Solves the re2 by running it under the debugger and extracting the relevant info

re2_solver.py

import r2pipe
import re

output = False

def p(sth):
        global output
        if output:
                print sth

r2 = r2pipe.open("./re2")

r2.cmd('aaaa')
r2.cmd('e dbg.profile=re2.rr2')

r2.cmd('doo')

maps = r2.cmd('dm')
print maps
print "Addr: "
a = input()

addr = int(a)

r2.cmd('db '+str(addr+0x7fB))

flag = ['*']*50#
r2.cmd('dc')
bajt = ""
while 1:
   offset = 0
   bajt = [None]*8
   for i in range(8):
        rax = int(r2.cmd('dr? eax'),16)
        p("rax="+str(rax))
        r2.cmd('ds')
        offset = int(r2.cmd('dr? eax'),16) - rax
        if offset < 0:
            offset = 0
            r2.cmd('ds')
        else:
            r2.cmd('ds 2')
        p("offset="+str(offset))

        ins = r2.cmd('pi 1 @rip')
        p("ins="+ins)
        if "sar" in ins:
                m = re.match("sar eax, ((0x)?[0-9]+)", ins)

                bit = int(m.group(1), 16)
                r2.cmd('ds')
        else:
                bit = 0

        r2.cmd('ds 2')
        ins = r2.cmd('pi 1 @rip')
        p("ins="+ins)
        rip = r2.cmd('dr? rip')
        p("rip="+rip)
        state = re.match("cmp dword \[rbp - 4\], ((0x)?[0-9a-fA-F]+)", ins)
        p("state="+state.group(1))
        bajt[int(bit)] = state.group(1)
        r2.cmd('ds')
        r2.cmd('dr zf=1')
        r2.cmd('ds 2')

   c = chr(int('0b'+''.join(bajt)[::-1],2))
   flag[offset]=c
   print (''.join(flag))