The binary ask for a 64 bytes password then replace the last \n with a null byte. The buffer is stored at address 0x412000. Then comes a huge amount of operation on this buffer using xor, add,sub,ror and rol opcodes. The final result is compared to 64 bytes stored at address 0x412050, if it matches, we won.
The dirty way to solve it, is to start from the 64 bytes at 0x412050 and reverts all operations.Here is the quick and dirty code:
```pythonfrom pwn import *from capstone import *
def process_operands(ods):    Os = ods.split(", ")    nOs = []    for o in Os:        if "ptr" in o:            address = int(o[o.index('[')+1:o.index("]")],16)            newo = o.replace("ptr","")            if address != 0x412090:                off = address - 0x412000                newo = newo.replace(hex(address),"var + "+str(off))            nOs.append(newo)        else:            nOs.append(o)    return ", ".join(nOs)
# get .text and .dataBIN = ELF("./runofthemill")text = BIN.get_section_by_name(".text").data()data = BIN.get_section_by_name(".data").data()data = data[0x50:0x90]
# disassemble .textmd = Cs(CS_ARCH_X86, CS_MODE_64)asm = []for i in md.disasm(text, 0x401000):    if i.address > 0x401051 and i.address < 0x4117f7:        asm.append((i.mnemonic,i.op_str))
# reverse all opsasm = asm[::-1]out = []i = 0while i < len(asm):    oc, ods = asm[i]     ods = process_operands(ods)     if oc == "sub":        out.append("add  "+ods)    elif oc == "add":        out.append("sub  "+ods)    elif oc == "ror":        out.append("rol  "+ods)    elif oc == "rol":        out.append("ror  "+ods)    elif oc == "movq":        const = asm[i+4][1].split(", ")[1]        ods = ods.replace("mm0","rbx")        out.append("mov rbx, "+const)        out.append("xor  "+ods)        i += 4    elif oc == "movabs":        out.append("mov  "+ods)    else:        out.append(oc+"  "+ods)    i += 1 newasm = """global _startsection .text    
_start:    %s     mov rax,1    mov rdi,1    mov rsi, var    mov rdx, 0x41    syscall    mov rax, 0x3c    mov rdi, 0    syscall
section .data    var db """ % "\n    ".join(out) for b in data:    newasm += str(int(b))+", "newasm += "10, 0\n"
f = open("reverse.asm","w")f.write(newasm)f.close()
```Results:```python exploit.pynasm -felf64 reverse.asm -o reverse.old -o reverse reverse.o -m elf_x86_64./reverse DrgnS{SoManyInstructionsYetSoWeak}
```