The binary is a flag printer - but it takes a lot of time process the input which is under layers of xor.The binary `realloc`s a buffer for which size is multiplied by 2 many times. With time this operation gets costly or probably oob and null ptr derefernceA simple way is to patch the multiplication to addition of 32 - the length of the flag.Or just F5(decompile) in IDA copy, edit and rebuild since the decompilation was neat.
```c#include <stdio.h>#include <stdlib.h>#include <string.h>
void shuffle(char *s, int seed, int mul) {  srand(seed);  int v6 = 0LL, v7 = 0, v4 = 0;  for (int i = 0; i <= 31; ++i) {    v7 = rand() + v6;    v6 *= mul;    v4 = s[v7 % 32];    s[v7 % 32] = s[v6 % 32];    s[v6 % 32] = v4;  }}char res[0x200];unsigned long long v3[4];int main() {  char *s = "actf{l_plus_ratio_plus_no_flags}";  char *orig = strdup(s);  int ops[] = {7, 2, 3, 2, 2, 6, 2, 9, 2, 6, 2, 2, 1, 2};  int residx = 0;  for (int o = 0; o < sizeof(ops) / sizeof(*ops); o++) {    if (ops[o] == 2) {      memcpy(&res[32 * residx++], orig, 0x20);    } else if (ops[o] == 3) {      shuffle(orig, 2, 2);    } else if (ops[o] == 6) {      shuffle(orig, 0, 0);    } else if (ops[o] == 1) {      shuffle(orig, 1, 1);    } else if (ops[o] == 9) {      for (int i = 0; i < sizeof(res) / sizeof(*res); i++) {        res[i] *= 9;      }    }  }  for (int i = 0; i < 0x20; i++) {      orig[i] = 0;  }  for (int i = 0; i < 0x200; i++) {    orig[i % 32] ^= res[i];  }  v3[0] = 0x5646564D6104635FULL;  v3[1] = 0xD2DA506ACC801521ULL;  v3[2] = 0x660A7262DAB5E734ULL;  v3[3] = 0x8C0A3EFC87E57E8CULL;  char *x = (char *)v3;  for (int i = 0; i <= 31; ++i)    orig[i] ^= x[i];  printf("%32s\n", orig);}```