xor bruteforce the given flag to get the offset then the flag is scrambled in chunks of 4, unscrambled it to get the flag