[ArC]

The keys are 0x45584554CF4F4C52 and 0x455845544F4F4C53.


SPOILERS AHEAD


The key observation is that each round has the following transformation pattern:

0...0 -> 0...0       k_n -> k' (with k_n being the key for round n and k' := a ^ b in the original algorithm)
  0...0 -> 0...0       k_n -> k_{n+1} (with k_{n+1} := k_n ^ k')

1...0 -> 0...1
  1...0 -> 1...1

0...1 -> 1...0
  0...1 -> 1...1

1...1 -> 1...1
  1...1 -> 0...0

So in other words, after each round k_n(s_n) = k_n(0) (with s_n being the amount to shift for round n). k_{n-1} can be deduced from k_n(s_n) (or k_n(0)) and k_n(s_{n-1}) by matching the patterns outlined in the table above. For k_0 we can then match two patterns which is why there're two valid keys.

Some special care needs to be taken for rounds with zero shifts as these are effectively NOPs.