Skip to main content

Obfuscation of C-String's

R5AC uses a simple XOR algorithm where the decryption key length and encrypted content length are identical.

Here is an example of automated decryption:

  bytes   pages size description
--------- ----- ---- --------------------------------------------
129359872 15791 8192 allocating memory for b-tree...
268435456 32768 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
398057472            total memory allocated

Loading processor module E:\Documents\IDA Pro 7.6\procs\pc64.dll for metapc...Initializing processor module metapc...OK
Loading type libraries...
Autoanalysis subsystem has been initialized.
E:\Documents\IDA Pro 7.6\plugins\__init__.py: undefined function __plugins____init__.PLUGIN_ENTRY
E:\Documents\IDA Pro 7.6\plugins\eliminate.py: undefined function __plugins__eliminate.PLUGIN_ENTRY
Database for file '_S25.bin' has been loaded.
Hex-Rays Decompiler plugin has been loaded (v7.6.0.210427)
  License: 55-F116-3A71-23 IDA PRO 7.6 SP1 (99 users)
  The hotkeys are F5: decompile, Ctrl-F5: decompile all.

  Please check the Edit/Plugins menu for more informaton.
E:\Documents\IDA Pro 7.6\plugins\__init__.py: undefined function __plugins____init__.PLUGIN_ENTRY
E:\Documents\IDA Pro 7.6\plugins\eliminate.py: undefined function __plugins__eliminate.PLUGIN_ENTRY
7D0690: restored microcode from idb
7D0690: restored pseudocode from idb
878460: restored microcode from idb
878460: restored pseudocode from idb
87847C: variable 'v2' is possibly undefined
87856F: variable 'v5' is possibly undefined
2345E0: using guessed type __int64 __fastcall sub_2345E0(_QWORD, _QWORD);
13734D8: using guessed type __int64 __fastcall sub_13734D8(_QWORD, _QWORD);
1AA6310: using guessed type int R5AC::Prime;
5D55360: using guessed type __int64 (__fastcall *R5AC::Imp::RtlCaptureSBT)(_QWORD, _QWORD, _QWORD);
5D55370: using guessed type __int128 xmmword_5D55370;
5D55398: using guessed type __int64 R5AC::WhitelistedSections;
5D553B0: using guessed type int R5AC::WhitelistedSectionCount;
5D553B8: using guessed type __int64 R5AC::IsEnabled;
878460: using guessed type char Format[64];
8504A0: restored microcode from idb
8504A0: restored pseudocode from idb
138D4A4: using guessed type double __fastcall sub_138D4A4(_QWORD);
844FB80: using guessed type __int64 qword_844FB80;
8483748: using guessed type __int64 qword_8483748;
84837A0: using guessed type __int64 gpCurrentPlaylist;
8583900: using guessed type __int64 qword_8583900;
---------------------------------------------------------------------------------------------
Python 3.8.10 (tags/v3.8.10:3d8993a, May  3 2021, 11:48:03) [MSC v.1928 64 bit (AMD64)]
IDAPython 64-bit v7.4.0 final (serial 0) (c) The IDAPython Team <idapython@googlegroups.com>
---------------------------------------------------------------------------------------------
Caching 'Functions'... ok
5431F0: restored microcode from idb
5431F0: restored pseudocode from idb
24ABFB0: using guessed type int R5AC::NumSecondaryVIolations;
24ABFB8: using guessed type __int64 R5AC::SecondaryViolationList;
5D553D0: using guessed type __int64 qword_5D553D0;
2C44C0: restored microcode from idb
2C44C0: restored pseudocode from idb
Caching 'Functions'... ok
Caching 'Functions'... ok
Caching 'Functions'... ok
Caching 'Functions'... ok
542CB0: restored microcode from idb
542CB0: restored pseudocode from idb
20E850: restored microcode from idb
20E850: restored pseudocode from idb
[autohidden] The decompiler assumes that the segment '.rdata' is read-only because of its NAME.
All data references to the segment will be replaced by constant values.
This may lead to drastic changes in the decompiler output.
If the segment is not read-only, please change the segment NAME.

In general, the decompiler checks the segment permissions, class, and name
to determine if it is read-only.
 -> OK
Caching 'xrefs to R5AC__PushViolation'... ok
7CF460: restored microcode from idb
7CF460: restored pseudocode from idb
Caching 'Functions'... ok
479290: restored microcode from idb
479290: restored pseudocode from idb
542FAA: restored microcode from idb
542FAA: restored pseudocode from idb
54A010: restored microcode from idb
54A010: restored pseudocode from idb
2C4B50: restored microcode from idb
2C4B50: restored pseudocode from idb
542880: restored microcode from idb
542880: restored pseudocode from idb
5433B0: restored microcode from idb
5433B0: restored pseudocode from idb
Looking for pattern in 0x1000-0xdacd000
Data ----------> 1aa2691
Key ----------> 1aa2770
KO: 4
[0x20e9f0] Decoded string: CS_CEngineClient::Engine_SetViewAngles
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x20ea35] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x20ea60] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x20ec61] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x20edd0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x20ee00] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x20efc1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x20f0f0] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x20f160] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x20f331] Decoded string: .dll
Data ----------> 1aa2811
Key ----------> 1aa2750
KO: 5
[0x22ee01] Decoded string: VTP_GetEngineTraceClient
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x22ee51] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x22ee81] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x22f031] Decoded string: .dll
Data ----------> 1aa2611
Key ----------> 1aa27b0
KO: 5
[0x22f271] Decoded string: VTP_GetEngineTraceClientDecals
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x22f2c1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x22f2f1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x22f4a1] Decoded string: .dll
Data ----------> 2791311
Key ----------> 27916a0
KO: 4
[0x26c540] Decoded string: CS_CNetChan::SetTimeout
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x26c585] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x26c5b0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26c7b1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x26c920] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x26c950] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26cb11] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x26cc30] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x26cca0] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26ce71] Decoded string: .dll
Data ----------> 27914f1
Key ----------> 2791560
KO: 4
[0x26dfe0] Decoded string: CS_CNetChan::SendReliableMessages
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x26e025] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x26e050] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26e251] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x26e3c0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x26e3f0] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26e5b1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x26e6e0] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x26e750] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x26e921] Decoded string: .dll
Data ----------> 2791520
Key ----------> 2791541
KO: 5
[0x270511] Decoded string: CS_CNetChan::SendDatagram
Data ----------> 1aa2680
Key ----------> 1aa2739
KO: 5
[0x270551] Decoded string: KERNEL32.dll
Data ----------> 1aa2720
Key ----------> 27912d1
KO: 5
[0x270581] Decoded string: K32GetMappedFileNameA
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x2707a1] Decoded string: .dll
Data ----------> 1aa2798
Key ----------> 1aa2701
KO: 5
[0x2708e4] Decoded string: KERNEL32.dll
Data ----------> 1aa2630
Key ----------> 1aa26f1
KO: 5
[0x270911] Decoded string: VirtualQuery
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x270af1] Decoded string: .dll
Data ----------> 1aa2640
Key ----------> 1aa27d1
KO: 5
[0x270c13] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 1aa25f8
Key ----------> 2791301
KO: 5
[0x270c81] Decoded string: GetLastError
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x270e61] Decoded string: .dll
Data ----------> 2791651
Key ----------> 2791330
KO: 5
[0x2744c1] Decoded string: CS_CNetChan::SendNetMsg
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x274502] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x274531] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x274734] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x274891] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x2748c1] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x274a84] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0x274ba1] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x274c11] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x274de4] Decoded string: .dll
Data ----------> 27914d1
Key ----------> 2791670
KO: 4
[0x275210] Decoded string: CS_CNetChan::SendData
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x275255] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x275280] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x275481] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x2755f0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x275620] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x2757e1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x275900] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x275970] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x275b41] Decoded string: .dll
Data ----------> 27916e1
Key ----------> 2791700
KO: 5
[0x2f1cc2] Decoded string: EOSSDK-Win64-Shipping.dll
Data ----------> 2791739
Key ----------> 2791808
KO: 5
[0x3a3e51] Decoded string: ntdll.dll
Data ----------> 2791721
Key ----------> 27917a0
KO: 5
[0x3a3e81] Decoded string: wine_get_version
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x3a43a1] Decoded string: .dll
Data ----------> 2791771
Key ----------> 2791750
KO: 4
[0x3ae540] Decoded string: CS_Playlist_GetPlaylistVar
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x3ae585] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x3ae5b0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x3ae7a1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x3ae8f4] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x3ae920] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x3aeae1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x3aec00] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x3aec70] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x3aee41] Decoded string: .dll
Data ----------> 2791881
Key ----------> 2791860
KO: 5
[0x479351] Decoded string: VTP_GetFilesystemInterface
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x4793a1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x4793d1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x479581] Decoded string: .dll
Data ----------> 27919f1
Key ----------> 2791c10
KO: 4
[0x541f93] Decoded string: ntdll.dll
Data ----------> 2791a81
Key ----------> 2791bb0
KO: 4
[0x541fc0] Decoded string: RtlCaptureStackBackTrace
Data ----------> 27919c1
Key ----------> 2791b78
KO: 4
[0x541ff0] Decoded string: KERNEL32.dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x5421b0] Decoded string: .dll
Data ----------> 2791b21
Key ----------> 2791c20
KO: 5
[0x542551] Decoded string: steamnetworkingsockets.dll
Data ----------> 2791b61
Key ----------> 2791ac0
KO: 5
[0x542691] Decoded string: steam_api64.dll
Data ----------> 2791bd1
Key ----------> 2791940
KO: 4
[0x5427e0] Decoded string: Callstack Init Failed
Data ----------> 2791961
Key ----------> 2791a10
KO: 5
[0x543443] Decoded string: KERNEL32.dll
Data ----------> 2791991
Key ----------> 2791a50
KO: 5
[0x543471] Decoded string: WideCharToMultiByte
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x543642] Decoded string: .dll
Data ----------> 2791971
Key ----------> 2791a38
KO: 5
[0x543821] Decoded string: os_version
Data ----------> 27919a9
Key ----------> 2791930
KO: 5
[0x543a12] Decoded string: gpu_vendor
Data ----------> 2791aa1
Key ----------> 2791af0
KO: 5
[0x543c91] Decoded string: render_device_driver_version
Data ----------> 2791a69
Key ----------> 2791be8
KO: 5
[0x543e81] Decoded string: cpu_brand
Data ----------> 2791ad1
Key ----------> 2791b90
KO: 4
[0x544042] Decoded string: windows_install_date
Data ----------> 2791a01
Key ----------> 2791958
KO: 4
[0x544205] Decoded string: is_wine
Data ----------> 27919e9
Key ----------> 2791a74
KO: 4
[0x544231] Decoded string: 0
Data ----------> 2791a65
Key ----------> 2791b10
KO: 4
[0x544260] Decoded string: 1
Data ----------> 2791739
Key ----------> 2791808
KO: 4
[0x544290] Decoded string: ntdll.dll
Data ----------> 2791721
Key ----------> 27917a0
KO: 4
[0x5442c0] Decoded string: wine_get_version
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x544491] Decoded string: .dll
Data ----------> 2791981
Key ----------> 2791920
KO: 4
[0x544780] Decoded string: language
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x544a40] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x544ab0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x544db1] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x544e11] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x545040] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x5450b0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x5453b1] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x545411] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x545640] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x5456b0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x5459b1] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x545a11] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x545c40] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x545cb0] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x545f91] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x545ff1] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x5461f0] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x546270] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x546551] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 5
[0x5465b1] Decoded string: %02X
Data ----------> 2791c01
Key ----------> 27919d8
KO: 4
[0x5467c0] Decoded string: HWID_%02X-%02X
Data ----------> 27919d1
Key ----------> 2791ae8
KO: 4
[0x546840] Decoded string: %02X
Data ----------> 2791a21
Key ----------> 2791b40
KO: 5
[0x546a54] Decoded string: HWID_%02X-FAILURE
Data ----------> 27919b5
Key ----------> 2791918
KO: 4
[0x546ab2] Decoded string: %02X
Data ----------> 2791ca1
Key ----------> 2791d60
KO: 5
[0x54a0b1] Decoded string: %u:%u:%X:%llX:%llX:%llX
Data ----------> 2791739
Key ----------> 2791808
KO: 5
[0x54eb23] Decoded string: ntdll.dll
Data ----------> 2791721
Key ----------> 27917a0
KO: 5
[0x54eb51] Decoded string: wine_get_version
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54ed01] Decoded string: .dll
Data ----------> 2791eb1
Key ----------> 2791e80
KO: 5
[0x54ee31] Decoded string: EasyAntiCheat_EOS
Data ----------> 2791e09
Key ----------> 2791dd8
KO: 5
[0x54ee61] Decoded string: ADVAPI32.dll
Data ----------> 2791e41
Key ----------> 2791e50
KO: 5
[0x54ee91] Decoded string: OpenSCManagerA
Data ----------> 2791ec9
Key ----------> 2791ed8
KO: 5
[0x54eec1] Decoded string: OpenServiceA
Data ----------> 2791f11
Key ----------> 2791dc0
KO: 5
[0x54eef1] Decoded string: QueryServiceStatusEx
Data ----------> 2791e61
Key ----------> 2791e20
KO: 5
[0x54ef21] Decoded string: CloseServiceHandle
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54f2a1] Decoded string: .dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54f4d1] Decoded string: .dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x54f6f0] Decoded string: .dll
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x54f921] Decoded string: .dll
Data ----------> 2791e99
Key ----------> 2791de8
KO: 5
[0x54fa91] Decoded string: Startup
Data ----------> 2794001
Key ----------> 2794020
KO: 4
[0x59ebd0] Decoded string: CS_CCommandBuffer::AddText
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x59ec20] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x59ec50] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x59ee51] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x59efa0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x59efd0] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x59f191] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x59f2b0] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x59f330] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x59f501] Decoded string: .dll
Data ----------> 2794071
Key ----------> 2794090
KO: 4
[0x69b830] Decoded string: CS_UTIL_TraceRay_Client
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x69b880] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x69b8b0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x69baa1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x69bbf4] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x69bc20] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x69bde1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x69bf00] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x69bf70] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x69c141] Decoded string: .dll
Data ----------> 27940c1
Key ----------> 27940f0
KO: 5
[0x7cf601] Decoded string: CS_C_BaseEntity::CalcAbsoluteVelocity
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x7cf651] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x7cf681] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7cf881] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x7cf9e2] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x7cfa11] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7cfbc1] Decoded string: .dll
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x7cfd51] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7cff21] Decoded string: .dll
Data ----------> 27941c9
Key ----------> 2794138
KO: 5
[0x7df801] Decoded string: KERNEL32.dll
Data ----------> 2794151
Key ----------> 2794198
KO: 5
[0x7df831] Decoded string: VirtualProtect
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x7dfa01] Decoded string: .dll
Data ----------> 2794181
Key ----------> 27941b0
KO: 5
[0x7dfb91] Decoded string: remove permissions
Data ----------> 2794161
Key ----------> 2794120
KO: 5
[0x817371] Decoded string: VTP_C_Player::Spawn
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x8173c1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x8173f1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x8175b1] Decoded string: .dll
Data ----------> 27942f1
Key ----------> 2794270
KO: 5
[0x850d21] Decoded string: CS_CalcMovementCompensation
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x850d65] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x850d91] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x850f95] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x8510e1] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x851111] Decoded string: VirtualQuery
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x8512d5] Decoded string: .dll
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x851465] Decoded string: GetLastError
Data ----------> 1aa26e4
Key ----------> 27912f5
KO: 5
[0x851635] Decoded string: .dll
Data ----------> 27942d1
Key ----------> 2794350
KO: 5
[0x865491] Decoded string: VTP_GetEntityList
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x8654e1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x865511] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x8656c1] Decoded string: .dll
Data ----------> 2794311
Key ----------> 2794290
KO: 4
[0x8661d0] Decoded string: CS_CClientEntityList::GetHighestEntityIndex
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x866215] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x866240] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x866471] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x8665e0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x866610] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x8667d1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x866900] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x866970] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x866b41] Decoded string: .dll
Data ----------> 2794211
Key ----------> 27941e0
KO: 4
[0x86e650] Decoded string: CS_ClientModeShared::ClientMode_CreateMove
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x86e6a0] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x86e6d0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x86e8c1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x86ea14] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x86ea40] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x86ec01] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x86ed20] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x86ed90] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x86ef61] Decoded string: .dll
Data ----------> 2794371
Key ----------> 2794240
KO: 4
[0x878620] Decoded string: CS_CViewRender::GetMostRecentClipTransform
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0x878670] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0x8786a0] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x8788a1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0x878a10] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0x878a40] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x878c01] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0x878d30] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0x878da0] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0x878f71] Decoded string: .dll
Data ----------> 2794420
Key ----------> 27943f1
KO: 5
[0x951be1] Decoded string: CS_CInput::Input_CreateMove
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x951c21] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x951c51] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x951f31] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0x952061] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0x952091] Decoded string: VirtualQuery
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0x952151] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x9522e1] Decoded string: .dll
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0x952401] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x9525c1] Decoded string: .dll
Data ----------> 27943c1
Key ----------> 27943a0
KO: 5
[0x952811] Decoded string: VTP_CInput::Input_CreateMove
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x952851] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x952881] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x952a81] Decoded string: .dll
Data ----------> 2794491
Key ----------> 2794470
KO: 5
[0x9f13b1] Decoded string: VTP_GetViewRenderInstance
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0x9f1401] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0x9f1431] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0x9f1611] Decoded string: .dll
Data ----------> 2794561
Key ----------> 27945c0
KO: 4
[0xa58200] Decoded string: CS_C_BaseEntity::GetEntityNameAsCStr
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0xa58250] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0xa58280] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xa58481] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0xa585f0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0xa58620] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xa587e1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0xa58910] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0xa58980] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xa58b51] Decoded string: .dll
Data ----------> 27944e1
Key ----------> 2794530
KO: 4
[0xabe800] Decoded string: CS_C_MoveData::MoveData_Init
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0xabe845] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0xabe870] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xabea71] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0xabebe0] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0xabec10] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xabedd1] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0xabef00] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0xabef70] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xabf141] Decoded string: .dll
Data ----------> 2794651
Key ----------> 2794670
KO: 4
[0xcc4e10] Decoded string: CS_Pak_RequireSignedPaks
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 4
[0xcc4e60] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 4
[0xcc4e90] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xcc50b1] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 4
[0xcc5220] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 4
[0xcc5250] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xcc5411] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 4
[0xcc5540] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 4
[0xcc55b0] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 4
[0xcc5781] Decoded string: .dll
Data ----------> 27946c1
Key ----------> 2794690
KO: 5
[0xcc8c51] Decoded string: CS_Pak_ValidateSignatureForCurrentReadingFile
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcc8ca1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcc8cd1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcc8ed2] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcc9035] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcc9061] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcc9222] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcc9351] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcc93c1] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcc9592] Decoded string: .dll
Data ----------> 27947b1
Key ----------> 2794760
KO: 5
[0xcd89a1] Decoded string: CS_WrappedFileSystem_Open
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcd89f1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcd8a21] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd8c22] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcd8d83] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcd8db1] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd8f72] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcd90a1] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcd9111] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd92e2] Decoded string: .dll
Data ----------> 27946f1
Key ----------> 2794780
KO: 5
[0xcd9791] Decoded string: CS_WrappedFileSystem_ReadWholeFile
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcd97e1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcd9811] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd9a11] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcd9b81] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcd9bb1] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcd9d71] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcd9ea1] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcd9f11] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcda0e1] Decoded string: .dll
Data ----------> 2794721
Key ----------> 2794740
KO: 5
[0xcdac51] Decoded string: CS_WrappedFileSystem_Init
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xcdaca1] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xcdacd1] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcdaed2] Decoded string: .dll
Data ----------> 1aa2701
Key ----------> 1aa2798
KO: 5
[0xcdb042] Decoded string: KERNEL32.dll
Data ----------> 1aa26f1
Key ----------> 1aa2630
KO: 5
[0xcdb071] Decoded string: VirtualQuery
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcdb232] Decoded string: .dll
Data ----------> 1aa27d1
Key ----------> 1aa2640
KO: 5
[0xcdb361] Decoded string: BA:0x%llX AB:0x%llX RS:0x%llX AP:0x%lX PR:0x%lX TY:0x%lX
Data ----------> 2791301
Key ----------> 1aa25f8
KO: 5
[0xcdb3d1] Decoded string: GetLastError
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xcdb5a2] Decoded string: .dll
Data ----------> 27947d1
Key ----------> 27947f0
KO: 5
[0xe7bfe1] Decoded string: VTP_GetInputAPI
Data ----------> 1aa2739
Key ----------> 1aa2680
KO: 5
[0xe7c031] Decoded string: KERNEL32.dll
Data ----------> 27912d1
Key ----------> 1aa2720
KO: 5
[0xe7c061] Decoded string: K32GetMappedFileNameA
Data ----------> 27912f5
Key ----------> 1aa26e4
KO: 5
[0xe7c211] Decoded string: .dll
found and successfully decoded 319 entries.
Back to top