The `main` program provides a fake flag(uiuctf{v3Ry_r341\_@rTT}), but by looking into the pointers to the fake flag, I found some weird strings at 0x555555554f80 to 0x55555555505f.
Also, the fake flag string is referenced at 0x55555555491a. And this func_91a is called at 0x555555554a5a. 
So, this func_a5a xor each byte from 0x555555554973 to 0x555555554973+0x7e with a constant value returned by func_91a. However, the xor-ed part is in a RX segment and is not writable, so I manually edit the code by python.
```f = open("ReddsArt_raw.bin", "rb")code = f.read()f.close()
# print hexdump(code[0x973:])header = code[0:0x973]body = code[0x973:0x973 + 0xe7]footer = code[0x973 + 0xe7:]new_body = "".join([chr(ord(x) ^ 0x1e) for x in body])new_code = header + new_body + footer
new_f = open("new_ReddsArt", "wb")new_f.write(new_code)new_f.close()```Now ghidra gives the disassembly code and decompiled code at 0x555555554973. Here's the psudocode:```void magic(void)
{  char cVar1;  size_t sVar2;  ulong uVar3;  int local_2c;  int local_28;   cVar1 = *(char *)((long)cRam0000000000000009 + 9);  local_2c = 0;  while( true ) {    sVar2 = strlen(PTR_s_hthzgubI>*ww7>z+Ha,m>W,7z+hmG`_555555756028);    if (sVar2 <= (ulong)(long)local_2c) break;    PTR_s_hthzgubI>*ww7>z+Ha,m>W,7z+hmG`_555555756028[local_2c] =         PTR_s_hthzgubI>*ww7>z+Ha,m>W,7z+hmG`_555555756028[local_2c] + cVar1;    local_2c = local_2c + 1;  }  uVar3 = FUN_55555555491a();  local_28 = 0;  while( true ) {    sVar2 = strlen(PTR_s_hthzgubI>*ww7>z+Ha,m>W,7z+hmG`_555555756028);    if (sVar2 <= (ulong)(long)local_28) break;    PTR_s_hthzgubI>*ww7>z+Ha,m>W,7z+hmG`_555555756028[local_28] =         PTR_s_hthzgubI>*ww7>z+Ha,m>W,7z+hmG`_555555756028[local_28] ^ (byte)uVar3;    local_28 = local_28 + 1;  }  return;}```
Basically the code does 2 things on string 0x555555554fc0, first each char is added to cVar1, then each char is xor-ed with uVar3. 
From the disassembly, I'm not sure if I did this correctly, but there's a line of `movzx eax, byte ptr [9]` at 0x555555554988, and this is relavent to cVar1. So I write this script to bruteforce all 0x100 cases of cVar1 and got the flag.
```from pwn import *
def str_len(content):    length = 0    for x in content:        if x == "\x00":            return length        else:            length += 1    return length
f = open("ReddsArt_raw.bin", "rb")code = f.read()f.close()
# print hexdump(code[0x973:])header = code[0:0x973]body = code[0x973:0x973 + 0xe7]footer = code[0x973 + 0xe7:]
new_body = "".join([chr(ord(x) ^ 0x1e) for x in body])
new_code = header + new_body + footer
new_header = new_code[:0xfc0]new_body = new_code[0xfc0:0xfc0 + 0x1e]new_footer = new_code[0xfc0 + 0x1e:]
# new_body is "hthzgubI>*ww7>z+Ha,m>W,7z+hmG`"original = new_body[::]
uVar3 = 0x1efor cVar1 in range(0, 0x100):    tmp = list(original)    local_2c = 0    while True:        sVar2 = str_len(tmp)        if sVar2 <= local_2c:            break        else:            tmp[local_2c] = chr((ord(tmp[local_2c]) + cVar1) % 0x100)            local_2c += 1
    local_2c = 0    while True:        sVar2 = str_len(tmp)        if sVar2 <= local_2c:            break        else:            tmp[local_2c] = chr(ord(tmp[local_2c]) ^ uVar3)            local_2c += 1
    outcome = "".join(tmp)    if "uiuc" in outcome or "UIUC" in outcome:        print outcome
```