The Obfuscated Check

A login page validates the password in JavaScript (never do this). The check is below. Work out the password it accepts — that's the flag.

function check(p) {
  if (p.length !== 26) return false;
  const x = [...p].map(c => c.charCodeAt(0) ^ 0x2a);
  const want = [100,111,122,105,95,89,93,65,95,65,89,95,67,65,119,89,91,65,95,82,65,106,65,95,67,71];
  return x.every((v, i) => v === want[i]);
}

(The real flag matches the pattern NEPSEC{...} once you reverse the XOR.)