Similar to zwiebel, decrypted code in ida using `idc` script. Then wrote a pintool to keep `ecx` 0 for jumps and collect condition for flag bytes.
![solve](https://gist.githubusercontent.com/sudhackar/ad9c15851f274b3248ef1645abee9ae8/raw/ce857ac93e1da9f3eecf80c76a68a05f4ad32020/zwiebel-revenge.png)