It reads the input flag from R08 at 60B4, then XOR it to 0x17f, loads R09 from somewhere in memory, adds the XOR result to 0(which was another memory), and finally stored the result to R09.

0x17f is a number from a table created by initialize function.

Fortunately, it didn’t change by modifying the input data. So, we can save them by setting a breakpoint on 60BA where the program wants to XOR input data with the key to collect them.

After we dumped it, we had to find the correct sequence of data. 60E4 was the first comparison routine, then 60FB, and so.
What I did was fix the content of the memory before each comparison.

After collecting the correct data, I wrote a python script to bruteforce the flag, so after some correction, I got the flag:
```
key = [
0x17f, 0x183, 0x193, 0x60, 0x4a, 0x1f6, 0xbc, 0xe, 0x103,
0x12f, 0x1d3, 0x1e1, 0xa3, 0x130, 0x15a, 0x175, 0x7, 0x162,
0x159, 0x129, 0x93, 0x1be, 0xcc, 0x16b, 0x2, 0x22, 0x27
]

dat = [
0x117, 0x101, 0x0e8, 0x0eb, 0x110, 0x0a8, 0x16f, 0x1a7, 0x10e,
0x02d, 0x1e2, 0x166, 0x1fa, 0x103, 0x03f, 0x186, 0x1bc, 0x111,
0x071, 0x189, 0x02d, 0x1b8, 0x060, 0x16f, 0x1d2, 0x031, 0x05e
]

flag = 'h'
for idx, c in enumerate(key):
for c in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+_-{}":
if (((ord(c) ^ key[idx]) + dat[idx-1]) & 0b111111111) == dat[idx]:
flag += c
print flag

#hitcon{6d0fe79f2179175dda}
```