Very fun challenge. We were the only team solving this challenge. We did exactly as described in the writeup excluding recognizing the RC4, but rather XORing the calculated value of a full 0 input with the constant ciphertext included in cipher.bin.

This is the VM documentation we came up with: https://pad.informatik.sexy/xWycsC2hSYusUMu-1YDm2Q#
This is our disassembler: https://gist.github.com/M4GNV5/5d72cb1301797b6efe488eb8c59b5aae