Skip to main content

Obfuscation: Constant (C-String)

R5AC uses a simple XOR algorithm where the decryption key length and encrypted content length are identical.

Here is an example of automated decryption:K32GetMappedFileNameA

VirtualQuery

GetLastError

VirtualProtect

OpenSCManagerA


OpenServiceA


QueryServiceStatusEx

Looking

CloseServiceHandle

for

WideCharToMultiByte

pattern

RtlCaptureStackBackTrace

in

 0x1000-0xdacd000

Data ----------> 1aa2691
Key ----------> 1aa2770
KO: 4
[0x20e9f0] Decoded string: CS_CEngineClient::Engine_SetViewAngles
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x20ea35] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x20ea60] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x20ec61] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x20edd0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x20ee00] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x20efc1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x20f0f0] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x20f160] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x20f331] Decoded string: .dll
Data ----------> 1aa2811
Key ----------> 1aa2750
KO: 5
[0x22ee01] Decoded string: VTP_GetEngineTraceClient
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x22ee51] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x22ee81] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x22f031] Decoded string: .dll
Data ----------> 1aa2611
Key ----------> 1aa27b0
KO: 5
[0x22f271] Decoded string: VTP_GetEngineTraceClientDecals
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x22f2c1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x22f2f1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x22f4a1] Decoded string: .dll
Data ----------> 2791311
Key ----------> 27916a0
KO: 4
[0x26c540] Decoded string: CS_CNetChan::SetTimeout
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x26c585] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x26c5b0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26c7b1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x26c920] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x26c950] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26cb11] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x26cc30] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x26cca0] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26ce71] Decoded string: .dll
Data ----------> 27914f1
Key ----------> 2791560
KO: 4
[0x26dfe0] Decoded string: CS_CNetChan::SendReliableMessages
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x26e025] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x26e050] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26e251] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x26e3c0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x26e3f0] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26e5b1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x26e6e0] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x26e750] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26e921] Decoded string: .dll
Data ----------> 2791520
Key ----------> 2791541
KO: 5
[0x270511] Decoded string: CS_CNetChan::SendDatagram
Data ----------> 1aa2680
Key ----------> 1aa2739
KO: 5
[0x270551] Decoded string: KERNEL32.dll
Data ----------> 1aa2720
Key ----------> 27912d1
KO: 5
[0x270581] Decoded string: K32GetMappedFileNameA
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x2707a1] Decoded string: .dll
Data ----------> 1aa2798
Key ----------> 1aa2701
KO: 5
[0x2708e4] Decoded string: KERNEL32.dll
Data ----------> 1aa2630
Key ----------> 1aa26f1
KO: 5
[0x270911] Decoded string: VirtualQuery
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x270af1] Decoded string: .dll
Data ----------> 1aa2640
Key ----------> 1aa27d1
KO: 5
[0x270c13] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 1aa25f8
Key ----------> 2791301
KO: 5
[0x270c81] Decoded string: GetLastError
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x270e61] Decoded string: .dll
Data ----------> 2791651
Key ----------> 2791330
KO: 5
[0x2744c1] Decoded string: CS_CNetChan::SendNetMsg
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x274502] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x274531] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x274734] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x274891] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x2748c1] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x274a84] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0x274ba1] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x274c11] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x274de4] Decoded string: .dll
Data ----------> 27914d1
Key ----------> 2791670
KO: 4
[0x275210] Decoded string: CS_CNetChan::SendData
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x275255] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x275280] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x275481] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x2755f0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x275620] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x2757e1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x275900] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x275970] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x275b41] Decoded string: .dll
Data ----------> 27916e1
Key ----------> 2791700
KO: 5
[0x2f1cc2] Decoded string: EOSSDK-Win64-Shipping.dll
Data ----------> 2791739
Key ----------> 2791808
KO: 5
[0x3a3e51] Decoded string: ntdll.dll
Data ----------> 2791721
Key ----------> 27917a0
KO: 5
[0x3a3e81] Decoded string: wine_get_version
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x3a43a1] Decoded string: .dll
Data ----------> 2791771
Key ----------> 2791750
KO: 4
[0x3ae540] Decoded string: CS_Playlist_GetPlaylistVar
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x3ae585] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x3ae5b0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x3ae7a1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x3ae8f4] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x3ae920] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x3aeae1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x3aec00] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x3aec70] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x3aee41] Decoded string: .dll
Data ----------> 2791881
Key ----------> 2791860
KO: 5
[0x479351] Decoded string: VTP_GetFilesystemInterface
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x4793a1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x4793d1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x479581] Decoded string: .dll
Data ----------> 27919f1
Key ----------> 2791c10
KO: 4
[0x541f93] Decoded string: ntdll.dll
Data ----------> 2791a81
Key ----------> 2791bb0
KO: 4
[0x541fc0] Decoded string: RtlCaptureStackBackTrace
Data ----------> 27919c1
Key ----------> 2791b78
KO: 4
[0x541ff0] Decoded string: KERNEL32.dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x5421b0] Decoded string: .dll
Data ----------> 2791b21
Key ----------> 2791c20
KO: 5
[0x542551] Decoded string: steamnetworkingsockets.dll
Data ----------> 2791b61
Key ----------> 2791ac0
KO: 5
[0x542691] Decoded string: steam_api64.dll
Data ----------> 2791bd1
Key ----------> 2791940
KO: 4
[0x5427e0] Decoded string: Callstack Init Failed
Data ----------> 2791961
Key ----------> 2791a10
KO: 5
[0x543443] Decoded string: KERNEL32.dll
Data ----------> 2791991
Key ----------> 2791a50
KO: 5
[0x543471] Decoded string: WideCharToMultiByte
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x543642] Decoded string: .dll
Data ----------> 2791971
Key ----------> 2791a38
KO: 5
[0x543821] Decoded string: os_version
Data ----------> 27919a9
Key ----------> 2791930
KO: 5
[0x543a12] Decoded string: gpu_vendor
Data ----------> 2791aa1
Key ----------> 2791af0
KO: 5
[0x543c91] Decoded string: render_device_driver_version
Data ----------> 2791a69
Key ----------> 2791be8
KO: 5
[0x543e81] Decoded string: cpu_brand
Data ----------> 2791ad1
Key ----------> 2791b90
KO: 4
[0x544042] Decoded string: windows_install_date
Data ----------> 2791a01
Key ----------> 2791958
KO: 4
[0x544205] Decoded string: is_wine
Data ----------> 27919e9
Key ----------> 2791a74
KO: 4
[0x544231] Decoded string: 0
Data ----------> 2791a65
Key ----------> 2791b10
KO: 4
[0x544260] Decoded string: 1
Data ----------> 2791739
Key ----------> 2791808
KO: 4
[0x544290] Decoded string: ntdll.dll
Data ----------> 2791721
Key ----------> 27917a0
KO: 4
[0x5442c0] Decoded string: wine_get_version
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x544491] Decoded string: .dll
Data ----------> 2791981
Key ----------> 2791920
KO: 4
[0x544780] Decoded string: language
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x544a40] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x544ab0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x544db1] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x544e11] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x545040] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x5450b0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x5453b1] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x545411] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x545640] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x5456b0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x5459b1] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x545a11] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x545c40] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x545cb0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x545f91] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x545ff1] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x5461f0] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x546270] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x546551] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x5465b1] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x5467c0] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x546840] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x546a54] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 4
[0x546ab2] Decoded string: %02X
Data ----------> 2791ca1
Key ----------> 2791d60
KO: 5
[0x54a0b1] Decoded string: %u:%u:%X:%llX:%llX:%llX
Data ----------> 2791739
Key ----------> 2791808
KO: 5
[0x54eb23] Decoded string: ntdll.dll
Data ----------> 2791721
Key ----------> 27917a0
KO: 5
[0x54eb51] Decoded string: wine_get_version
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54ed01] Decoded string: .dll
Data ----------> 2791eb1
Key ----------> 2791e80
KO: 5
[0x54ee31] Decoded string: EasyAntiCheat_EOS
Data ----------> 2791e09
Key ----------> 2791dd8
KO: 5
[0x54ee61] Decoded string: ADVAPI32.dll
Data ----------> 2791e41
Key ----------> 2791e50
KO: 5
[0x54ee91] Decoded string: OpenSCManagerA
Data ----------> 2791ec9
Key ----------> 2791ed8
KO: 5
[0x54eec1] Decoded string: OpenServiceA
Data ----------> 2791f11
Key ----------> 2791dc0
KO: 5
[0x54eef1] Decoded string: QueryServiceStatusEx
Data ----------> 2791e61
Key ----------> 2791e20
KO: 5
[0x54ef21] Decoded string: CloseServiceHandle
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54f2a1] Decoded string: .dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54f4d1] Decoded string: .dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x54f6f0] Decoded string: .dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54f921] Decoded string: .dll
Data ----------> 2791e99
Key ----------> 2791de8
KO: 5
[0x54fa91] Decoded string: Startup
Data ----------> 2794001
Key ----------> 2794020
KO: 4
[0x59ebd0] Decoded string: CS_CCommandBuffer::AddText
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x59ec20] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x59ec50] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x59ee51] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x59efa0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x59efd0] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x59f191] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x59f2b0] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x59f330] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x59f501] Decoded string: .dll
Data ----------> 2794071
Key ----------> 2794090
KO: 4
[0x69b830] Decoded string: CS_UTIL_TraceRay_Client
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x69b880] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x69b8b0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x69baa1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x69bbf4] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x69bc20] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x69bde1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x69bf00] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x69bf70] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x69c141] Decoded string: .dll
Data ----------> 27940c1
Key ----------> 27940f0
KO: 5
[0x7cf601] Decoded string: CS_C_BaseEntity::CalcAbsoluteVelocity
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x7cf651] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x7cf681] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7cf881] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x7cf9e2] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x7cfa11] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7cfbc1] Decoded string: .dll
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x7cfd51] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7cff21] Decoded string: .dll
Data ----------> 27941c9
Key ----------> 2794138
KO: 5
[0x7df801] Decoded string: KERNEL32.dll
Data ----------> 2794151
Key ----------> 2794198
KO: 5
[0x7df831] Decoded string: VirtualProtect
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7dfa01] Decoded string: .dll
Data ----------> 2794181
Key ----------> 27941b0
KO: 5
[0x7dfb91] Decoded string: remove permissions
Data ----------> 2794161
Key ----------> 2794120
KO: 5
[0x817371] Decoded string: VTP_C_Player::Spawn
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x8173c1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x8173f1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x8175b1] Decoded string: .dll
Data ----------> 27942f1
Key ----------> 2794270
KO: 5
[0x850d21] Decoded string: CS_CalcMovementCompensation
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x850d65] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x850d91] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x850f95] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x8510e1] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x851111] Decoded string: VirtualQuery
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x8512d5] Decoded string: .dll
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x851465] Decoded string: GetLastError
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x851635] Decoded string: .dll
Data ----------> 27942d1
Key ----------> 2794350
KO: 5
[0x865491] Decoded string: VTP_GetEntityList
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x8654e1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x865511] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x8656c1] Decoded string: .dll
Data ----------> 2794311
Key ----------> 2794290
KO: 4
[0x8661d0] Decoded string: CS_CClientEntityList::GetHighestEntityIndex
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x866215] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x866240] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x866471] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x8665e0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x866610] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x8667d1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x866900] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x866970] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x866b41] Decoded string: .dll
Data ----------> 2794211
Key ----------> 27941e0
KO: 4
[0x86e650] Decoded string: CS_ClientModeShared::ClientMode_CreateMove
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x86e6a0] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x86e6d0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x86e8c1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x86ea14] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x86ea40] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x86ec01] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x86ed20] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x86ed90] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x86ef61] Decoded string: .dll
Data ----------> 2794371
Key ----------> 2794240
KO: 4
[0x878620] Decoded string: CS_CViewRender::GetMostRecentClipTransform
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x878670] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x8786a0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x8788a1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x878a10] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x878a40] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x878c01] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x878d30] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x878da0] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x878f71] Decoded string: .dll
Data ----------> 2794420
Key ----------> 27943f1
KO: 5
[0x951be1] Decoded string: CS_CInput::Input_CreateMove
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x951c21] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x951c51] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x951f31] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x952061] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x952091] Decoded string: VirtualQuery
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0x952151] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x9522e1] Decoded string: .dll
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x952401] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x9525c1] Decoded string: .dll
Data ----------> 27943c1
Key ----------> 27943a0
KO: 5
[0x952811] Decoded string: VTP_CInput::Input_CreateMove
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x952851] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x952881] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x952a81] Decoded string: .dll
Data ----------> 2794491
Key ----------> 2794470
KO: 5
[0x9f13b1] Decoded string: VTP_GetViewRenderInstance
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x9f1401] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x9f1431] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x9f1611] Decoded string: .dll
Data ----------> 2794561
Key ----------> 27945c0
KO: 4
[0xa58200] Decoded string: CS_C_BaseEntity::GetEntityNameAsCStr
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0xa58250] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0xa58280] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xa58481] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0xa585f0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0xa58620] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xa587e1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0xa58910] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0xa58980] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xa58b51] Decoded string: .dll
Data ----------> 27944e1
Key ----------> 2794530
KO: 4
[0xabe800] Decoded string: CS_C_MoveData::MoveData_Init
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0xabe845] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0xabe870] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xabea71] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0xabebe0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0xabec10] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xabedd1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0xabef00] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0xabef70] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xabf141] Decoded string: .dll
Data ----------> 2794651
Key ----------> 2794670
KO: 4
[0xcc4e10] Decoded string: CS_Pak_RequireSignedPaks
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0xcc4e60] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0xcc4e90] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xcc50b1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0xcc5220] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0xcc5250] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xcc5411] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0xcc5540] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0xcc55b0] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xcc5781] Decoded string: .dll
Data ----------> 27946c1
Key ----------> 2794690
KO: 5
[0xcc8c51] Decoded string: CS_Pak_ValidateSignatureForCurrentReadingFile
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcc8ca1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcc8cd1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcc8ed2] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcc9035] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcc9061] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcc9222] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcc9351] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcc93c1] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcc9592] Decoded string: .dll
Data ----------> 27947b1
Key ----------> 2794760
KO: 5
[0xcd89a1] Decoded string: CS_WrappedFileSystem_Open
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcd89f1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcd8a21] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd8c22] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcd8d83] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcd8db1] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd8f72] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcd90a1] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcd9111] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd92e2] Decoded string: .dll
Data ----------> 27946f1
Key ----------> 2794780
KO: 5
[0xcd9791] Decoded string: CS_WrappedFileSystem_ReadWholeFile
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcd97e1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcd9811] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd9a11] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcd9b81] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcd9bb1] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd9d71] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcd9ea1] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcd9f11] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcda0e1] Decoded string: .dll
Data ----------> 2794721
Key ----------> 2794740
KO: 5
[0xcdac51] Decoded string: CS_WrappedFileSystem_Init
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcdaca1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcdacd1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcdaed2] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcdb042] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcdb071] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcdb232] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcdb361] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcdb3d1] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcdb5a2] Decoded string: .dll
Data ----------> 27947d1
Key ----------> 27947f0
KO: 5
[0xe7bfe1] Decoded string: VTP_GetInputAPI
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xe7c031] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xe7c061] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xe7c211] Decoded string: .dll
found and successfully decoded 319 entries.

Back to top