Admittedly this one wasn't an interesting process as I didn't have access to any windows boxes or VM's. So it was quickly done in radare2.
$ r2 cannotberun > s sym.main
Used '<' and '>' hotkeys in radare2 to step through the code a bit, and found an interesting looking block (About 7 pages down):
0000:04f4 40 inc ax 0000:04f5 0938 or word [bx + si], di 0000:04f7 c6400a31 mov byte [bx + si + 0xa], 0x31 ; [0x31:1]=0 ; '1' 0000:04fb c6400b66 mov byte [bx + si + 0xb], 0x66 ; [0x66:1]=32 ; 'f' 0000:04ff c6400c73 mov byte [bx + si + 0xc], 0x73 ; [0x73:1]=10 ; 's' 0000:0503 c6400d67 mov byte [bx + si + 0xd], 0x67 ; [0x67:1]=114 ; 'g' 0000:0507 c6400e36 mov byte [bx + si + 0xe], 0x36 ; [0x36:1]=0 ; '6' 0000:050b ff15 call word [di] unk(unk, unk) ; section_end..text
Doesn't look big enough to be a flag, but let's try shifting around a little. I usually play with left and arrow keys to see if alignment issues are in place. In this case, it seemed like there were. You'll see the result after shifting to the right amount below:
0000:04d0 c60037 mov byte [bx + si], 0x37 ; [0x37:1]=0 ; '7' 0000:04d3 c6400161 mov byte [bx + si + 1], 0x61 ; [0x61:1]=39 ; 'a' 0000:04d7 c6400233 mov byte [bx + si + 2], 0x33 ; [0x33:1]=0 ; '3' 0000:04db c6400335 mov byte [bx + si + 3], 0x35 ; [0x35:1]=0 ; '5' 0000:04df c6400468 mov byte [bx + si + 4], 0x68 ; [0x68:1]=117 ; 'h' 0000:04e3 c6400578 mov byte [bx + si + 5], 0x78 ; [0x78:1]=36 ; 'x' 0000:04e7 c6400662 mov byte [bx + si + 6], 0x62 ; [0x62:1]=116 ; 'b' 0000:04eb c6400739 mov byte [bx + si + 7], 0x39 ; [0x39:1]=0 ; '9' 0000:04ef c6400871 mov byte [bx + si + 8], 0x71 ; [0x71:1]=63 ; 'q' 0000:04f3 c6400938 mov byte [bx + si + 9], 0x38 ; [0x38:1]=0 ; '8' 0000:04f7 c6400a31 mov byte [bx + si + 0xa], 0x31 ; [0x31:1]=0 ; '1' 0000:04fb c6400b66 mov byte [bx + si + 0xb], 0x66 ; [0x66:1]=32 ; 'f' 0000:04ff c6400c73 mov byte [bx + si + 0xc], 0x73 ; [0x73:1]=10 ; 's' 0000:0503 c6400d67 mov byte [bx + si + 0xd], 0x67 ; [0x67:1]=114 ; 'g' 0000:0507 c6400e36 mov byte [bx + si + 0xe], 0x36 ; [0x36:1]=0 ; '6'
This Looked more promising.
Pasted this in vim, and did the following to clean the data:
%s/; //g %s/'//g %s/\n//g
Wrap this data in the flag format, and we've got a valid flag!
MMA{7a35hxb9q81fsg6}
