# TI-83 Beta (68 solves)
> Hey I'm building a new calculator! I hid a flag inside it, think you can find it? Author: nadrojisk
We are given a windows executable.  The flag is in `SEH` exception handler that was registered in main function:
```.text:004124D0 ; int __cdecl main_0(int argc, const char **argv, const char **envp).text:004124D0 _main_0         proc near               ; CODE XREF: _main↑j.text:004124D0.text:004124D0 var_C0          = byte ptr -0C0h.text:004124D0 argc            = dword ptr  8.text:004124D0 argv            = dword ptr  0Ch.text:004124D0 envp            = dword ptr  10h.text:004124D0.text:004124D0                 push    ebp.text:004124D1                 mov     ebp, esp.text:004124D3                 sub     esp, 0C0h.text:004124D9                 push    ebx.text:004124DA                 push    esi.text:004124DB                 push    edi.text:004124DC                 lea     edi, [ebp+var_C0].text:004124E2                 mov     ecx, 30h.text:004124E7                 mov     eax, 0CCCCCCCCh.text:004124EC                 rep stosd.text:004124EE                 push    offset sub_4111A9	; <- exception handling func.text:004124F3                 push    large dword ptr fs:0 ; char.text:004124FA                 mov     large fs:0, esp.text:00412501                 push    offset aWelcomeToMyPro ; "Welcome to my program!\n".text:00412506                 call    print.text:0041250B                 add     esp, 4```
The exception handler is a bit obfuscated so IDA could not create a function from it. The flag is being create on stack one byte at the time. 
```.text:00412560 loc_412560:                             ; CODE XREF: sub_4111A9↑j.text:00412560                 push    ebp.text:00412561                 mov     ebp, esp.text:00412563                 sub     esp, 0C0h.text:00412569                 push    ebx.text:0041256A                 push    esi.text:0041256B                 push    edi.text:0041256C                 lea     edi, [ebp-0C0h].text:00412572                 mov     ecx, 30h ; '0'.text:00412577                 mov     eax, 0CCCCCCCCh.text:0041257C                 rep stosd.text:0041257E                 xor     eax, eax.text:00412580                 jz      short loc_412584.text:00412580 ; ---------------------------------------------------------------------------.text:00412582                 db 0EAh ; ê.text:00412583                 db  58h ; X.text:00412584 ; ---------------------------------------------------------------------------.text:00412584.text:00412584 loc_412584:                             ; CODE XREF: .text:00412580↑j.text:00412584                 mov     eax, 0.text:00412589                 sub     esp, 20h.text:0041258C                 mov     byte ptr [esp], 61h ; 'a'.text:00412590                 mov     byte ptr [esp+1], 75h ; 'u'.text:00412595                 mov     byte ptr [esp+2], 63h ; 'c'.text:0041259A                 mov     byte ptr [esp+3], 74h ; 't'.text:0041259F                 mov     byte ptr [esp+4], 66h ; 'f'.text:004125A4                 mov     byte ptr [esp+5], 7Bh ; '{'.text:004125A9                 mov     byte ptr [esp+6], 6Fh ; 'o'.text:004125AE                 xor     eax, eax.text:004125B0                 jz      short loc_4125B4.text:004125B0 ; ---------------------------------------------------------------------------.text:004125B2                 db 0EAh ; ê.text:004125B3                 db  58h ; X.text:004125B4 ; ---------------------------------------------------------------------------.text:004125B4.text:004125B4 loc_4125B4:                             ; CODE XREF: .text:004125B0↑j.text:004125B4                 mov     byte ptr [esp+7], 6Fh ; 'o'.text:004125B9                 mov     byte ptr [esp+8], 70h ; 'p'.text:004125BE                 mov     byte ptr [esp+9], 73h ; 's'.text:004125C3                 mov     byte ptr [esp+0Ah], 5Fh ; '_'.text:004125C8                 mov     byte ptr [esp+0Bh], 64h ; 'd'.text:004125CD                 mov     byte ptr [esp+0Ch], 69h ; 'i'.text:004125D2                 mov     byte ptr [esp+0Dh], 64h ; 'd'.text:004125D7                 mov     byte ptr [esp+0Eh], 5Fh ; '_'.text:004125DC                 mov     byte ptr [esp+0Fh], 69h ; 'i'.text:004125E1                 mov     byte ptr [esp+10h], 5Fh ; '_'.text:004125E6                 mov     byte ptr [esp+11h], 64h ; 'd'.text:004125EB                 mov     byte ptr [esp+12h], 6Fh ; 'o'.text:004125F0                 mov     byte ptr [esp+13h], 5Fh ; '_'.text:004125F5                 mov     byte ptr [esp+14h], 74h ; 't'.text:004125FA                 mov     byte ptr [esp+15h], 68h ; 'h'.text:004125FF                 mov     byte ptr [esp+16h], 74h ; 't'.text:00412604                 mov     byte ptr [esp+17h], 7Dh ; '}'.text:00412609                 mov     byte ptr [esp+18h], 0Ah.text:0041260E                 mov     byte ptr [esp+19h], 0.text:00412613                 push    esp.text:00412614                 call    print```
`auctf{oops_did_i_do_tht}`