^+rc4

main

int __fastcall main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // eax
  unsigned int v4; // eax
  void *v5; // rax
  void *v7; // rax
  int i; // [rsp+24h] [rbp-D4h]
  void *v9; // [rsp+28h] [rbp-D0h]
  char v10[32]; // [rsp+30h] [rbp-C8h] BYREF
  char Str[128]; // [rsp+50h] [rbp-A8h] BYREF

  strcpy(Str, "12345678abcdefghijklmnopqrspxyz");
  memset(&Str[32], 0, 0x60u);
  memset(v10, 0, 0x17u);
  sub_1400054D0("%s", v10);
  v9 = malloc(0x408u);
  v3 = strlen(Str);
  sub_140001120(v9, Str, v3);
  v4 = strlen(v10);
  sub_140001240(v9, v10, v4);
  for ( i = 0; i < 22; ++i )
  {
    if ( ((unsigned __int8)v10[i] ^ 0x22) != byte_14013B000[i] )
    {
      v5 = (void *)sub_1400015A0(&off_14013B020, "error");
      _CallMemberFunction0(v5, sub_140001F10);
      return 0;
    }
  }
  v7 = (void *)sub_1400015A0(&off_14013B020, "nice job");
  _CallMemberFunction0(v7, sub_140001F10);
  return 0;
}

rc4

__int64 __fastcall sub_140001120(_DWORD *a1, __int64 a2, int a3)
{
  __int64 result; // rax
  int i; // [rsp+0h] [rbp-28h]
  int j; // [rsp+0h] [rbp-28h]
  int v6; // [rsp+4h] [rbp-24h]
  int v7; // [rsp+8h] [rbp-20h]
  int v8; // [rsp+Ch] [rbp-1Ch]
  _DWORD *v9; // [rsp+10h] [rbp-18h]

  *a1 = 0;
  a1[1] = 0;
  v9 = a1 + 2;
  for ( i = 0; i < 256; ++i )
    v9[i] = i;
  v6 = 0;
  result = 0;
  LOBYTE(v7) = 0;
  for ( j = 0; j < 256; ++j )
  {
    v8 = v9[j];
    v7 = (unsigned __int8)(*(_BYTE *)(a2 + v6) + v8 + v7);
    v9[j] = v9[v7];
    v9[v7] = v8;
    if ( ++v6 >= a3 )
      v6 = 0;
    result = (unsigned int)(j + 1);
  }
  return result;
}
int *__fastcall sub_140001240(int *a1, __int64 a2, int a3)
{
  int i; // [rsp+0h] [rbp-28h]
  int v5; // [rsp+4h] [rbp-24h]
  int v6; // [rsp+8h] [rbp-20h]
  int v7; // [rsp+Ch] [rbp-1Ch]
  int v8; // [rsp+10h] [rbp-18h]
  _DWORD *v9; // [rsp+18h] [rbp-10h]

  v5 = *a1;
  v6 = a1[1];
  v9 = a1 + 2;
  for ( i = 0; i < a3; ++i )
  {
    v5 = (unsigned __int8)(v5 + 1);
    v7 = v9[v5];
    v6 = (unsigned __int8)(v7 + v6);
    v8 = v9[v6];
    v9[v5] = v8;
    v9[v6] = v7;
    *(_BYTE *)(a2 + i) ^= LOBYTE(v9[(unsigned __int8)(v8 + v7)]);
  }
  *a1 = v5;
  a1[1] = v6;
  return a1;
}

数据

key = b"12345678abcdefghijklmnopqrspxyz"
byte_14013B000 = [0x9E, 0xE7, 0x30, 0x5F, 0xA7, 0x01, 0xA6, 0x53, 0x59, 0x1B, 0x0A, 0x20, 0xF1, 0x73, 0xD1, 0x0E, 0xAB, 0x09, 0x84, 0x0E, 0x8D, 0x2B, 0x00, 0x00]

exp

key = b"12345678abcdefghijklmnopqrspxyz"

enc = [
    0x9E, 0xE7, 0x30, 0x5F, 0xA7, 0x01, 0xA6, 0x53,
    0x59, 0x1B, 0x0A, 0x20, 0xF1, 0x73, 0xD1, 0x0E,
    0xAB, 0x09, 0x84, 0x0E, 0x8D, 0x2B
]

target = bytes([x ^ 0x22 for x in enc])

def rc4(key, data):
    S = list(range(256))
    j = 0
    k = 0

    for i in range(256):
        j = (key[k] + S[i] + j) & 0xff
        S[i], S[j] = S[j], S[i]
        k += 1
        if k >= len(key):
            k = 0

    i = 0
    j = 0
    out = bytearray(data)

    for n in range(len(out)):
        i = (i + 1) & 0xff
        j = (S[i] + j) & 0xff
        S[i], S[j] = S[j], S[i]
        out[n] ^= S[(S[i] + S[j]) & 0xff]

    return bytes(out)

flag = rc4(key, target)
print(flag.decode())

flag

flag{nice_to_meet_you}