smc

void __usercall sub_411244(unsigned __int8 a1@<al>, unsigned __int16 a2@<dx>, int a3@<edi>)
{
  sub_4117A0(a1, a2, a3);
}//此处是被加密后的函数

#include <idc.idc>

static main()
{
    auto addr = 0x004117A0;
    auto i = 0;
    for(i=0;i<171;i++)
    {
        PatchByte(addr+i,Byte(addr+i)^(-18));
    }
}//可以通过idc脚本来解密,解密后需要手动找到对应的位置进行代码转化，ida可能识别不到对应的是个函数 用p键对准函数头来将其识别为函数

int __cdecl sub_4117A0(int a1, int a2)
{
  int result; // eax
  int i; // [esp+D0h] [ebp-20h]

  __CheckForDebuggerJustMyCode(&unk_41C0A2);
  for ( i = 0; ; ++i )
  {
    result = i;
    if ( i >= a2 )
      break;
    *(_BYTE *)(i + a1) = ((*(_BYTE *)(i + a1) | ~*(_BYTE *)(a1 + (i + 1) % a2)) & (*(_BYTE *)(a1 + (i + 1) % a2) | ~*(_BYTE *)(i + a1)))
                       + 1;
  }
  return result;
}//解密后的加密过程

pythonz3解题方法如下

from z3 import *
a=[0x90,0xA0,0xF8,0x93,0x8F,0xF8,0xF3,0xF2,
    0xE7,0x9F,0xFB,0x8F,0xE9,0x00,0xEB,0xE6,
    0xED,0xEE,0xED,0xF4,0xEE,0xE1,0xFD,0xE3,
    0xE7,0xFC,0xE3,0x00,0x9A,0x00,0x9B,0x39]
flag =[BitVec('flag[%2d]' % i, 8) for i in range(32)]
out=[0]*32
for i in range(32):
    out[i]=flag[i]
f=Solver()
for i in range(32):
    out[i]=((out[i]|~out[(i+1)%32])&(out[(i+1)%32]|~out[i]))+1#注意括号，因为运算符号顺序不同括号很重要！
    f.add(out[i]==a[i])
while(f.check()==sat):
    condition = []
    m = f.model()
    p=""
    for i in range(32):
        p+=chr(int("%s" % (m[flag[i]])))
        condition.append(flag[i]!=int("%s" % (m[flag[i]])))
    print(p)
    f.add(Or(condition))

答案为

B2RZ7FNCMT50AVVCYJXKGUJITMITT22W