0x11  :  push X
0x12  :  pop now_char_
0x13  :  pop x ;pop y ;push x*y;
0x14  :  pop x ;pop y ;push x+y;
0x15  :  printf("%c",now_char_)
0x16  :  push input[index]
0x17  :  pop x ;pop y ;push (y >> x) & 1;
0x18  :  pop x ;pop y ;push x^y;
0x19  :  index++
0x1A  :  return ( need 0 )
0x1B  :  pop x ;pop y ;push x-y;
0x1C  :  pop x ;pop y ;push x/y;

f = open("quest",'rb')
data = f.read()
data2 = data[0x110:]
input_index = 0

number = [0 for i in range(8)]
for i in range(32):
    # print(i)
    data = data2[i*0x43:0x43+i*0x43] 
    index = 0
    for j in range(8):
        # print((data[5+j*7]),end=" ")
        number[j] = data[5+j*7]
    # print(number)
    # print("")
    target = (data[-3])
    # print((target))
    for emu in range(2**8-1):
        num8 = emu>>7&1
        num7 = emu>>6&1
        num6 = emu>>5&1
        num5 = emu>>4&1
        num4 = emu>>3&1
        num3 = emu>>2&1
        num2 = emu>>1&1
        num1 = emu&1
        if (number[0]*num1 + number[1]*num2 + number[2]*num3 + number[3]*num4 + number[4]*num5 + number[5]*num6 + number[6]*num7 + number[7]*num8) == target:
            if emu < 0x7f and emu > 0x20:
                print(chr(emu&0xff),end="")
            # break
            # print(hex(emu),end="")
            # input_index = emu

print("")
data = "s1mpl3_VM_us3s_link3d_l1st_st4ck"
print(len(data))

import re

# 定义正则表达式，用于匹配符合条件的数字和运算符序列
pattern = re.compile(r"\s[0-9+\-/*]+\s")

# 读取文件并进行匹配和转换
with open("chall.vbs", "r") as file:
    content = file.read()
    matches = pattern.findall(content)
    decoded_text = ''.join(chr(int(eval(match.strip()))) for match in matches)
    print(decoded_text, end="")

MsgBox "VBScript, often abbreviated as VBS, is an event-driven programming language developed by Microsoft, primarily used for scripting in the Windows environment."
MsgBox "It is based on the Visual Basic programming language and is designed to be simple and easy to use, especially for those familiar with the BASIC programming language."
MsgBox "And for me, it is the first programming language that I've leart"
MsgBox "Hackers! Have fun with this VBS challenge!"
flag = InputBox("Enter the FLAG:", "Hack for fun")
wefbuwiue = "NalvN3hKExBtALBtInPtNHTnKJ80L3JtqxTboRA/MbF3LnT0L2zHL2SlqnPtJLAnFbIlL2SnFT8lpzFzA2JHrRTiNmT9"

qwfe = 9+2+2+1

Function Base64Decode(base64EncodedString)
    Dim xml, elem
    Set xml = CreateObject("MSXML2.DOMDocument")
    Set elem = xml.createElement("tmp")
    elem.dataType = "bin.base64"
    elem.text = base64EncodedString
    Dim stream
    Set stream = CreateObject("ADODB.Stream")
    stream.Type = 1 'Binary
    stream.Open
    stream.Write elem.nodeTypedValue
    stream.Position = 0
    stream.Type = 2 'Text
    stream.Charset = "utf-8"
    Base64Decode = stream.ReadText
    stream.Close
End Function
Function Caesar(str,offset)
        Dim length,char,i
        Caesar = ""
        length = Len(str)
        For i = 1 To length
                char = Mid(str,i,1)
                If char >= "A" And char <= "Z" Then
                        char = Asc("A") + (Asc(char) - Asc("A") + offset) Mod 26
                        Caesar = Caesar & Chr(char)
                ElseIf char >= "a" And char <= "z" Then
                        char = Asc("a") + (Asc(char) - Asc("a") + offset) Mod 26
                        Caesar = Caesar & Chr(char)
                Else
                        Caesar = Caesar & char
                End If
        Next
End Function

If flag = Base64Decode(Caesar(wefbuwiue, 26-qwfe)) Then
    MsgBox "Congratulations! Correct  FLAG!"
Else
    MsgBox "Wrong flag."
End If

import re
str = open("C:\\Users\\22101\\Downloads\\trace4.txt","r").read()

def hex_to_decimal_little_endian(hex_str):
    # 去掉空格
    hex_str = hex_str.replace(" ", "")
    
    # 将16进制字符串按照每2个字符为一个字节拆分并翻转字节顺序
    reversed_hex_str = ''.join([hex_str[i:i+2] for i in range(0, len(hex_str), 2)][::-1])
    
    # 将翻转后的16进制字符串转为10进制
    decimal_value = int(reversed_hex_str, 16)
    
    return decimal_value

regex = r"Stack\[000029E8\]:0019FE70: .*"
data = []
matches = re.findall(regex, str)
print(len(matches))
for match in matches:
    hex_str = match[len("Stack[000029E8]:0019FE70: "):-1]
    # data.append(int(match[:-1], 16))
    data.append(hex_to_decimal_little_endian(hex_str))
data2 = []
for i in range(len(data)-1):
    if data[i+1] == data[i]:
        continue
    data2.append(data[i])
    print(hex(data[i]))
data2.append(0x873fc)
print(data2)
print(len(data2))

#include<bits/stdc++.h>
#include"../defs.h"
using namespace std;
_DWORD key[4] = {2,2,3,3};
unsigned int input[9] = {
    0x33323130, 0x37363534, 0x33323130, 0x37363534, 0x33323130, 0x37363534, 0x33323130, 0x37363534, 
};
unsigned int Destination2[8] = {
    0x5E487035, 0x0DC30FB7, 0x73E48B63, 0x20CDF292, 0x46C3CD6F, 0x1F2DB262, 0x73D8C2E6, 0x1222FCB8
};
unsigned int out[8] = {
    0x0EA2063F8 ,0x8F66F252, 0x902A72EF, 0x411FDA74, 0x19590D4D, 0xCAE74317, 0x63870F3F, 0xD753AE61
};
unsigned int key1[32] = {
	38, 7757, 28995, 31432, 40287, 52084, 60449, 92734, 103184, 133796, 139649, 167749, 168891, 169172, 189709, 205630, 214575, 240860, 243857, 258537, 279513, 311404, 333059, 358965, 377422, 378745, 407626, 409866, 419591, 451869, 454315, 454905
};
unsigned int key2[32] = {
	840, 19427, 36334, 57571, 81182, 93799, 106255, 107122, 136655, 143533, 171756, 189643, 221240, 241824, 254036, 285147, 292725, 309791, 317420, 
	346824, 359103, 372608, 396996, 408645, 420974, 428150, 430481, 449745, 471859, 485995, 512923, 514025};
unsigned int key3[32] = {
	21652, 30056, 54393, 82249, 87847, 112619, 126716, 139929, 144612, 161315, 176575, 192517, 195264, 222639, 251510, 269514, 286187, 289339, 301158, 324662, 324901, 329087, 331891, 360828, 363851, 374186, 394719, 416112, 432132, 443706, 469689, 483650
};
unsigned int key4[32] = {
	624, 7689, 35258, 48088, 72255, 84491, 115740, 139376, 154995, 180722, 193422, 217745, 232667, 255441, 262252, 274314, 277879, 303070, 303189, 321936, 347986, 367606, 383940, 389908, 407432, 411009, 426055, 451586, 466044, 495316, 521846, 553980
};
int __cdecl encrypt(unsigned int *a1, _DWORD *a2)
{
  int result; // eax
  unsigned int i; // [esp+64h] [ebp-28h]
  int v4; // [esp+68h] [ebp-24h]
  unsigned int v5; // [esp+6Ch] [ebp-20h]
  unsigned int v6; // [esp+70h] [ebp-1Ch]

  v6 = *a1;
  v5 = a1[1];
  v4 = 0;
      printf("%x\n",v6);
      printf("%x\n",v5);
  for ( i = 0; i < 0x20; ++i )
  {
//    v4 -= 0x61C88647;
	v4 = key1[i];
    v6 += (a2[1] + (v5 >> 5)) ^ (v4 + v5) ^ (*a2 + 16 * v5);
    v5 += (a2[3] + (v6 >> 5)) ^ (v4 + v6) ^ (a2[2] + 16 * v6);
    printf("%x\n",v6);
    printf("%x\n",v5);
    printf("%x\n",v4);
  }
  *a1 = v6;
//  printf("%d\n",v4);
  result = 4;
  a1[1] = v5;
  return result;
}

int __cdecl decrypt(unsigned int *a1, _DWORD *a2,_DWORD *a3)
{
  int result; // eax
  unsigned int i; // [esp+64h] [ebp-28h]
  int v4; // [esp+68h] [ebp-24h]
  unsigned int v5; // [esp+6Ch] [ebp-20h]
  unsigned int v6; // [esp+70h] [ebp-1Ch]

  v6 = *a1;
  v5 = a1[1];
  v4 = a3[31];
//      printf("%x\n",v6);
//      printf("%x\n",v5);
//      printf("%x\n",v4);?
  for ( i = 0; i < 0x20; ++i )
  {
  	v5 -= (a2[3] + (v6 >> 5)) ^ (v4 + v6) ^ (a2[2] + 16 * v6);
  	v6 -= (a2[1] + (v5 >> 5)) ^ (v4 + v5) ^ (*a2 + 16 * v5);
    v4 =a3[30-i];
//        printf("%x\n",v6);
//	    printf("%x\n",v5);
//	    printf("%x\n",v4);
  }
  *a1 = v6;
  result = 4;
  a1[1] = v5;
  printf("%x\n",v6);
  printf("%x\n",v5);
  return result;
}

int main(){
	unsigned int data[2] = {1,2};
//	encrypt(&input[0],key);
	printf("%x %x\n",input[0],input[1]);
	decrypt(&out[0],key,key1);
	decrypt(&out[2],key,key2);
	decrypt(&out[4],key,key3);
	decrypt(&out[6],key,key4);
	char *flag = (char *)out;
	
	for(int i = 0;i<=31;i++){
		printf("%c",*(flag+i));
	}
//	decrypt(&out[2],key);
//	decrypt(&out[4],key);
//	decrypt(&out[6],key);
//	char *flag = (char *)out;

}

flag{8edae458-4tf3-2ph2-9f26-1f8719ec8f8d}

qmemcpy(Buf1, "H@^jHwpsH)[jH{M/\\tBBK_|-O{W.iJZ7\\)|~zaB^H+Lwv{SS|-j@\\_[Y", 4 * v3 + 1);

data = base64.b64decode(data)
# print(data[-7:-5])
while True:
    if data[12:15] == b'b32':
        print(data[:100])
        data = base64.b32decode(data[26:-5])
        continue
    if data[12:15] == b'b64':
        print(data[:100])
        data = base64.b64decode(data[26:-5])
        continue
    if data[12:15] == b'b16':
        print(data[:100])
        data = base64.b16decode(data[26:-5])
        continue
    if data[12:15] == b'a85':
        print(data[:100])
        data = base64.a85decode(data[26:-5])
        continue
    if data[12:15] == b'b85':
        print(data[:100])
        data = base64.b85decode(data[26:-5])
        continue
    else:
        file = open('output.txt', 'wb')
        file.write(data)
        print(data)
        break
     

# output.py
a=True
d=len
G=list
g=range
s=next
R=bytes
o=input
Y=print
def l(S):
 i=0
 j=0
 while a:
  i=(i+1)%256
  j=(j+S[i])%256
  S[i],S[j]=S[j],S[i]
  K=S[(S[i]+S[j])%256]
  yield K
def N(key,O):
 I=d(key)
 S=G(g(256))
 j=0
 for i in g(256):
  j=(j+S[i]+key[i%I])%256
  S[i],S[j]=S[j],S[i]
 z=l(S)
 n=[]
 for k in O:
  n.append(k^s(z)+2)
 return R(n)
def E(s,parts_num):
 Q=d(s.decode())
 S=Q//parts_num
 u=Q%parts_num
 W=[]
 j=0
 for i in g(parts_num):
  T=j+S
  if u>0:
   T+=1
   u-=1
  W.append(s[j:T])
  j=T
 return W
if __name__=='__main__':
 L=o('input the flag: >>> ').encode()
 assert d(L)%2==0,'flag length should be even'
 t=b'v3ry_s3cr3t_p@ssw0rd'
 O=E(L,2)
 U=[]
 for i in O:
  U.append(N(t,i).hex())
 if U==['1796972c348bc4fe7a1930b833ff10a80ab281627731ab705dacacfef2e2804d74ab6bc19f60',2ea999141a8cc9e47975269340c177c726a8aa732953a66a6af183bcd9cec8464a']:
  Y('Congratulations! You got the flag!')
 else:
  Y('Wrong flag!')
  
# 注意到是魔改的RC4，懒得自己改了
# 让他自己RC4回去

# O=E(L,2)
# U=[]
# O = []
# O.append(bytes.fromhex('1796972c348bc4fe7a1930b833ff10a80ab281627731ab705dacacfef2e2804d74ab6bc19f60'))
# O.append(bytes.fromhex('2ea999141a8cc9e47975269340c177c726a8aa732953a66a6af183bcd9cec8464a'))

flag{thEn_I_Ca5_BE_YoUR_Onl7_ExeCUti6n_So_Use_m3_t0_R0n_tH17_Ex3Cuti0n}

package com.nobody.Serv1ce;

import android.app.Service;
import android.content.Intent;
import android.os.IBinder;
import android.widget.Toast;

public class MyService extends Service {
    private String input;
    private String key;
    private byte[] keyarray;
    int num;

    static {
        System.loadLibrary("Serv1ce");
    }

    public MyService() {
        this.key = "1liIl11lIllIIl11llII";
        this.keyarray = new byte[0x40];
        this.num = 9;
    }

    private native boolean check(String arg1, byte[] arg2, int arg3) {
    }

    @Override  // android.app.Service
    public IBinder onBind(Intent intent0) {
        throw new UnsupportedOperationException("Not yet implemented");
    }

    @Override  // android.app.Service
    public void onCreate() {
        ++this.num;
        super.onCreate();
    }

    @Override  // android.app.Service
    public void onDestroy() {
        if(this.check(this.input, this.keyarray, this.num)) {
            Toast.makeText(this.getApplicationContext(), "You Are Right", 1).show();
        }
        else {
            Toast.makeText(this.getApplicationContext(), "Wrong", 1).show();
        }

        super.onDestroy();
    }

    @Override  // android.app.Service
    public int onStartCommand(Intent intent0, int v, int v1) {
        ++this.num;
        for(int v2 = 0; v2 < 0x40; ++v2) {
            this.keyarray[v2] = (byte)((this.key.charAt(v2 % this.key.length()) - 0x77 ^ 23) & 0xFF);
        }

        if(intent0 != null) {
            this.input = intent0.getStringExtra("input");
            Toast.makeText(this.getApplicationContext(), "Input Success", 1).show();
        }

        super.onStartCommand(intent0, v, v1);
        return v;
    }
}

res = [0xB9, 0x32, 0xC2, 0xD4, 0x69, 0xD5, 0xCA, 0xFB, 0xF8, 0xFB, 0x80, 0x7C, 0xD4, 0xE5, 0x93, 0xD5, 0x1C, 0x8B, 0xF8, 0xDF, 0xDA, 0xA1, 0x11, 0xF8, 0xA1, 0x93, 0x93, 0xC2, 0x7C, 0x8B, 0x1C, 0x66, 0x01, 0x3D, 0xA3, 0x67]

key = "1liIl11lIllIIl11llII"
keyarray = [0 for i in range(0x40)]
for i in range(0x40):
    keyarray[i] =((ord(key[i%len(key)])-0x77)^23)&0xff
print(keyarray)
for i in range(36):
    # print(i)
    for num in string.printable:
        if ((ord(num)^keyarray[i])*11)&0xff == res[i]:
            print(num,end='')

function enenenenene {
    param(
        $plaintextBytes,
        $keyBytes
    )
    # Initialize S and KSA
    $S = 0..255
    $j = 0
    for ($i = 0; $i -lt 256; $i++) {
        $j = ($j + $S[$i] + $keyBytes[$i % $keyBytes.Length]) % 256
        $temp = $S[$i]
        $S[$i] = $S[$j]
        $S[$j] = $temp
    }

    # PRGA and encryption
    $i = 0
    $j = 0
    $ciphertextBytes = @()
    for ($k = 0; $k -lt $plaintextBytes.Length; $k++) {
        $i = ($i + 1) % 256
        $j = ($j + $S[$i]) % 256
 $temp = $S[$i]
        $S[$i] = $S[$j]
        $S[$j] = $temp
        $t = ($S[$i] + $S[$j]) % 256
        $ciphertextBytes += ($plaintextBytes[$k] -bxor $S[$t])
    }

    # Return ciphertext as a string
    return $ciphertextBytes
}
function enenenenene1 {
    param(
        $inputbyte
    )
    $key = @(0x70, 0x6f, 0x77, 0x65, 0x72)
    $encryptedText = @();
    for ($k = 0; $k -lt $inputbyte.Length; $k++) {
        $encryptedText = enenenenene -plaintextBytes $inputbyte -keyBytes $key;
        $key = enenenenene -plaintextBytes $key -keyBytes $encryptedText;
    }
    return $encryptedText + $key;
}
function enenenenene2 {
    param(
        $inputbyte
    )
    $key = @(0x70, 0x30, 0x77, 0x65, 0x72)
    for ($k = 0; $k -lt $inputbyte.Length; $k++) {
        $inputbyte[$k] = $inputbyte[$k] + $key[$k % $key.Length]
    }
    return $inputbyte;
}
function enenenenene3 {
    param(
        $inputbyte
    )
    $key = @(0x70, 0x30, 0x77, 0x33, 0x72)
    for ($k = 0; $k -lt $inputbyte.Length; $k++) {
        $inputbyte[$k] = $inputbyte[$k] * $key[$k % $key.Length]
    }
    return $inputbyte;
}
$registryPath = 'HKCU:\Software\PacManX'
$valueName = 'MYFLAG'
$value = Get-ItemPropertyValue $registryPath $valueName
$plaintext = @($value) | ForEach-Object {
    $input = $_
    $plaintext = @()
    for ($i = 0; $i -lt $input.Length; $i++) {
        $plaintext += [int][char]$input[$i]
    }
    $plaintext
}
if ($plaintext.Length -ne 36) {
    Set-Content -Path "log.txt" -Value "ERROR"
    exit
}
$encrypted1Text = enENenenene2 -inputbyte (enenenENene2 -inputbyte (enenenenene3 -inputbyte (Enenenenene2 -inputbyte (enenenenene2 -inputbyte (enenenenene2 -inputbyte (enenenenene1 -input $plaintext))))))
$result = @(38304, 8928, 43673, 25957 , 67260, 47152, 16656, 62832 , 19480 , 66690, 40432, 15072 , 63427 , 28558 , 54606, 47712 , 18240 , 68187 , 18256, 63954 , 48384, 14784, 60690 , 21724 , 53238 , 64176 , 9888 , 54859 , 23050 , 58368 , 46032 , 15648 , 64260 , 17899 , 52782 , 51968 , 12336 , 69377 , 27844 , 43206 , 63616)
for ($k = 0; $k -lt $result.Length; $k++) {
    if ($encrypted1Text[$k] -ne $result[$k]) {
        Set-Content -Path "log.txt" -Value "ERROR"
 exit

}
Set-Content -Path "log.txt" -Value "RIGHT"

#include"defs.h" 
#include<stdio.h>
__int64 __fastcall sub_4020F7(int *a1)
{
  int v1; // r8d
  int v2; // ecx
  int v3; // ecx
  int v5; // [rsp+8h] [rbp-38h]
  int v6; // [rsp+Ch] [rbp-34h]
  int v7; // [rsp+10h] [rbp-30h]
  int v8; // [rsp+14h] [rbp-2Ch]
  int v9; // [rsp+18h] [rbp-28h]
  int v10; // [rsp+1Ch] [rbp-24h]
  int v11; // [rsp+20h] [rbp-20h]
  int v12; // [rsp+24h] [rbp-1Ch]
  int v13; // [rsp+28h] [rbp-18h]
  int v14; // [rsp+2Ch] [rbp-14h]
  __int64 v15; // [rsp+30h] [rbp-10h]
  int i; // [rsp+38h] [rbp-8h]
  unsigned int v17; // [rsp+3Ch] [rbp-4h]

  v17 = 1;
  for ( i = 0; i <= 0; ++i )
  {
    HIDWORD(v15) = a1[12 * i];
    LODWORD(v15) = a1[12 * i + 1];
    v14 = a1[12 * i + 2];
    v13 = a1[12 * i + 3];
    v12 = a1[12 * i + 4];
    v11 = a1[12 * i + 5];
    v10 = a1[12 * i + 6];
    v9 = a1[12 * i + 7];
    v8 = a1[12 * i + 8];
    v7 = a1[12 * i + 9];
    v6 = a1[12 * i + 10];
    v5 = a1[12 * i + 11];
    v1 = (unsigned __int8)v7 & (unsigned __int8)v8 & (unsigned __int8)v9 & (v11 == 0) & (v12 == 0) & (unsigned __int8)v13 & ((v14 | (unsigned int)v15 | HIDWORD(v15)) == 0) & (v10 == 0) & (v6 == 0) | (unsigned __int8)v7 & (unsigned __int8)v9 & (unsigned __int8)v11 & (v13 == 0) & (v14 == 0) & BYTE4(v15) & ((_DWORD)v15 == 0) & (v12 == 0) & (v10 == 0) & (v8 == 0) & (v6 == 0) | (unsigned __int8)v6 & (v8 == 0) & (v9 == 0) & (v10 == 0) & (unsigned __int8)v11 & (unsigned __int8)v12 & (unsigned __int8)(v14 & v15 & BYTE4(v15)) & (v13 == 0) & (v7 == 0);
    v2 = (unsigned __int8)v5 & (unsigned __int8)v6 & (unsigned __int8)v8 & (unsigned __int8)v9 & (unsigned __int8)v10 & (unsigned __int8)v11 & (unsigned __int8)v12 & (v14 == 0) & (unsigned __int8)(v15 & BYTE4(v15)) & (v13 == 0) & (v7 == 0) | (v6 == 0) & (v7 == 0) & (unsigned __int8)v8 & (unsigned __int8)v9 & (unsigned __int8)v10 & (unsigned __int8)v12 & (unsigned __int8)v13 & (unsigned __int8)v15 & (HIDWORD(v15) == 0) & (v14 == 0) & (v11 == 0) & (v5 == 0) | (unsigned __int8)v5 & (v7 == 0) & (unsigned __int8)v8 & (unsigned __int8)v10 & (unsigned __int8)v12 & (unsigned __int8)v13 & (unsigned __int8)v14 & BYTE4(v15) & ((_DWORD)v15 == 0) & (v11 == 0) & (v9 == 0) & (v6 == 0) | (unsigned __int8)v5 & (unsigned __int8)v7 & (unsigned __int8)v8 & (unsigned __int8)v10 & (unsigned __int8)v11 & (unsigned __int8)v13 & (unsigned __int8)v14 & (v15 == 0) & (v12 == 0) & (v9 == 0) & (v6 == 0) | (v1 | (unsigned __int8)v6 & (unsigned __int8)v7 & (v9 == 0) & (unsigned __int8)v10 & (v12 == 0) & (unsigned __int8)v13 & (unsigned __int8)v14 & BYTE4(v15) & ((_DWORD)v15 == 0) & (v11 == 0) & (v8 == 0)) & (v5 == 0);
    v3 = (unsigned __int8)v5 & (unsigned __int8)v6 & (v8 == 0) & (v9 == 0) & (unsigned __int8)v10 & (v12 == 0) & (v13 == 0) & (v14 == 0) & (unsigned __int8)(v15 & BYTE4(v15)) & (v11 == 0) & (v7 == 0) | (v6 == 0) & (v7 == 0) & (v8 == 0) & (v9 == 0) & (unsigned __int8)v10 & (v12 == 0) & (unsigned __int8)v13 & ((v14 | (unsigned int)v15 | HIDWORD(v15)) == 0) & (v11 == 0) & (v5 == 0) | (unsigned __int8)v5 & (unsigned __int8)v6 & (unsigned __int8)v7 & (v9 == 0) & (v10 == 0) & (unsigned __int8)v11 & (unsigned __int8)v12 & (v14 == 0) & (unsigned __int8)v15 & (HIDWORD(v15) == 0) & (v13 == 0) & (v8 == 0) | (unsigned __int8)v5 & (unsigned __int8)v7 & (v9 == 0) & (v10 == 0) & (unsigned __int8)v11 & ((v12 | v13 | v14 | (unsigned int)v15 | HIDWORD(v15)) == 0) & (v8 == 0) & (v6 == 0) | (unsigned __int8)v5 & (v7 == 0) & (v8 == 0) & (unsigned __int8)v9 & (unsigned __int8)v10 & (unsigned __int8)v11 & (unsigned __int8)v12 & (v14 == 0) & BYTE4(v15) & ((_DWORD)v15 == 0) & (v13 == 0) & (v6 == 0) | v2;
    if ( !((unsigned __int8)v6 & (unsigned __int8)v8 & (unsigned __int8)v10 & (unsigned __int8)v12 & (v14 == 0) & (unsigned __int8)v15 & (HIDWORD(v15) == 0) & (v13 == 0) & (v11 == 0) & (v9 == 0) & (v7 == 0) & (v5 == 0) | (unsigned __int8)v5 & (unsigned __int8)v6 & (unsigned __int8)v7 & (unsigned __int8)v8 & (v10 == 0) & (v11 == 0) & (unsigned __int8)v12 & (v14 == 0) & (unsigned __int8)v15 & (HIDWORD(v15) == 0) & (v13 == 0) & (v9 == 0) | v3 | (unsigned __int8)v6 & (unsigned __int8)v7 & (unsigned __int8)v8 & (unsigned __int8)v10 & (unsigned __int8)v12 & ((v13 | v14 | (unsigned int)v15 | HIDWORD(v15)) == 0) & (v11 == 0) & (v9 == 0) & (v5 == 0)) )
      v17 = 0;
  }
  return v17;
}
int main(){
	int res[13];
  int num;
	for(int i=0;i<=(1<<12);i++){
		res[0] = i&1;
		res[1] = (i>>1)&1;
     	res[2] = (i>>2)&1;
		res[3] = (i>>3)&1;
		res[4] = (i>>4)&1;
		res[5] = (i>>5)&1;
		res[6] = (i>>6)&1;
		res[7] = (i>>7)&1;
		res[8] = (i>>8)&1;
		res[9] = (i>>9)&1;
		res[10] = (i>>10)&1;
		res[11] = (i>>11)&1;
		if(sub_4020F7(res)){
//		    printf("%d\n",i);
		  // for(int j=0;j<=11;j++){
			// 	printf("%d ",res[j]);
			// }
      num = res[8];
      num = (num<<1) + res[9];
      num = (num<<1) + res[10];
      num = (num<<1) + res[11];
      printf("a[%d]=",num);
      num = res[0];
      num = (num<<1) + res[1];
      num = (num<<1) + res[2];
      num = (num<<1) + res[3];  
      num = (num<<1) + res[4];
      num = (num<<1) + res[5];
      num = (num<<1) + res[6];
      num = (num<<1) + res[7];
      printf("0x%x\n",num);
		}
	}
}
// data = [18,143,236,194,133,4,178,76,91,186,74,207,17,54,10,72]