Solved using pwntools. Leak base of libmylib, use got of loss function to redirect execution to win.

Original writeup (https://anee.me/gotmilk-csaw-ctf-quals-2019-c6eaacc431e9).