[2019红帽杯]calc

逆天...
代码很长很长 输入了三个数 进行了一系列算术运算...
可以分析出其中的add,sub,mul,pow等函数 然后就耐心的逐个看
完整分析:

点击查看代码

int __fastcall main(int argc, const char **argv, const char **envp)
{
  __int64 v3; // rax
  __int64 v4; // r8
  __int64 v5; // rax
  __int64 v6; // r8
  __int64 v7; // rax
  __int64 v8; // r8
  __int64 v9; // rax
  __int64 v10; // rax
  void *v11; // rcx
  void *v12; // rcx
  void *v13; // rcx
  __int64 v14; // r8
  __int64 v15; // rax
  __int64 v16; // rax
  void *v17; // rcx
  void *v18; // rcx
  void *v19; // rcx
  __int64 v20; // r8
  __int64 v21; // rax
  void *v22; // rcx
  void *v23; // rcx
  char *v24; // r8
  unsigned __int64 v25; // r11
  _BYTE *v26; // rbx
  unsigned __int64 v27; // rax
  char *v28; // r9
  bool v29; // al
  int v30; // r10d
  __int64 v31; // rdx
  _DWORD *v32; // rcx
  int v33; // edi
  void *v34; // rcx
  unsigned __int64 v35; // rax
  bool v36; // al
  int v37; // r10d
  __int64 v38; // rdx
  _DWORD *v39; // rcx
  __int64 v40; // rax
  __int64 v41; // rax
  __int64 v42; // r14
  __int64 v43; // rbx
  __int64 v44; // rax
  __int64 v45; // r15
  const void *v46; // rsi
  _BYTE *v47; // rdi
  unsigned __int64 v48; // rbx
  size_t v49; // rbx
  void *v50; // rax
  void *v51; // rcx
  char *v52; // rax
  char *v53; // rbx
  __int64 v54; // rax
  __int64 v55; // rbx
  __int64 v56; // rax
  __int64 v57; // rax
  _QWORD *v58; // rcx
  __int64 v59; // rax
  __int64 v60; // rax
  void *v61; // rcx
  void *v62; // rcx
  _BYTE *v63; // rcx
  _BYTE *v64; // rcx
  _BYTE *v65; // rcx
  _BYTE *v66; // rcx
  _BYTE *v67; // rcx
  _BYTE *v68; // rcx
  void *v69; // rcx
  void *v70; // rcx
  void *v71; // rcx
  void *v72; // rcx
  __int64 v73; // rsi
  __int64 v74; // rax
  __int64 v75; // rbx
  __int64 v76; // rax
  void **v77; // rdi
  __int64 v78; // rax
  __int64 v79; // rax
  _QWORD *v80; // rcx
  __int64 v81; // rax
  __int64 v82; // rax
  void *v83; // rcx
  __int64 v84; // rax
  __int64 v85; // rax
  signed __int64 v86; // r8
  void *v87; // rcx
  _BYTE *v88; // rcx
  _BYTE *v89; // rcx
  _BYTE *v90; // rcx
  _BYTE *v91; // rcx
  void *v92; // rcx
  void *v93; // rcx
  void *v94; // rcx
  void *v95; // rcx
  char *v96; // r15
  signed __int64 v97; // rcx
  char *v98; // r14
  int v99; // eax
  __int64 v100; // rdx
  _DWORD *v101; // rcx
  __int64 v102; // r8
  _BYTE *v103; // rcx
  _BYTE *v104; // rax
  int v105; // eax
  __int64 v106; // rsi
  _BYTE *v107; // rcx
  _BYTE *v108; // rax
  int v109; // eax
  __int64 v110; // rsi
  _BYTE *v111; // rsi
  int v112; // eax
  __int64 i; // rsi
  char *v114; // rax
  char *v115; // rax
  _BYTE *v116; // rcx
  void *v117; // rcx
  _BYTE *v118; // rax
  char *v119; // rax
  char *v120; // rax
  void *v122[2]; // [rsp+20h] [rbp-E0h] BYREF
  __int64 v123; // [rsp+30h] [rbp-D0h]
  void *v124[2]; // [rsp+38h] [rbp-C8h] BYREF
  char *v125; // [rsp+48h] [rbp-B8h]
  void **v126; // [rsp+50h] [rbp-B0h]
  void *Block[3]; // [rsp+58h] [rbp-A8h] BYREF
  void *v128[2]; // [rsp+70h] [rbp-90h] BYREF
  __int64 v129; // [rsp+80h] [rbp-80h]
  void *v130[2]; // [rsp+88h] [rbp-78h] BYREF
  __int64 v131; // [rsp+98h] [rbp-68h]
  void *v132[2]; // [rsp+A0h] [rbp-60h] BYREF
  __int64 v133; // [rsp+B0h] [rbp-50h]
  void *v134[2]; // [rsp+B8h] [rbp-48h] BYREF
  __int64 v135; // [rsp+C8h] [rbp-38h]
  void *v136; // [rsp+D0h] [rbp-30h] BYREF
  __int128 v137; // [rsp+D8h] [rbp-28h]
  void *v138; // [rsp+E8h] [rbp-18h] BYREF
  __int128 v139; // [rsp+F0h] [rbp-10h]
  void *v140; // [rsp+100h] [rbp+0h] BYREF
  __int128 v141; // [rsp+108h] [rbp+8h]
  void *v142; // [rsp+118h] [rbp+18h] BYREF
  __int128 v143; // [rsp+120h] [rbp+20h]
  __int64 v144[3]; // [rsp+130h] [rbp+30h] BYREF
  void *v145; // [rsp+148h] [rbp+48h] BYREF
  __int128 v146; // [rsp+150h] [rbp+50h]
  __int64 v147[3]; // [rsp+160h] [rbp+60h] BYREF
  __int64 v148; // [rsp+178h] [rbp+78h] BYREF
  void *INPUT_1[2]; // [rsp+180h] [rbp+80h] BYREF
  __int64 v150; // [rsp+190h] [rbp+90h]
  void *INPUT_2[2]; // [rsp+198h] [rbp+98h] BYREF
  __int64 v152; // [rsp+1A8h] [rbp+A8h]
  void *INPUT_3[2]; // [rsp+1B0h] [rbp+B0h] BYREF
  __int64 v154; // [rsp+1C0h] [rbp+C0h]
  void *v155; // [rsp+1C8h] [rbp+C8h] BYREF
  __int128 v156; // [rsp+1D0h] [rbp+D0h]
  void *v157[3]; // [rsp+1E0h] [rbp+E0h] BYREF
  void *v158; // [rsp+1F8h] [rbp+F8h] BYREF
  __int128 v159; // [rsp+200h] [rbp+100h]
  void *v160[3]; // [rsp+210h] [rbp+110h] BYREF
  void *v161[3]; // [rsp+228h] [rbp+128h] BYREF

  v3 = sub_7FF7EE7A4120(std::cout, "A few days ago,Someone asked me for Windows RE...", envp);
  std::ostream::operator<<(v3, sub_7FF7EE7A42F0);
  v5 = sub_7FF7EE7A4120(std::cout, "But Windows + STL is terrible!", v4);
  std::ostream::operator<<(v5, sub_7FF7EE7A42F0);
  LODWORD(v148) = 0;
  *(_OWORD *)INPUT_1 = 0i64;
  v150 = 0i64;
  COPY1((const void **)INPUT_1, 0i64, &v148);
  UPDATE1((__int64)INPUT_1);
  LODWORD(v148) = 0;
  *(_OWORD *)INPUT_2 = 0i64;
  v152 = 0i64;
  COPY1((const void **)INPUT_2, 0i64, &v148);
  UPDATE1((__int64)INPUT_2);
  LODWORD(v148) = 0;
  *(_OWORD *)INPUT_3 = 0i64;
  v154 = 0i64;
  COPY1((const void **)INPUT_3, 0i64, &v148);
  UPDATE1((__int64)INPUT_3);
  v7 = sub_7FF7EE7A4120(std::cout, "Enjoy it", v6);
  std::ostream::operator<<(v7, sub_7FF7EE7A42F0);
  sub_7FF7EE7A13D0(std::cin, (__int64)INPUT_1);
  v9 = sub_7FF7EE7A4120(std::cout, "Calculating...", v8);
  std::ostream::operator<<(v9, sub_7FF7EE7A42F0);
  LODWORD(v148) = 4;
  *(_OWORD *)v124 = 0i64;
  v125 = 0i64;
  COPY1((const void **)v124, 0i64, &v148);
  UPDATE1((__int64)v124);
  LODWORD(v148) = 2;
  *(_OWORD *)v122 = 0i64;
  v123 = 0i64;
  COPY1((const void **)v122, 0i64, &v148);
  UPDATE1((__int64)v122);
  v10 = POW((__int64)Block, (__int64 *)INPUT_1, v122);// Block = input1**2
  MUL((__int64)v161, (__int64 *)v10, v124);     // v161 = v10*4
  v11 = Block[0];
  if ( Block[0] )
  {
    if ( (unsigned __int64)(4 * ((Block[2] - Block[0]) >> 2)) >= 0x1000 )
    {
      v11 = (void *)*((_QWORD *)Block[0] - 1);
      if ( (unsigned __int64)(Block[0] - v11 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v11);
    memset(Block, 0, sizeof(Block));
  }
  v12 = v122[0];
  if ( v122[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v123 - (unsigned __int64)v122[0]) >> 2)) >= 0x1000 )
    {
      v12 = (void *)*((_QWORD *)v122[0] - 1);
      if ( (unsigned __int64)(v122[0] - v12 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v12);
  }
  v13 = v124[0];
  if ( v124[0] )
  {
    if ( (unsigned __int64)(4 * ((v125 - (char *)v124[0]) >> 2)) >= 0x1000 )
    {
      v13 = (void *)*((_QWORD *)v124[0] - 1);
      if ( (unsigned __int64)(v124[0] - v13 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v13);
  }
  sub_7FF7EE7A13D0(std::cin, (__int64)INPUT_2);
  v15 = sub_7FF7EE7A4120(std::cout, "Calculating......", v14);
  std::ostream::operator<<(v15, sub_7FF7EE7A42F0);
  LODWORD(v148) = 2;
  *(_OWORD *)v124 = 0i64;
  v125 = 0i64;
  COPY1((const void **)v124, 0i64, &v148);
  UPDATE1((__int64)v124);
  LODWORD(v148) = 3;
  *(_OWORD *)v122 = 0i64;
  v123 = 0i64;
  COPY1((const void **)v122, 0i64, &v148);
  UPDATE1((__int64)v122);
  v16 = MUL((__int64)Block, (__int64 *)INPUT_2, v122);// Block = 3*input2
  POW((__int64)&v158, (__int64 *)v16, v124);    // v16 = v16**2
  v17 = Block[0];
  if ( Block[0] )
  {
    if ( (unsigned __int64)(4 * ((Block[2] - Block[0]) >> 2)) >= 0x1000 )
    {
      v17 = (void *)*((_QWORD *)Block[0] - 1);
      if ( (unsigned __int64)(Block[0] - v17 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v17);
    memset(Block, 0, sizeof(Block));
  }
  v18 = v122[0];
  if ( v122[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v123 - (unsigned __int64)v122[0]) >> 2)) >= 0x1000 )
    {
      v18 = (void *)*((_QWORD *)v122[0] - 1);
      if ( (unsigned __int64)(v122[0] - v18 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v18);
  }
  v19 = v124[0];
  if ( v124[0] )
  {
    if ( (unsigned __int64)(4 * ((v125 - (char *)v124[0]) >> 2)) >= 0x1000 )
    {
      v19 = (void *)*((_QWORD *)v124[0] - 1);
      if ( (unsigned __int64)(v124[0] - v19 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v19);
  }
  sub_7FF7EE7A13D0(std::cin, (__int64)INPUT_3);
  sub_7FF7EE7A4120(std::cout, "Calculating............", v20);
  LODWORD(v148) = 7;
  *(_OWORD *)v122 = 0i64;
  v123 = 0i64;
  COPY1((const void **)v122, 0i64, &v148);
  UPDATE1((__int64)v122);
  v21 = MUL((__int64)Block, (__int64 *)v122, INPUT_3);// v21  = Block = 7*input3
  MUL((__int64)v160, (__int64 *)v21, INPUT_3);
  v22 = Block[0];
  if ( Block[0] )
  {
    if ( (unsigned __int64)(4 * ((Block[2] - Block[0]) >> 2)) >= 0x1000 )
    {
      v22 = (void *)*((_QWORD *)Block[0] - 1);
      if ( (unsigned __int64)(Block[0] - v22 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v22);
    memset(Block, 0, sizeof(Block));
  }
  v23 = v122[0];
  if ( v122[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v123 - (unsigned __int64)v122[0]) >> 2)) >= 0x1000 )
    {
      v23 = (void *)*((_QWORD *)v122[0] - 1);
      if ( (unsigned __int64)(v122[0] - v23 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v23);
  }
  v24 = (char *)INPUT_1[0];
  v25 = (INPUT_1[1] - INPUT_1[0]) >> 2;
  v26 = INPUT_3[0];
  v27 = (INPUT_3[1] - INPUT_3[0]) >> 2;
  v28 = (char *)INPUT_2[0];
  if ( v25 == v27 )
  {
    v30 = v25 - 1;
    if ( (int)v25 - 1 < 0 )
      goto LABEL_47;
    v31 = v30;
    v32 = (char *)INPUT_3[0] + 4 * v30;
    while ( *(_DWORD *)((char *)v32 + INPUT_1[0] - INPUT_3[0]) == *v32 )
    {
      --v30;
      --v32;
      if ( --v31 < 0 )
        goto LABEL_47;
    }
    v29 = *((_DWORD *)INPUT_1[0] + v30) < *((_DWORD *)INPUT_3[0] + v30);// input_1<input_3
  }
  else
  {
    v29 = v25 < v27;
  }
  if ( !v29 )
    goto LABEL_47;
  v35 = (INPUT_2[1] - INPUT_2[0]) >> 2;
  if ( v35 != v25 )
  {
    v36 = v35 < v25;
    goto LABEL_62;
  }
  v37 = v35 - 1;
  if ( (int)v35 - 1 < 0 )
  {
LABEL_47:
    v33 = -1;
    goto LABEL_48;
  }
  v38 = v37;
  v39 = (char *)INPUT_1[0] + 4 * v37;
  while ( *(_DWORD *)((char *)v39 + INPUT_2[0] - INPUT_1[0]) == *v39 )
  {
    --v37;
    --v39;
    if ( --v38 < 0 )
      goto LABEL_47;
  }
  v36 = *((_DWORD *)INPUT_2[0] + v37) < *((_DWORD *)INPUT_1[0] + v37);// input_2<input_1
LABEL_62:
  if ( !v36 )
    goto LABEL_47;
  LODWORD(v148) = 3;
  *(_OWORD *)v134 = 0i64;
  v135 = 0i64;
  COPY1((const void **)v134, 0i64, &v148);      // v134 = 3
  UPDATE1((__int64)v134);
  LODWORD(v148) = 2;
  *(_OWORD *)v132 = 0i64;
  v133 = 0i64;
  COPY1((const void **)v132, 0i64, &v148);      // v132 = 2
  UPDATE1((__int64)v132);
  LODWORD(v148) = 3;
  *(_OWORD *)v130 = 0i64;
  v131 = 0i64;
  COPY1((const void **)v130, 0i64, &v148);      // v130 = 3
  UPDATE1((__int64)v130);
  LODWORD(v148) = 3;
  *(_OWORD *)v128 = 0i64;
  v129 = 0i64;
  COPY1((const void **)v128, 0i64, &v148);      // v128 = 3
  UPDATE1((__int64)v128);
  v40 = MUL((__int64)&v142, (__int64 *)v134, INPUT_1);// v40 = 3*input1
  v41 = MUL((__int64)&v140, (__int64 *)v40, INPUT_1);// v41 = v40*input1 = 3*input1**2
  v42 = MUL((__int64)&v138, (__int64 *)v41, INPUT_2);// v42 = v41*input2 = 3*input1**2*input2
  v43 = POW((__int64)&v136, (__int64 *)INPUT_2, v132);// v43 = input2**2
  v44 = MUL((__int64)&v155, (__int64 *)v130, INPUT_1);// v44 = 3*input1
  v45 = MUL((__int64)&v145, (__int64 *)v44, (_QWORD *)v43);// v45 = v43*v44 = 3*input1*input2**2
  *(_OWORD *)v124 = 0i64;
  v125 = 0i64;
  v46 = INPUT_1[0];
  v47 = INPUT_1[1];
  if ( INPUT_1[0] != INPUT_1[1] )
  {
    v48 = (INPUT_1[1] - INPUT_1[0]) >> 2;
    if ( v48 <= 0x3FFFFFFFFFFFFFFFi64 )
    {
      v49 = 4 * v48;
      if ( v49 < 0x1000 )
      {
        if ( v49 )
          v52 = (char *)operator new(v49);
        else
          v52 = 0i64;
LABEL_73:
        v124[0] = v52;
        v124[1] = v52;
        v53 = &v52[v49];
        v125 = v53;
        memmove(v52, v46, v47 - (_BYTE *)v46);  // v52  = input1
        v124[1] = v53;
        goto LABEL_74;
      }
      if ( v49 + 39 > v49 )
      {
        v50 = operator new(v49 + 39);
        v51 = v50;
        if ( !v50 )
          invalid_parameter_noinfo_noreturn();
        v52 = (char *)(((unsigned __int64)v50 + 39) & 0xFFFFFFFFFFFFFFE0ui64);
        *((_QWORD *)v52 - 1) = v51;
        goto LABEL_73;
      }
    }
    sub_7FF7EE7A1110();
  }
LABEL_74:
  v54 = (__int64)ADD((__int64 *)Block, (char **)v124, INPUT_2);// v54 = v124+input2 = input1+input2
  v55 = POW((__int64)v144, (__int64 *)v54, v128);// V55 = V54**3
  v148 = v55;
  v56 = (__int64)COPY((__int64 *)v157, v45);    // v56 = v45 = 3*input1*input2**2
  v57 = SUB((char **)v55, v56);                 // v57 = v55-v56 = (input1+input2)**3-3*input1*input2**2
  COPY((__int64 *)v122, v57);                   // v122 = v57
  v58 = *(_QWORD **)v55;
  if ( *(_QWORD *)v55 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*(_QWORD *)(v55 + 16) - (_QWORD)v58) >> 2)) >= 0x1000 )
    {
      if ( (unsigned __int64)v58 - *(v58 - 1) - 8 > 0x1F )
        invalid_parameter_noinfo_noreturn();
      v58 = (_QWORD *)*(v58 - 1);
    }
    j_j_free(v58);
    *(_QWORD *)v55 = 0i64;
    *(_QWORD *)(v55 + 8) = 0i64;
    *(_QWORD *)(v55 + 16) = 0i64;
  }
  v126 = v122;
  v59 = (__int64)COPY(v147, v42);
  v60 = SUB((char **)v122, v59);                // v60 = v122-v42 = (input1+input2)**3-3*input1*input2**2-3*input1**2-input2
  COPY((__int64 *)v157, v60);                   // v157 = v60 等式的左边式子
  v61 = v122[0];
  if ( v122[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v123 - (unsigned __int64)v122[0]) >> 2)) >= 0x1000 )
    {
      v61 = (void *)*((_QWORD *)v122[0] - 1);
      if ( (unsigned __int64)(v122[0] - v61 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v61);
    *(_OWORD *)v122 = 0i64;
    v123 = 0i64;
  }
  v62 = Block[0];
  if ( Block[0] )
  {
    if ( (unsigned __int64)(4 * ((Block[2] - Block[0]) >> 2)) >= 0x1000 )
    {
      v62 = (void *)*((_QWORD *)Block[0] - 1);
      if ( (unsigned __int64)(Block[0] - v62 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v62);
    memset(Block, 0, sizeof(Block));
  }
  v63 = v145;
  if ( v145 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v146 + 1) - (_QWORD)v145) >> 2)) >= 0x1000 )
    {
      v63 = (_BYTE *)*((_QWORD *)v145 - 1);
      if ( (unsigned __int64)((_BYTE *)v145 - v63 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v63);
    v145 = 0i64;
    v146 = 0i64;
  }
  v64 = v155;
  if ( v155 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v156 + 1) - (_QWORD)v155) >> 2)) >= 0x1000 )
    {
      v64 = (_BYTE *)*((_QWORD *)v155 - 1);
      if ( (unsigned __int64)((_BYTE *)v155 - v64 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v64);
    v155 = 0i64;
    v156 = 0i64;
  }
  v65 = v136;
  if ( v136 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v137 + 1) - (_QWORD)v136) >> 2)) >= 0x1000 )
    {
      v65 = (_BYTE *)*((_QWORD *)v136 - 1);
      if ( (unsigned __int64)((_BYTE *)v136 - v65 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v65);
    v136 = 0i64;
    v137 = 0i64;
  }
  v66 = v138;
  if ( v138 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v139 + 1) - (_QWORD)v138) >> 2)) >= 0x1000 )
    {
      v66 = (_BYTE *)*((_QWORD *)v138 - 1);
      if ( (unsigned __int64)((_BYTE *)v138 - v66 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v66);
    v138 = 0i64;
    v139 = 0i64;
  }
  v67 = v140;
  if ( v140 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v141 + 1) - (_QWORD)v140) >> 2)) >= 0x1000 )
    {
      v67 = (_BYTE *)*((_QWORD *)v140 - 1);
      if ( (unsigned __int64)((_BYTE *)v140 - v67 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v67);
    v140 = 0i64;
    v141 = 0i64;
  }
  v68 = v142;
  if ( v142 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v143 + 1) - (_QWORD)v142) >> 2)) >= 0x1000 )
    {
      v68 = (_BYTE *)*((_QWORD *)v142 - 1);
      if ( (unsigned __int64)((_BYTE *)v142 - v68 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v68);
    v142 = 0i64;
    v143 = 0i64;
  }
  v69 = v128[0];
  if ( v128[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v129 - (unsigned __int64)v128[0]) >> 2)) >= 0x1000 )
    {
      v69 = (void *)*((_QWORD *)v128[0] - 1);
      if ( (unsigned __int64)(v128[0] - v69 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v69);
  }
  v70 = v130[0];
  if ( v130[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v131 - (unsigned __int64)v130[0]) >> 2)) >= 0x1000 )
    {
      v70 = (void *)*((_QWORD *)v130[0] - 1);
      if ( (unsigned __int64)(v130[0] - v70 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v70);
  }
  v71 = v132[0];
  if ( v132[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v133 - (unsigned __int64)v132[0]) >> 2)) >= 0x1000 )
    {
      v71 = (void *)*((_QWORD *)v132[0] - 1);
      if ( (unsigned __int64)(v132[0] - v71 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v71);
  }
  v72 = v134[0];
  if ( v134[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v135 - (unsigned __int64)v134[0]) >> 2)) >= 0x1000 )
    {
      v72 = (void *)*((_QWORD *)v134[0] - 1);
      if ( (unsigned __int64)(v134[0] - v72 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v72);
  }
  LODWORD(v148) = 22;
  *(_OWORD *)v128 = 0i64;
  v129 = 0i64;
  COPY1((const void **)v128, 0i64, &v148);      // v128 = 22
  UPDATE1((__int64)v128);
  LODWORD(v148) = 48;
  *(_OWORD *)v130 = 0i64;
  v131 = 0i64;
  COPY1((const void **)v130, 0i64, &v148);      // v130 = 48
  UPDATE1((__int64)v130);
  LODWORD(v148) = 12;
  *(_OWORD *)v132 = 0i64;
  v133 = 0i64;
  COPY1((const void **)v132, 0i64, &v148);      // v132 = 12
  UPDATE1((__int64)v132);
  LODWORD(v148) = 3;
  *(_OWORD *)v134 = 0i64;
  v135 = 0i64;
  COPY1((const void **)v134, 0i64, &v148);      // v134 = 3
  UPDATE1((__int64)v134);
  v126 = Block;
  v73 = MUL((__int64)&v136, (__int64 *)v130, INPUT_3);// V73 = 48*INPUT3
  v74 = MUL((__int64)&v138, (__int64 *)v132, INPUT_3);// V74 = 12*INPUT3
  v75 = MUL((__int64)&v140, (__int64 *)v74, INPUT_3);// V75 = 12*input3**2
  LODWORD(v148) = 4;
  memset(Block, 0, sizeof(Block));
  COPY1((const void **)Block, 0i64, &v148);
  UPDATE1((__int64)Block);
  v76 = (__int64)ADD((__int64 *)&v142, (char **)Block, INPUT_3);// v76 = input3+4
  v77 = (void **)POW((__int64)v147, (__int64 *)v76, v134);// v77 = (input3+4)**3
  v126 = v77;
  v78 = (__int64)COPY(v144, v75);
  v79 = SUB((char **)v77, v78);                 // v79 = v77-v75
  COPY((__int64 *)v122, v79);                   // v122 = v79 = (input3+4)**3-12*input3**2
  v80 = *v77;
  if ( *v77 )
  {
    if ( (unsigned __int64)(4 * (((_BYTE *)v77[2] - (_BYTE *)v80) >> 2)) >= 0x1000 )
    {
      if ( (unsigned __int64)v80 - *(v80 - 1) - 8 > 0x1F )
        invalid_parameter_noinfo_noreturn();
      v80 = (_QWORD *)*(v80 - 1);
    }
    j_j_free(v80);
    *v77 = 0i64;
    v77[1] = 0i64;
    v77[2] = 0i64;
  }
  v126 = v122;
  v81 = (__int64)COPY(v144, v73);               // v81 = 48*input3
  v82 = SUB((char **)v122, v81);                // v82 = v122-v81
  COPY((__int64 *)v124, v82);                   // v124  = v82
  v83 = v122[0];
  if ( v122[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v123 - (unsigned __int64)v122[0]) >> 2)) >= 0x1000 )
    {
      v83 = (void *)*((_QWORD *)v122[0] - 1);
      if ( (unsigned __int64)(v122[0] - v83 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v83);
    *(_OWORD *)v122 = 0i64;
    v123 = 0i64;
  }
  v126 = v124;
  v84 = (__int64)COPY(v144, (__int64)v128);     // v84 = 22
  v85 = SUB((char **)v124, v84);                // v85 = v124-22
  COPY((__int64 *)&v155, v85);                  // v155 = v85 = (input3+4)**3-12*input3**2-48*input3-22
  v87 = v124[0];
  if ( v124[0] )
  {
    if ( (unsigned __int64)(4 * ((v125 - (char *)v124[0]) >> 2)) >= 0x1000 )
    {
      v87 = (void *)*((_QWORD *)v124[0] - 1);
      if ( (unsigned __int64)(v124[0] - v87 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v87);
    *(_OWORD *)v124 = 0i64;
    v125 = 0i64;
  }
  v88 = v142;
  if ( v142 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v143 + 1) - (_QWORD)v142) >> 2)) >= 0x1000 )
    {
      v88 = (_BYTE *)*((_QWORD *)v142 - 1);
      if ( (unsigned __int64)((_BYTE *)v142 - v88 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v88);
    v142 = 0i64;
    v143 = 0i64;
  }
  v89 = v140;
  if ( v140 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v141 + 1) - (_QWORD)v140) >> 2)) >= 0x1000 )
    {
      v89 = (_BYTE *)*((_QWORD *)v140 - 1);
      if ( (unsigned __int64)((_BYTE *)v140 - v89 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v89);
    v140 = 0i64;
    v141 = 0i64;
  }
  v90 = v138;
  if ( v138 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v139 + 1) - (_QWORD)v138) >> 2)) >= 0x1000 )
    {
      v90 = (_BYTE *)*((_QWORD *)v138 - 1);
      if ( (unsigned __int64)((_BYTE *)v138 - v90 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v90);
    v138 = 0i64;
    v139 = 0i64;
  }
  v91 = v136;
  if ( v136 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v137 + 1) - (_QWORD)v136) >> 2)) >= 0x1000 )
    {
      v91 = (_BYTE *)*((_QWORD *)v136 - 1);
      if ( (unsigned __int64)((_BYTE *)v136 - v91 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v91);
    v136 = 0i64;
    v137 = 0i64;
  }
  v92 = v134[0];
  if ( v134[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v135 - (unsigned __int64)v134[0]) >> 2)) >= 0x1000 )
    {
      v92 = (void *)*((_QWORD *)v134[0] - 1);
      if ( (unsigned __int64)(v134[0] - v92 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v92);
  }
  v93 = v132[0];
  if ( v132[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v133 - (unsigned __int64)v132[0]) >> 2)) >= 0x1000 )
    {
      v93 = (void *)*((_QWORD *)v132[0] - 1);
      if ( (unsigned __int64)(v132[0] - v93 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v93);
  }
  v94 = v130[0];
  if ( v130[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v131 - (unsigned __int64)v130[0]) >> 2)) >= 0x1000 )
    {
      v94 = (void *)*((_QWORD *)v130[0] - 1);
      if ( (unsigned __int64)(v130[0] - v94 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v94);
  }
  v95 = v128[0];
  if ( v128[0] )
  {
    if ( (unsigned __int64)(4 * ((signed __int64)(v129 - (unsigned __int64)v128[0]) >> 2)) >= 0x1000 )
    {
      v95 = (void *)*((_QWORD *)v128[0] - 1);
      if ( (unsigned __int64)(v128[0] - v95 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v95);
  }
  v96 = (char *)v157[0];                        // v157: 1st poly
  v97 = (v157[1] - v157[0]) >> 2;
  v98 = (char *)v155;                           // v155: 2nd poly
  v26 = INPUT_3[0];
  if ( v97 == (__int64)(v156 - (_QWORD)v155) >> 2 )
  {
    v99 = v97 - 1;
    if ( (int)v97 - 1 < 0 )                     // v97==0
    {
LABEL_201:
      sub_7FF7EE7A4120(std::cout, "You win!\nflag{MD5(\"", v86);
      v103 = INPUT_1[0];
      v104 = INPUT_1[1];
      if ( INPUT_1[0] == INPUT_1[1] )
      {
        std::ostream::operator<<(std::cout, 0i64);
        v104 = INPUT_1[1];
        v103 = INPUT_1[0];
      }
      v105 = ((v104 - v103) >> 2) - 1;
      v106 = v105;
      if ( v105 >= 0 )
      {
        while ( 1 )
        {
          std::ostream::operator<<(std::cout, *(unsigned int *)&v103[4 * v106--]);
          if ( v106 < 0 )
            break;
          v103 = INPUT_1[0];
        }
      }
      v107 = INPUT_2[0];
      v108 = INPUT_2[1];
      if ( INPUT_2[0] == INPUT_2[1] )
      {
        std::ostream::operator<<(std::cout, 0i64);
        v108 = INPUT_2[1];
        v107 = INPUT_2[0];
      }
      v109 = ((v108 - v107) >> 2) - 1;
      v110 = v109;
      if ( v109 >= 0 )
      {
        while ( 1 )
        {
          std::ostream::operator<<(std::cout, *(unsigned int *)&v107[4 * v110--]);
          if ( v110 < 0 )
            break;
          v107 = INPUT_2[0];
        }
      }
      v111 = INPUT_3[1];
      if ( v26 == INPUT_3[1] )
        std::ostream::operator<<(std::cout, 0i64);
      v112 = ((v111 - v26) >> 2) - 1;
      for ( i = v112; i >= 0; std::ostream::operator<<(std::cout, *(unsigned int *)&v26[4 * i--]) )
        ;
      sub_7FF7EE7A4120(std::cout, "\").tolower()}\n", v102);
    }
    else
    {
      v100 = v99;
      v101 = (char *)v155 + 4 * v99;
      v86 = v157[0] - v155;
      while ( *(_DWORD *)((char *)v101 + v86) == *v101 )// cmp(v155,v157)
      {
        --v101;
        if ( --v100 < 0 )
          goto LABEL_201;
      }
    }
  }
  v33 = 0;
  if ( v98 )
  {
    v114 = v98;
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v156 + 1) - (_QWORD)v98) >> 2)) >= 0x1000 )
    {
      v98 = (char *)*((_QWORD *)v98 - 1);
      if ( (unsigned __int64)(v114 - v98 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v98);
  }
  if ( v96 )
  {
    v115 = v96;
    if ( (unsigned __int64)(4 * ((v157[2] - (void *)v96) >> 2)) >= 0x1000 )
    {
      v96 = (char *)*((_QWORD *)v96 - 1);
      if ( (unsigned __int64)(v115 - v96 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v96);
  }
  v24 = (char *)INPUT_1[0];
  v28 = (char *)INPUT_2[0];
LABEL_48:
  v34 = v160[0];
  if ( v160[0] )
  {
    if ( (unsigned __int64)(4 * ((v160[2] - v160[0]) >> 2)) >= 0x1000 )
    {
      v34 = (void *)*((_QWORD *)v160[0] - 1);
      if ( (unsigned __int64)(v160[0] - v34 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v34);
    v24 = (char *)INPUT_1[0];
    v28 = (char *)INPUT_2[0];
  }
  v116 = v158;
  if ( v158 )
  {
    if ( (unsigned __int64)(4 * ((__int64)(*((_QWORD *)&v159 + 1) - (_QWORD)v158) >> 2)) >= 0x1000 )
    {
      v116 = (_BYTE *)*((_QWORD *)v158 - 1);
      if ( (unsigned __int64)((_BYTE *)v158 - v116 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v116);
    v158 = 0i64;
    v159 = 0i64;
    v24 = (char *)INPUT_1[0];
    v28 = (char *)INPUT_2[0];
  }
  v117 = v161[0];
  if ( v161[0] )
  {
    if ( (unsigned __int64)(4 * ((v161[2] - v161[0]) >> 2)) >= 0x1000 )
    {
      v117 = (void *)*((_QWORD *)v161[0] - 1);
      if ( (unsigned __int64)(v161[0] - v117 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v117);
    v24 = (char *)INPUT_1[0];
    v28 = (char *)INPUT_2[0];
  }
  if ( v26 )
  {
    v118 = v26;
    if ( (unsigned __int64)(4 * ((v154 - (__int64)v26) >> 2)) >= 0x1000 )
    {
      v26 = (_BYTE *)*((_QWORD *)v26 - 1);
      if ( (unsigned __int64)(v118 - v26 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v26);
    v24 = (char *)INPUT_1[0];
    v28 = (char *)INPUT_2[0];
  }
  if ( v28 )
  {
    v119 = v28;
    if ( (unsigned __int64)(4 * ((v152 - (__int64)v28) >> 2)) >= 0x1000 )
    {
      v28 = (char *)*((_QWORD *)v28 - 1);
      if ( (unsigned __int64)(v119 - v28 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v28);
    *(_OWORD *)INPUT_2 = 0i64;
    v152 = 0i64;
    v24 = (char *)INPUT_1[0];
  }
  if ( v24 )
  {
    v120 = v24;
    if ( ((v150 - (_QWORD)v24) & 0xFFFFFFFFFFFFFFFCui64) >= 0x1000 )
    {
      v24 = (char *)*((_QWORD *)v24 - 1);
      if ( (unsigned __int64)(v120 - v24 - 8) > 0x1F )
        invalid_parameter_noinfo_noreturn();
    }
    j_j_free(v24);
  }
  return v33;
}

最后是两个式子的cmp check
即

按照题目要求 input2<input1<input3
排序后连起来md5即可
flag{951e27be2b2f10b7fa22a6dc8f4682bd}