 0x91, 0x49, 0x91, 0xE3, 0xC0, 0x46, 0xC0, 0x25, 0x7A, 0xBE, 0x7A, 0x99, 0xC3, 0xB4, 0xC3, 0x75, 0x0A, 0xFE, 0x0A, 0x8C, 0x4E, 0xED, 0x4E, 0x66, 0x5A, 0x78, 0x5A, 0x7C, 0xDE, 0x2D, 0xDE, 0xC3, 0xBD, 0xFC, 0xBD, 0x1F, 0x83, 0x51, 0x83, 0x98, 0x52, 0xFD, 0x52, 0x33, 0x2D, 0x3C, 0x2D, 0x8B, 0x02, 0x7B, 0x02, 0x22, 0x36, 0x28, 0x36, 0xF1, 0x01, 0x89, 0x01, 0xCB, 0xF8, 0x66, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x37, 0xBB, 0x71, 0xBB, 0x7B, 0x92, 0xBB, 0x92, 0xDE, 0x75, 0x3F, 0x75, 0x3B, 0x68, 0xA6, 0x68, 0x80, 0x9D, 0x3A, 0x9D, 0xCC, 0xB4, 0xF0, 0xB4, 0x4F, 0xF3, 0x11, 0xF3, 0x68, 0xC2, 0x3D, 0xC2, 0x14, 0x1C, 0x10, 0x1C, 0x81, 0x0C, 0x73, 0x0C, 0xB8, 0x2F, 0x47, 0x2F, 0x23, 0xA7, 0x61, 0xA7, 0x96, 0xCA, 0xB8, 0xCA, 0x91, 0x86, 0x2E, 0x86, 0x3F, 0xFE, 0xEB, 0xFE, 0x8F, 0x94, 0x36, 0x94, 0x6E, 0x1F, 0xE2, 0x1F, 0x92, 0x5C, 0xF5, 0x5C, 0x1C, 0x59, 0x8A, 0x59, 0x9A, 0x19, 0x6F, 0x19, 0xED, 0x58, 0x03, 0x58, 0x40, 0xFA, 0x1D, 0xFA, 0x07, 0x4C, 0x96, 0x4C, 0x88, 0xD8, 0xA0, 0xD8, 0x18, 0xCF, 0xC7, 0xCF, 0x8D, 0xDF, 0xA4, 0xDF, 0x29, 0xA9, 0x69, 0xA9, 0x03, 0xDA, 0xDB, 0xDA, 0x36, 0x2A, 0x38, 0x2A, 0xF9, 0x44, 0x13, 0x44, 0x17, 0xC6, 0xCB, 0xC6, 0xA4, 0x76, 0xCD, 0x76, 0x58, 0x35, 0xDA, 0x35, 0xC4, 0xF1, 0x6A, 0xF1, 0x10, 0x8A, 0x5D, 0x8A, 0x04, 0x96, 0x4D, 0x96, 0x13, 0x50, 0x86, 0x50, 0xCA, 0x69, 0x2F, 0x69, 0xA9, 0x34, 0x53, 0x34, 0x1A, 0x84, 0x55, 0x84, 0x1E, 0x12, 0x18, 0x12, 0x15, 0x8D, 0x59, 0x8D, 0xEB, 0x85, 0xDC, 0x85, 0x90, 0x17, 0x67, 0x17, 0x21, 0xEC, 0xF3, 0xEC, 0xE4, 0x8C, 0xD0, 0x8C, 0x5C, 0xA3, 0x97, 0xA3, 0xA3, 0x3A, 0x5B, 0x3A, 0x35, 0xF0, 0xE3, 0xF0, 0xE6, 0xC7, 0x42, 0xC7, 0xC1, 0xF6, 0x6E, 0xF6, 0x6B, 0x18, 0xE6, 0x18, 0x64, 0x11, 0xEA, 0x11, 0x39, 0x23, 0x34, 0x23, 0xA0, 0xE0, 0x80, 0xE0, 0x7E, 0x95, 0xBF, 0x95, 0x9E, 0x8F, 0x22, 0x8F, 0xBA, 0x64, 0xD5, 0x64, 0x53, 0xAA, 0x9B, 0xAA, 0xD2, 0xA6, 0xE8, 0xA6, 0x56, 0xAD, 0x9F, 0xAD, 0xDD, 0xAF, 0xE4, 0xAF, 0xAC, 0x33, 0x57, 0x33, 0x73, 0xD7, 0x21, 0xD7, 0x43, 0x20, 0xC6, 0x20, 0xC1, 0x6E, 0xF6, 0xC1, 0x09, 0xD3, 0xD4, 0x09, 0xB0, 0xDD, 0x6A, 0xB0, 0x18, 0xC7, 0xCF, 0x18, 0xE1, 0xD4, 0x8B, 0xE1, 0xE4, 0xD0, 0x8C, 0xE4, 0x68, 0x3D, 0xC2, 0x68, 0xFD, 0x5E, 0xD2, 0xFD, 0xB1, 0x94, 0xFB, 0xB1, 0x7F, 0xF6, 0x04, 0x7F, 0xF0, 0xC0, 0x90, 0xF0, 0xD9, 0xA9, 0x39, 0xD9, 0x5D, 0xDE, 0x32, 0x5D, 0x2B, 0xFB, 0xE2, 0x2B, 0x17, 0xCB, 0xC6, 0x17, 0x53, 0x9B, 0xAA, 0x53, 0x1F, 0x51, 0x83, 0x1F, 0x00, 0x00, 0x00, 0x00, 0xC9, 0xF4, 0xB3, 0xC9, 0x84, 0x77, 0x0B, 0x84, 0x2D, 0x24, 0x3F, 0x2D, 0x4C, 0xCA, 0x29, 0x4C, 0xC8, 0xBD, 0x22, 0xC8, 0x73, 0x21, 0xD7, 0x73, 0x97, 0xF1, 0x5B, 0x97, 0x94, 0x2A, 0x81, 0x94, 0xD8, 0xE0, 0xA8, 0xD8, 0x4D, 0x83, 0xB8, 0x4D, 0xBB, 0x9C, 0xF5, 0xBB, 0x19, 0x8E, 0x5E, 0x19, 0xF6, 0x1F, 0x4D, 0xF6, 0x20, 0xBA, 0x7D, 0x20, 0x83, 0xE1, 0x47, 0x83, 0x40, 0x1D, 0xFA, 0x40, 0xF5, 0xC4, 0x97, 0xF5, 0xB7, 0x4B, 0x26, 0xB7, 0x62, 0x35, 0xCC, 0x62, 0x8D, 0xA4, 0xDF, 0x8D, 0xD1, 0x33, 0x7C, 0xD1, 0x5B, 0x01, 0xEF, 0x5B, 0x87, 0xAC, 0xD1, 0x87, 0x88, 0xA0, 0xD8, 0x88, 0x6F, 0xAB, 0x8E, 0x6F, 0x23, 0x61, 0xA7, 0x23, 0xAE, 0xC5, 0x78, 0xAE, 0xD2, 0xE8, 0xA6, 0xD2, 0x1C, 0x8A, 0x59, 0x1C, 0xC5, 0x23, 0x60, 0xC5, 0x1E, 0x18, 0x12, 0x1E, 0x72, 0x68, 0x46, 0x72, 0x2C, 0x6D, 0xAE, 0x2C, 0x11, 0x14, 0x1B, 0x11, 0xDC, 0xAD, 0x3E, 0xDC, 0xF8, 0x5A, 0xD5, 0xF8, 0x75, 0xFE, 0x0A, 0x75, 0x51, 0x09, 0xE1, 0x51, 0xD3, 0xA1, 0x37, 0xD3, 0x6A, 0xAF, 0x89, 0x6A, 0x42, 0x8F, 0xB1, 0x42, 0x04, 0x4D, 0x96, 0x04, 0x8C, 0xED, 0x4E, 0x8C, 0xC3, 0xFC, 0xBD, 0xC3, 0xDA, 0x72, 0xE3, 0xDA, 0x3A, 0xEF, 0xF9, 0x3A, 0x37, 0x71, 0xBB, 0x37, 0x8A, 0x32, 0x93, 0x8A, 0xFE, 0x85, 0x08, 0xFE, 0xC2, 0xB5, 0x2C, 0xC2, 0x15, 0x59, 0x8D, 0x15, 0x30, 0xE7, 0xF7, 0x30, 0xCB, 0x66, 0xF8, 0xCB, 0x74, 0xB7, 0x9B, 0x74, 0x9E, 0x22, 0x8F, 0x9E, 0x66, 0x78, 0x5A, 0x66, 0x39, 0x34, 0x23, 0x39, 0x1B, 0x1C, 0x15, 0x1B, 0xEC, 0x4A, 0xC9, 0xEC, 0x29, 0x69, 0xA9, 0x29, 0xF2, 0x52, 0xDB, 0xF2, 0x22, 0x28, 0x36, 0x22, 0x31, 0xAE, 0x66, 0x31, 0xF4, 0x8D, 0x06, 0xF4, 0x85, 0x3E, 0x9A, 0x85, 0x47, 0x8B, 0xB6, 0x47, 0x7E, 0xBF, 0x95, 0x7E, 0x4F, 0x11, 0xF3, 0x4F, 0xED, 0x03, 0x58, 0xED, 0xE5, 0x99, 0x1D, 0xE5, 0x45, 0x19, 0xFD, 0x45, 0x92, 0xF5, 0x5C, 0x92, 0xE6, 0x42, 0xC7, 0xE6, 0x34, 0xAA, 0x61, 0x34, 0x14, 0x10, 0x1C, 0x14, 0x35, 0xE3, 0xF0, 0x35, 0xAF, 0x8C, 0xE9, 0xAF, 0x08, 0x9A, 0x45, 0x08, 0x27, 0x2C, 0x31, 0x27, 0x05, 0x04, 0x07, 0x05, 0x2E, 0xFF, 0xE5, 0x2E, 0xEF, 0x91, 0x13, 0xEF, 0x77, 0x6C, 0x41, 0x77, 0xA8, 0x1A, 0xA5, 0xA8, 0xD4, 0x37, 0x7B, 0xD4, 0x0D, 0x9E, 0x42, 0x0D, 0xAC, 0x57, 0x33, 0xAC, 0xDB, 0x3B, 0x72, 0xDB, 0xBD, 0x43, 0x28, 0xBD, 0x80, 0x3A, 0x9D, 0x80, 0x65, 0xA3, 0x80, 0x65, 0x0E, 0x45, 0x98, 0x0E, 0x81, 0x73, 0x0C, 0x81, 0xB8, 0x47, 0x2F, 0xB8, 0x7C, 0x2D, 0xDE, 0x7C, 0xDD, 0xE4, 0xAF, 0xDD, 0x79, 0x29, 0xD9, 0x79, 0xFC, 0x17, 0x43, 0xFC, 0x86, 0xE5, 0x40, 0x86, 0x64, 0xEA, 0x11, 0x64, 0x8B, 0x7B, 0x02, 0x8B, 0x8F, 0x36, 0x94, 0x8F, 0xE2, 0x0F, 0x51, 0xE2, 0x6B, 0xE6, 0x18, 0x6B, 0x2A, 0xB2, 0x73, 0x2A, 0x12, 0xCF, 0xC1, 0x12, 0xA0, 0x80, 0xE0, 0xA0, 0xDF, 0x76, 0xE4, 0xDF, 0x5F, 0x4C, 0x79, 0x5F, 0x99, 0xB4, 0xC3, 0x99, 0xA5, 0x84, 0xE7, 0xA5, 0x49, 0xCE, 0x2E, 0x49, 0xF9, 0x13, 0x44, 0xF9, 0xD7, 0xEC, 0xA1, 0xD7, 0xE7, 0x0B, 0x56, 0xE7, 0xA4, 0xCD, 0x76, 0xA4, 0x63, 0x7C, 0x5D, 0x63, 0x25, 0xBE, 0x7A, 0x25, 0xF3, 0x1B, 0x4A, 0xF3, 0x67, 0x31, 0xCB, 0x67, 0xEE, 0xD8, 0x82, 0xEE, 0xA6, 0x5F, 0x3D, 0xA6, 0xC7, 0xB1, 0x2B, 0xC7, 0xC0, 0x27, 0x67, 0xC0, 0x07, 0x96, 0x4C, 0x07, 0x6E, 0xE2, 0x1F, 0x6E, 0xAA, 0x88, 0xEE, 0xAA, 0xCD, 0xB9, 0x25, 0xCD, 0x61, 0xEE, 0x16, 0x61, 0x0C, 0xD7, 0xD3, 0x0C, 0xB5, 0xD9, 0x6D, 0xB5, 0x54, 0x0D, 0xE6, 0x54, 0x1D, 0xC3, 0xC8, 0x1D, 0x93, 0xBC, 0xCD, 0x93, 0x43, 0xC6, 0x20, 0x43, 0xCE, 0x62, 0xFF, 0xCE, 0x71, 0xB3, 0x9C, 0x71, 0x57, 0xD6, 0x3C, 0x57, 0x4B, 0x5C, 0x65, 0x4B, 0xB6, 0x02, 0xB7, 0xB6, 0x95, 0x63, 0x10, 0x95, 0x60, 0xA7, 0x87, 0x60, 0x58, 0xDA, 0x35, 0x58, 0x82, 0xA8, 0xD6, 0x82, 0xEA, 0x95, 0x14, 0xEA, 0x1A, 0x55, 0x84, 0x1A, 0xFB, 0x81, 0x0F, 0xFB, 0x56, 0x9F, 0xAD, 0x56, 0xE0, 0x9D, 0x1A, 0xE0, 0x3E, 0xA2, 0x6F, 0x3E, 0x06, 0xDF, 0xDD, 0x06, 0x89, 0xE9, 0x49, 0x89, 0x24, 0xF7, 0xEB, 0x24, 0x7A, 0xF2, 0x03, 0x7A, 0x41, 0x54, 0x6B, 0x41, 0xE3, 0x46, 0xC0, 0xE3, 0x91, 0x2E, 0x86, 0x91, 0x28, 0x20, 0x38, 0x28, 0x9D, 0xF9, 0x55, 0x9D, 0xD5, 0x7E, 0xEA, 0xD5, 0x46, 0xC2, 0x27, 0x46, 0x6C, 0x70, 0x54, 0x6C, 0x21, 0xF3, 0xEC, 0x21, 0x50, 0x40, 0x70, 0x50, 0x5A, 0x48, 0x7E, 0x5A, 0xDE, 0x3F, 0x75, 0xDE, 0x26, 0x65, 0xA0, 0x26, 0x48, 0x87, 0xBF, 0x48, 0xB2, 0x4F, 0x21, 0xB2, 0xD0, 0x7A, 0xED, 0xD0, 0x36, 0x38, 0x2A, 0x36, 0xAB, 0xC1, 0x7F, 0xAB, 0xBF, 0xD1, 0x63, 0xBF, 0xA9, 0x53, 0x34, 0xA9, 0x5E, 0x05, 0xE8, 0x5E, 0x32, 0x75, 0xBC, 0x32, 0x01, 0x49, 0x91, 0x01, 0x3F, 0xEB, 0xFE, 0x3F, 0x55, 0x44, 0x77, 0x55, 0x38, 0x7D, 0xB2, 0x38, 0xC6, 0xF8, 0xBA, 0xC6, 0xFF, 0xCC, 0x99, 0xFF, 0xAD, 0x1E, 0xA2, 0xAD, 0x5C, 0x97, 0xA3, 0x5C, 0x02, 0x92, 0x4B, 0x02, 0x76, 0x25, 0xD0, 0x76, 0xA2, 0x12, 0xAB, 0xA2, 0xE8, 0x07, 0x5F, 0xE8, 0x3B, 0xA6, 0x68, 0x3B, 0xB4, 0x90, 0xFC, 0xB4, 0xF1, 0x89, 0x01, 0xF1, 0x0A, 0x08, 0x0E, 0x0A, 0xCF, 0x2B, 0x6E, 0xCF, 0x70, 0xFA, 0x0D, 0x70, 0xD6, 0xA5, 0x30, 0xD6, 0x7D, 0x64, 0x4F, 0x7D, 0x0B, 0x41, 0x9F, 0x0B, 0x59, 0x93, 0xA4, 0x59, 0xEB, 0xDC, 0x85, 0xEB, 0x03, 0xDB, 0xDA, 0x03, 0x3D, 0x79, 0xB5, 0x3D, 0x44, 0x50, 0x6C, 0x44, 0x4A, 0x15, 0xF4, 0x4A, 0xF7, 0x56, 0xDC, 0xF7, 0x6D, 0x39, 0xC5, 0x6D, 0x7B, 0xBB, 0x92, 0x7B, 0x52, 0xD2, 0x3B, 0x52, 0x9F, 0x6B, 0x1E, 0x9F, 0x8E, 0x7F, 0x05, 0x8E, 0x98, 0xFD, 0x52, 0x98, 0x69, 0x74, 0x53, 0x69, 0xBC, 0x0A, 0xB9, 0xBC, 0x33, 0x3C, 0x2D, 0x33, 0xBA, 0xD5, 0x64, 0xBA, 0x78, 0x60, 0x48, 0x78, 0xB9, 0x0E, 0xBE, 0xB9, 0xA3, 0x5B, 0x3A, 0xA3, 0x3C, 0x30, 0x24, 0x3C, 0x0F, 0x0C, 0x09, 0x0F, 0x96, 0xB8, 0xCA, 0x96, 0xA1, 0xC9, 0x71, 0xA1, 0xBE, 0x98, 0xF2, 0xBE, 0xCA, 0x2F, 0x69, 0xCA, 0x2F, 0xB6, 0x74, 0x2F, 0x90, 0x67, 0x17, 0x90, 0xC4, 0x6A, 0xF1, 0xC4, 0xCC, 0xF0, 0xB4, 0xCC, 0xFA, 0xC8, 0x9E, 0xFA, 0x10, 0x5D, 0x8A, 0x10, 0x9C, 0xB0, 0xC4, 0x9C, 0xE9, 0x4E, 0xCE, 0xE9, 0x9B, 0x26, 0x88, 0x9B, 0x9A, 0x6F, 0x19, 0x9A, 0x13, 0x86, 0x50, 0x13, 0x4E, 0x58, 0x62, 0x4E, 0xA7, 0x16, 0xAC, 0xA7, 0x16, 0x82, 0x57, 0x16, 0xB3, 0x06, 0xB0, 0xB3]

# Rotate left: 0b1001 --> 0b0011
rol = lambda val, r_bits, max_bits: \
    (val << r_bits % max_bits) & (2**max_bits - 1) | \
    ((val & (2**max_bits - 1)) >> (max_bits - (r_bits % max_bits)))

# Rotate right: 0b1001 --> 0b1100
ror = lambda val, r_bits, max_bits: \
    ((val & (2**max_bits - 1)) >> r_bits % max_bits) | \
    (val << (max_bits - (r_bits % max_bits)) & (2**max_bits - 1))


def access_offstream(offset, index):
    return array_of_ints_to_int(offset[index:index + 4][::-1])


def array_of_ints_to_int(a):
    return int(''.join(pack('!B', x) for x in a).encode('hex'), 16)


def shr_add_xor(dword, offset, shifts, adds=[0, 0, 0, 0], muls=[1, 1, 1, 1]):

    edx = ((dword >> shifts[0] & 0xff) + adds[0]) * muls[0]
    a = array_of_ints_to_int(offset[edx:edx + 4][::-1])

    edx = ((dword >> shifts[1] & 0xff) + adds[1]) * muls[1]
    b = array_of_ints_to_int(offset[edx:edx + 4][::-1])

    c = a ^ b

    edx = ((dword >> shifts[2] & 0xff) + adds[2]) * muls[2]
    d = array_of_ints_to_int(offset[edx:edx + 4][::-1])
    e = d ^ c

    edx = ((dword >> shifts[3] & 0xff) + adds[3]) * muls[3]
    f = array_of_ints_to_int(offset[edx:edx + 4][::-1])
    g = f ^ e

    return a, b, c, d, f, g


def sum_sum_xor(dword0, dword1, dword3, offset, offset_index):
    sum1 = (dword0 + dword1) & 0xffffffff
    sum2 = (
        sum1 + array_of_ints_to_int(offset[offset_index:offset_index + 4][::-1])) & 0xffffffff
    return sum2 ^ dword3

encrypted_flag = [0x4F, 0x6F, 0xA7, 0x87, 0xE9, 0x51, 0x87, 0x64, 0x38, 0x2A,
                  0x46, 0xE5, 0x4F, 0x21, 0x9E, 0x1C, 0xCD, 0x65, 0xE1, 0x9A,
                  0x4F, 0xCF, 0xDE, 0x52, 0x09, 0xBF, 0x53, 0xC4, 0xB0, 0x95,
                  0x75, 0x31, 0xAC, 0x2F, 0xF4, 0x97, 0x1D, 0xA5, 0x9A, 0x02,
                  0xA8, 0xFF, 0xAE, 0x2E, 0xB9, 0x70, 0xCC, 0x02]

xor_keys_input0 = [0] * 0x8
xor_keys_input1 = [0] * 0x8

for x in range(len(encrypted_flag)):
    if (x % 16) < 8:
        xor_keys_input0.append(encrypted_flag[x])
    else:
        xor_keys_input1.append(encrypted_flag[x])

flag = ''

for x in range(0, 16 * 3, 16):

    test = encrypted_flag[x:16 + x]

    dword_560CC63C71B0 = test[:8][::-1]
    dword_560CC63C71B8 = test[8:][::-1]

    dword_560CC63C71C0 = array_of_ints_to_int(dword_560CC63C71B8[-4:])
    dword_560CC63C71C4 = array_of_ints_to_int(dword_560CC63C71B8[:4])
    dword_560CC63C71C8 = array_of_ints_to_int(dword_560CC63C71B0[-4:])
    dword_560CC63C71CC = array_of_ints_to_int(dword_560CC63C71B0[:4])

    dword_560CC63C71C8 = dword_560CC63C71C8 ^ access_offstream(
        off_560CC63C7150, 0x10)
    dword_560CC63C71CC = dword_560CC63C71CC ^ access_offstream(
        off_560CC63C7150, 0x14)
    dword_560CC63C71C0 = dword_560CC63C71C0 ^ access_offstream(
        off_560CC63C7150, 0x18)
    dword_560CC63C71C4 = dword_560CC63C71C4 ^ access_offstream(
        off_560CC63C7150, 0x1c)

    for i in range(16 * 7, -16, -16):
        dword_560CC63C71D0 = shr_add_xor(dword_560CC63C71C8, off_560CC63C7150, [
                                         0, 8, 0x10, 0x18], [0x40, 0x140, 0x240, 0x340], [4, 4, 4, 4])[-1]
        dword_560CC63C71D4 = shr_add_xor(dword_560CC63C71CC, off_560CC63C7150, [
                                         0x18, 0, 0x8, 0x10], [0x40, 0x140, 0x240, 0x340], [4, 4, 4, 4])[-1]

        edx = dword_560CC63C71D0 + \
            (dword_560CC63C71D4 + dword_560CC63C71D4) & 0xffffffff
        eax = (array_of_ints_to_int(off_560CC63C7150[
               0x2c + i:0x2c + 4 + i][::-1]) + edx) & 0xffffffff

        dword_560CC63C71C4 = dword_560CC63C71C4 ^ eax
        dword_560CC63C71C4 = ror(dword_560CC63C71C4, 1, max_bits)
        dword_560CC63C71C0 = rol(dword_560CC63C71C0, 1, max_bits)
        dword_560CC63C71C0 = sum_sum_xor(
            dword_560CC63C71D0, dword_560CC63C71D4, dword_560CC63C71C0, off_560CC63C7150, 0x28 + i)

        dword_560CC63C71D0 = shr_add_xor(dword_560CC63C71C0, off_560CC63C7150, [
                                         0, 8, 0x10, 0x18], [0x40, 0x140, 0x240, 0x340], [4, 4, 4, 4])[-1]
        dword_560CC63C71D4 = shr_add_xor(dword_560CC63C71C4, off_560CC63C7150, [
                                         0x18, 0, 0x8, 0x10], [0x40, 0x140, 0x240, 0x340], [4, 4, 4, 4])[-1]

        edx = dword_560CC63C71D0 + \
            ((dword_560CC63C71D4 + dword_560CC63C71D4) & 0xffffffff)
        eax = (array_of_ints_to_int(off_560CC63C7150[
               0x24 + i:0x24 + 4 + i][::-1]) + edx) & 0xffffffff

        dword_560CC63C71CC = dword_560CC63C71CC ^ eax
        dword_560CC63C71CC = ror(dword_560CC63C71CC, 1, max_bits)
        dword_560CC63C71C8 = rol(dword_560CC63C71C8, 1, max_bits)
        dword_560CC63C71C8 = sum_sum_xor(
            dword_560CC63C71D0, dword_560CC63C71D4, dword_560CC63C71C8, off_560CC63C7150, 0x20 + i)

    dwords_flaginput = [dword_560CC63C71C8, dword_560CC63C71CC]
    dwords_flaginput2 = [dword_560CC63C71C0, dword_560CC63C71C4]

    k = 0

    s = ''
    for i in range(0, 8, 4):
        s += pack("<I", dwords_flaginput2[k] ^
                  access_offstream(off_560CC63C7150, i))
        k += 1

    s = pack(">Q", int(s.encode('hex'), 16) ^
             array_of_ints_to_int(xor_keys_input0[x / 2:x / 2 + 8]))
    s1 = ''
    k = 0
    for i in range(8, 8 * 2, 4):
        s1 += pack("<I", dwords_flaginput[k] ^
                   access_offstream(off_560CC63C7150, i))
        k += 1

    s1 = pack(">Q", int(s1.encode('hex'), 16) ^
              array_of_ints_to_int(xor_keys_input1[x / 2:x / 2 + 8]))

    flag += s + s1

print "hitcon{"+flag+"}"

Running it to get the flag :

1
2
$ python reverselukaku.py 
hitcon{~Exc3p7i0n-Ori3n7ed-Pr0grammin9~RoO0cks!!\o^_^o/}

TeamRocketISTCTF Team

Portuguese Computer Science Students