Rating:

![](https://blog-1309321804.cos.ap-nanjing.myqcloud.com/blog/re.png)

The flag appears at a fixed position in the function, and you can use IDAPYTHON to iterate.
```python
import idautils
adr=0x0000000000001161
for i in range(999):
tmp=adr+0x28
next=Dword(adr+0x35)+adr+0x39
a=Byte(tmp)
if a!=0:
print(chr(a),end='')
adr=next&0xffff
```