LCG-XOR: small seed, big leak

We encrypted a secret flag with a custom keystream XOR. The keystream is generated by a 16-bit Linear Congruential Generator (LCG). The LCG parameters are known, but the 16-bit seed is secret. Your goal is to recover the flag.

LCG parameters used:

a = 1103515245

c = 12345

modulus = 2^16 (so outputs are 16-bit)

Keystream bytes: each LCG output is written as big-endian 2 bytes and those bytes are XORed with the flag bytes.

Flag format: ProblemStack{...}