下载下来是一个exe文件

__int64 __fastcall check(char *a1)
{char v1; // alchar v3[32]; // [rsp+20h] [rbp-60h] BYREF_DWORD v4[8]; // [rsp+40h] [rbp-40h] BYREF__int64 v5; // [rsp+60h] [rbp-20h]__int64 v6; // [rsp+68h] [rbp-18h]__int64 v7; // [rsp+70h] [rbp-10h]__int64 v8; // [rsp+78h] [rbp-8h]char v9; // [rsp+80h] [rbp+0h]_DWORD v10[8]; // [rsp+90h] [rbp+10h] BYREF__int64 v11; // [rsp+B0h] [rbp+30h]__int64 v12; // [rsp+B8h] [rbp+38h]__int64 v13; // [rsp+C0h] [rbp+40h]__int64 v14; // [rsp+C8h] [rbp+48h]char v15; // [rsp+D0h] [rbp+50h]_DWORD v16[8]; // [rsp+E0h] [rbp+60h] BYREF__int64 v17; // [rsp+100h] [rbp+80h]__int64 v18; // [rsp+108h] [rbp+88h]__int64 v19; // [rsp+110h] [rbp+90h]__int64 v20; // [rsp+118h] [rbp+98h]char v21; // [rsp+120h] [rbp+A0h]int v22; // [rsp+124h] [rbp+A4h]int v23; // [rsp+128h] [rbp+A8h]int i; // [rsp+12Ch] [rbp+ACh]strcpy(v16, "ABCDEFGHIJKLMNOPQRSTUVWXYZ");HIBYTE(v16[6]) = 0;v16[7] = 0;v17 = 0i64;v18 = 0i64;v19 = 0i64;v20 = 0i64;v21 = 0;strcpy(v10, "abcdefghijklmnopqrstuvwxyz");HIBYTE(v10[6]) = 0;v10[7] = 0;v11 = 0i64;v12 = 0i64;v13 = 0i64;v14 = 0i64;v15 = 0;strcpy(v4, "0123456789+/-=!#&*()?;:*^%");HIBYTE(v4[6]) = 0;v4[7] = 0;v5 = 0i64;v6 = 0i64;v7 = 0i64;v8 = 0i64;v9 = 0;strcpy(v3, "DABBZXQESVFRWNGTHYJUMKIOLPC");v23 = strlen(a1);for ( i = 0; i < v23; ++i ){if ( a1[i] != 127 && a1[i] > 32 ){if ( a1[i] - v3[i] <= 0 ){std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "flag is wrong");}else{v22 = a1[i] - v3[i];if ( v22 > 25 ){if ( v22 > 51 )v1 = *(&v4[-13] + v22);elsev1 = *(&v10[-6] + v22 - 2);a1[i] = v1;}else{a1[i] = *(v16 + v22);}}}}return check_2(a1);
}

其实其他都没什么，就是这个

对应的脚本是这个

因为伪C代码中，这个v4[-13]就是地址 -13 *sizeof(v14[0])

然后这里V14是dwrod 所以要*4

然后还有一个学习到的

import string
v16='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
v10='abcdefghijklmnopqrstuvwxyz'
v4='0123456789+/-=!#&*()?;:*^%'
v3='DABBZXQESVFRWNGTHYJUMKIOLPC'
flag='FSBBhKljpZSYENddjFsWQiNIUF6'
a=''
for i in range(len(flag)):for j in string.printable:enc=-1v22=ord(j)if(v22!=127 and v22>32):if(v22-ord(v3[i]) <=0):continue;else:v22=v22-ord(v3[i])if (v22>25):if(v22>51):enc=ord(v4[v22-52])else:enc=ord(v10[v22-26])else:enc=ord(v16[v22])else:continueif(enc==ord(flag[i])):a+=jbreak
print(a)