Security

CGGHashMgr, CNProtectGameGuardMgr, Stove PCSDK IAP, anti-cheat, nProtect GameGuard (183), Camellia/SEED/SEAL/DEAL/MARS, CHashWatermark, PacketCrypt, UIPinCodeWnd

Functions 389Code 137 KBAddresses 0x00401640 to 0x00E02740

Filter these functions389 functions

Address	Size	Name	Description
0x00401640	6	CGGHashMgr__halt_baddata	Wrapper function that terminates the game client when hash validation fails in the hash manager.
0x00401870	4	CGGHashMgr__GetField8	Returns pointer to hash table data stored at offset +8 in CGGHashMgr instance
0x00401880	4	CGGHashMgr__GetField4	CGGHashMgr accessor returning the 4-byte value at offset +4 from the instance base address.
0x004C9DA0	31	validate_buffer_size	Validates buffer size is positive and address is below fixed upper bound (0x989681), returns 0 if valid, 5 if invalid.
0x00600DC0	745	StoveSDK__OnGetTokenCallback	Handles Stove PCSDK token callback; validates auth result, extracts access token, or displays error dialog and quits.
0x006010B0	210	StoveSDK__OnInitCallback	Stove PCSDK initialization callback that validates SDK initialization result and exits with error MessageBox on failure.
0x00601190	1034	StoveSDK__OnProductListCallback	Processes Stove IAP product list callback; iterates products, extracts price/ID/display info, validates purchase limits and sale dates.
0x006015A0	497	StoveSDK__OnPurchaseResultCallback	Processes Stove IAP purchase callback, extracts product/category IDs on success, stores in global struct, shows error MessageBox on failure.
0x006017A0	2855	StoveSDK__OnCashShopProductListCallback	Processes Stove SDK cash shop product list callback, categorizes products by ID, initializes item slots with category mapping.
0x006022D0	413	StoveSDK__OnConfirmPurchaseCallback	Stove SDK purchase callback: sends 0x143 message on success, opens error URL via ShellExecuteA on failure.
0x00602470	384	StoveSDK__OnOwnershipCheckCallback	Handles Stove SDK ownership verification callback; on success sends packet 0x14b to active mode, fetches products, updates UI window 0x13e; on failure shows error dialog.
0x006026D0	215	StoveSDK__ClientInit	Initializes StoveSDK client wrapper with vtable, zeroes member fields, allocates 0x288-byte buffer, calls StoveSDK__Initialize for Korean launcher integration.
0x006027B0	170	StoveSDK__TickTimerInit	Initializes a timer structure with linked list node, default intervals (20ms, 12ms), and current system tick timestamp for StoveSDK.
0x00602870	64	StoveSDK__TickTimerNodeFree	Frees a StoveSDK tick timer node by deallocating its 0x28-byte internal buffer with stack canary protection.
0x006028C0	67	StoveSDK__ContextNodeFree	Frees allocated memory (0x100 bytes) from a StoveSDK context node structure at offset +4.
0x00602910	110	StoveSDK__TickTimerDestroy	Destroys a StoveSDK tick timer by freeing allocated memory (0x28 bytes) and cleaning up internal string state.
0x00602990	130	StoveSDK__ContextDestroy	Destroys StoveSDK context by freeing allocated memory and cleaning up string resources at offset +4.
0x00602A20	101	StoveSDK__TickTimerClearAndFree	Destructs and deallocates a StoveSDK timer object, freeing internal string and timer structure memory.
0x00602AB0	208	StoveSDK__Shutdown	Shuts down Stove PCSDK by calling IAP_UnInitialize and Base_UnInitialize, clearing initialized flag and cleaning up Result objects.
0x00602B80	65	StoveSDK__TickTimerClearWrapper	Wrapper that clears and frees StoveSDK tick timer with stack canary security checks (XOR-based stack protection).
0x00602BD0	33	StoveSDK__BaseScalarDeletingDestructor	StoveSDK Base destructor with conditional heap deallocation based on deletion flag parameter.
0x00602C00	229	StoveSDK__ScalarDeletingDestructor	StoveSDK destructor that uninitializes IAP and base systems, clears strings, optionally deletes object memory.
0x00602CF0	188	StoveSDK__AddProductToCategory	Inserts a product node into a category's doubly-linked list; validates category index <11, allocates 0x100-byte node, copies product data, updates list size.
0x00602DC0	779	StoveSDK__Initialize	Initializes Stove PC SDK with environment detection (sandbox/live), sets app keys, restarts if needed, initializes IAP and retrieves user info.
0x006030D0	158	StoveSDK__Uninitialize	Uninitializes Stove SDK by calling IAP_UnInitialize and Base_UnInitialize, then clears the initialized flag.
0x00603170	644	StoveSDK__GetAccessTokenString	Retrieves Stove SDK access token, converts from wide-char to multibyte, stores at object+0x30 with 600-byte limit.
0x00603400	288	StoveSDK__GetUserInfo	Retrieves Stove SDK user info (member number, game user ID), stores as strings at offsets 0x288/0x2a0, exits on failure.
0x00603520	5	Base_RunCallback	Infinite recursion stub; likely corrupted/obfuscated code or failed decompilation of indirect jump table
0x00603530	203	StoveSDK__FetchProducts	Fetches IAP product list from Stove SDK, blocking until callback completes with 200ms polling intervals.
0x00603600	513	StoveSDK__StartPurchase	Initiates Stove IAP purchase flow by building StovePCStartPurchaseParam from product vector, calling IAP_StartPurchase with callback, then opens CS page or payment URL dialog.
0x00603810	321	StoveSDK__FetchAllProducts	Fetches cash shop products in two passes: all categories, then specific LIVE/SANDBOX category via Stove IAP SDK with blocking spin loops.
0x00603960	90	StoveSDK__FetchTermsAgreement	Synchronously fetches Stove IAP terms agreement with polling loop, invoking OnConfirmPurchaseCallback upon completion.
0x006039C0	39	StoveSDK__WaitForCallback	Synchronous blocking wait that polls Base_RunCallback every 200ms until DAT_01253d20 flag is cleared by Stove SDK callback completion.
0x00606B70	394	CHashWatermark__Init	Initializes a 310x15 GDI+ surface rendering a git commit hash watermark with black shadow and white text overlay.
0x00606D00	31	CHashWatermark__Destructor	Destructor for CHashWatermark that sets vftable, safely releases object at offset +8 via virtual destructor call.
0x00606D20	53	CHashWatermark__ScalarDeletingDestructor	Scalar deleting destructor for CHashWatermark; releases member at offset +8 and conditionally deallocates object.
0x00606D60	488	CHashWatermark__GetOrCreate	Singleton factory that creates/initializes CHashWatermark with embedded watermark text, returns validity status
0x00606F70	34	CHashWatermark__DrawToSurface	Invokes virtual method at offset 0x30 on object at param_1+8 to render watermark with color 0xffffffff and dimensions 0x136x0xf
0x00607050	7	CryptoPP__BlockCipherMode__SetVtable	Sets virtual function table pointer for CryptoPP BlockCipherMode object to destructor vtable entry.
0x00607060	93	CryptoPP__BlockCipherModeEx__Destructor	Destroys CryptoPP BlockCipherModeEx object by clearing internal byte vector buffers and restoring stack frame state.
0x0060ACB0	233	CryptoPP__AE_CipherInit	Initializes AE (Authenticated Encryption) cipher mode object with vtable pointers, buffers, and destructor setup.
0x0060B1A0	261	CryptoPP__AE_CipherInit_Dual	Initializes a dual AES cipher mode object with vtable pointers and zeroed buffer state for encryption/decryption.
0x00611270	613	CryptoPP__AE_EncryptDecryptBlock	Decrypts/encrypts data blocks using AES cipher with XOR operations and BCrypt, processes up to 0x810 byte chunks iteratively.
0x006176F0	388	CryptoPP__RNG__GenerateWord32	MT19937 Mersenne Twister PRNG implementation; generates 32-bit random numbers for RO client crypto, shuffling, and game mechanics.
0x00618350	693	PacketCrypt__DispatchDecryptByType	Dispatches packet decryption based on cipher type byte, validates xxhash32, returns 1 on success or 0 on failure.
0x00618750	263	PacketCrypt__XorRandomBytes	XORs pseudo-random bytes from an LCG or PRNG state into a 48-byte output buffer for packet encryption key derivation.
0x006188C0	1418	PacketCrypt__InitAllCryptoKeys	Initializes three PacketCrypt cipher key pairs by generating random keys and creating RNG contexts for packet encryption.
0x006195D0	400	CryptoPP__MersenneTwister__Generate	CryptoPP: MersenneTwister Generate
0x00619760	295	BufferedTransformation__Deallocate	Deallocates a Crypto++ BufferedTransformation object's internal buffer and linked list nodes.
0x00619970	442	CryptoPP__IDEA__InvertKeys	Generates IDEA cipher decryption subkeys by inverting and reversing 52 encryption subkeys using multiplicative/additive inverses.
0x00619B30	220	CryptoPP__InlineBlockConstants	Initializes Crypto++ block cipher constants by loading 16 32-bit values from input buffer and deriving 48 additional round constants via bit rotation.
0x00619C80	592	CryptoPP__IDEA__EncryptBlock	Encrypts 8-byte block using IDEA cipher with 8 rounds of modular multiplication and XOR mixing operations
0x00619ED0	665	CryptoPP__IDEA__SetKey	Expands 128-bit IDEA cipher key into 52 subkeys for encryption/decryption operations
0x0061A1F0	270	CryptoPP__AlignedBuffer_270	ChaCha20 quarter-round transformation with rotation/XOR operations on four 32-bit state words (stream cipher core)
0x0061A380	265	CryptoPP__AlignedBuffer_265	Block cipher encryption/decryption loop (likely RC4 or TEA variant) processing 4 uint32 values through 20 rounds with key schedule
0x0061A490	392	CryptoPP__SecureBuffer_InitializeKey	Initializes cryptographic key schedule using input data with RC6-like key expansion algorithm and secure buffer clearing.
0x0061A620	392	CryptoPP__SecureBuffer_KeySchedule	Initializes SHA-1-like key schedule with input data validation and rotation-based state transformation.
0x0061AC20	883	CryptoPP__ThreeWay__EncryptBlock	Three-Way block cipher encryption with 11 rounds, bit permutation, and LFSR-based key scheduling for RO packet encryption.
0x0061AFA0	464	CryptoPP__ThreeWay__EncryptBlockBE	Encrypts a 12-byte block using Three-Way cipher in big-endian mode with 11 rounds and key schedule.
0x0061B170	484	CryptoPP__ThreeWay__SetKey	Initializes 3-Way block cipher key schedule by loading 12-byte key and performing bit permutation transformation if needed.
0x0061B8C0	225	PacketQueue__FindAndDequeuePacket	Searches packet queue for matching packet pair (iVar2, iVar1), dequeues and returns it via param_2
0x00733920	453	CGGHashMgr__Constructor	Initializes CGGHashMgr with critical section, loads RagHash.dat integrity file via CFileLoader, validates hash data.
0x00733AF0	89	CGGHashMgr__Destructor	Destroys CGGHashMgr object by calling CFileLoader destructor, nullifying pointer, and deleting critical section.
0x00733B50	107	CGGHashMgr__ScalarDeletingDestructor	Destructor for CGGHashMgr; destroys CFileLoader, deletes critical section, optionally frees 0x24-byte object
0x00733BD0	6	CGGHashMgr__Init	GameGuard hash manager initialization stub that returns 1; actual implementation removed by Gravity.
0x00733C00	215	CGGHashMgr__FindByFileHash	Thread-safe wrapper that queries CFileLoader for file hash match; throws formatted error if not found.
0x00733D00	215	CGGHashMgr__FindByHashPair	Thread-safe hash pair lookup wrapper that acquires lock, searches via CFileLoader, returns 1 on success or throws formatted error.
0x00733DF0	202	CGGHashMgr__ValidateHashFile_ThreadSafe	Acquires lock, checks hash validity, logs error if corrupted, releases lock, returns success status.
0x00733EE0	325	CGGHashMgr__ReloadAndValidateAll	Validates all hash entries in game resource manager; logs error and crashes if file hash lookup fails.
0x00734040	353	CGGHashMgr__LoadRagHashDat	Allocates CFileLoader, loads RagHash.dat integrity file, validates version >= 2 and hash check, returns success status.
0x007341B0	159	CGGHashMgr__CreateInstance	Creates and initializes CGGHashMgr singleton instance (0x24 bytes); returns 1 on success, 0 on allocation/construction failure.
0x007344D0	90	CNProtect__InitializeSkillTreeNode	Initializes a skill tree node object by setting vftable, copying data from param_3, and inserting byte data.
0x00734530	152	CNProtect__InsertByteData	Copies byte data from source vector to destination vector, resizing destination to match source size via memmove.
0x00734A70	577	CNProtectGameGuardMgr__SendPacket	Sends GameGuard response packet 0x9D0 to server from queued auth data with critical section protection.
0x00734CC0	158	CSecurityMgr__ValidateGameGuard	Validates GameGuard initialization status; logs error if validation fails with code 0x755.
0x00734D60	695	CNProtectGameGuardMgr__Initialize	Initializes nProtect GameGuard anti-cheat system with region-specific configuration based on g_serviceType
0x00735180	272	CSecurityMgr__CreateInstance	Creates singleton CSecurityMgr instance (0x50 bytes), initializes critical section and GameGuard protection, returns success status.
0x00735290	27	cleanup_gameguard_resource	Cleans up GameGuard instance stored at offset 0xc, calls gg_cleanup_and_destroy then deletes the pointer.
0x007352C0	27	destroy_global_gameguard_obj	Calls virtual destructor on global GameGuard object and nullifies pointer to prevent double-free.
0x007352E0	97	CNProtectGameGuardMgr__HasError	Thread-safe getter returning GameGuard error flag (offset 0x10) from CNProtectGameGuardMgr under critical section lock
0x00735350	118	CNProtectGameGuardMgr__ResetError	Clears the error string in CNProtectGameGuardMgr using a scoped lock for thread-safe access to offset 0x14.
0x007353D0	125	CNProtectGameGuardMgr__GetProductNameThreadSafe	Thread-safe wrapper retrieving GameGuard product name from nProtect pipe; returns "unknown" if uninitialized.
0x007354B0	99	CNProtectGameGuardMgr__SetAuthData	Sets GameGuard authentication data by forwarding param_2 to nProtect library with thread-safe critical section locking.
0x00735520	731	CNProtectGameGuardMgr__Callback	GameGuard callback handler processing nProtect messages (0x3E9-0x3FB), logging errors and queuing auth data packets.
0x00735830	93	CGGHashMgr__IncrementCounter	Increments GameGuard hash manager counter with mutex protection for session/connection tracking.
0x00735890	145	CNProtectGameGuardMgr__SetErrorInfo	Thread-safely stores first error info (file path string) in GameGuard manager, using critical section lock at offset 0x2C.
0x00735930	99	CNProtectGameGuardMgr__CheckAuth	Acquires lock and invokes nProtect GameGuard authentication check with XOR-encoded stack canary for anti-tampering verification.
0x007362E0	350	RC4__KeySchedule	RC4 Key Scheduling Algorithm (KSA) - initializes S-box permutation and performs key mixing for RC4 cipher state
0x007B3800	207	ShuffleByteArrayWithCryptoPPRNG	Fisher-Yates shuffle implementation using CryptoPP RNG to randomly permute byte array elements between param_1 and param_2.
0x007B38D0	207	FisherYatesShuffle_WithRNG_B	Fisher-Yates shuffle implementation using cryptographic RNG with rejection sampling for unbiased random element selection.
0x007B39A0	147	FisherYatesShuffle_Simple_A	Fisher-Yates shuffle implementation for byte array range [param_1, param_2) using CryptoPP RNG with rejection sampling
0x007B3A40	147	FisherYatesShuffle_Simple_B	Fisher-Yates shuffle algorithm for byte array randomization using CryptoPP RNG with rejection sampling.
0x007B3AE0	76	MersenneTwister__SeedInit	Initializes MT19937 Mersenne Twister PRNG with seed, populating 624-entry state array using standard multiplier 0x6C078965.
0x00A88FA0	163	CProcessScanner__CheckFileExists	Checks if a file exists by searching resource manager hash table or filesystem using FindFirstFileA.
0x00A892F0	288	CProcessScanner__Init	Initializes anti-cheat process scanner by loading platform-specific APIs (kernel32/psapi) and enabling debug privilege.
0x00A89410	84	CProcessScanner__Cleanup	Cleans up process scanner by freeing library handle and resetting debug privileges if not on Windows 9x.
0x00A89480	416	crypto_rc4_decrypt_with_md5_key_derivation	Decrypts RC4-encrypted data using MD5-derived key via Windows CryptoAPI; copies input to output buffer before decryption.
0x00A89640	147	delete_hack_detection_files	Removes known cheat tool executables and config files from client directory during anti-cheat cleanup.
0x00A896E0	193	set_debug_privilege	Enables or disables SeDebugPrivilege for the current process via dynamic advapi32.dll function loading
0x00A897B0	217	CProcessScanner__EnumModulesToolhelp	Enumerates loaded modules in a process using Windows Toolhelp API, invoking callback for each module found.
0x00A89890	509	CProcessScanner__EnumProcessModules	Enumerates loaded modules for a process, invoking callback for each module across Windows 9x and modern platforms.
0x00A89BF0	220	CProcessScanner__FindProcessEntry	Searches process list snapshot for matching PID, copies PROCESSENTRY32 structure to output buffer if found.
0x00A89CD0	575	CProcessScanner__InitToolhelpOrPsapi	Initializes process scanning APIs (Toolhelp32 on Win9x, PSAPI on NT) and enables debug privileges for process introspection.
0x00A89F10	135	is_windows_9x_platform	Detects Windows 9x/ME platform by calling GetVersionExA and checking if dwPlatformId equals VER_PLATFORM_WIN32_WINDOWS (1)
0x00A89FA0	157	security_decrypt_and_type_chars	Decrypts RC4-encrypted string via MD5-derived key and simulates keyboard input to CEditCtrl by feeding each decrypted character to OnCharInput
0x00A8A0E0	268	CProcessScanner__InitInstance	Initializes process scanner instance with platform-specific WinAPI function pointers (Win9x vs NT).
0x00AA7D90	1120	CRijndael__Init	Initializes Rijndael/AES cipher with key schedule setup for encryption/decryption round keys
0x00AA8200	172	CRijndael__CleanupArrays	Securely zeroes Rijndael cipher state including encryption keys, decryption keys, IV, and round key workspace to prevent sensitive data leakage.
0x00AA82B0	35	CRijndael__ScalarDeletingDestructor	Scalar deleting destructor for CRijndael class; cleans up arrays and conditionally frees 0x474-byte object memory.
0x00AA82E0	313	CRijndael__EncryptECB	Encrypts data using Rijndael cipher in ECB mode, processing input in block-sized chunks with key schedule initialization.
0x00AA8420	313	CRijndael__DecryptECB	Decrypts data using Rijndael algorithm in ECB mode by decrypting each block and copying result to output buffer.
0x00AA8560	384	CRijndael__EncryptWithMode	Encrypts data blocks using Rijndael cipher in CBC (mode=1), CFB (mode=2), or ECB mode with IV XOR operations.
0x00AA86F0	759	CRijndael__EncryptBlock	Encrypts a data block using Rijndael cipher with variable block sizes (16/24/32 bytes), delegating 16-byte blocks to optimized handler.
0x00AA89F0	919	CRijndael__EncryptBlock16	Encrypts 16-byte blocks using Rijndael algorithm with T-table optimization and round-key XOR operations.
0x00AA8D90	916	CRijndael__DecryptBlock16	Decrypts 16-byte AES blocks using inverse T-tables and round keys; part of Rijndael cipher implementation for RO client encryption.
0x00AA9130	390	CRijndael__DecryptWithMode	Decrypts data blocks using Rijndael cipher in CBC, CFB, or ECB mode with proper IV chaining and block alignment validation.
0x00AA92C0	756	CRijndael__DecryptBlock	Decrypts Rijndael cipher blocks of variable size (20/24/32 bytes); delegates 16-byte blocks to optimized routine.
0x00AA95C0	1118	CRijndael__MakeKey	Initializes Rijndael cipher key schedule with validation of key/block lengths (16/24/32 bytes) and IV setup.
0x00AA9A20	88	CRijndael__XorBlocks	XORs two byte blocks in-place for CBC/CFB cipher mode chaining; validates initialization before operating on block data.
0x00AA9A80	35	store_uint32_le	Encodes a 32-bit unsigned integer in little-endian byte order to a 4-byte buffer
0x00AA9AB0	19	store_uint16_le	Stores a 16-bit unsigned integer in little-endian byte order at the given memory address.
0x00AA9AD0	134	MISTY1__FI_function	MISTY1 block cipher FI function performing 4 rounds of S-box substitution and XOR mixing on 32-bit input with 16-bit key material.
0x00AA9B60	742	MISTY1__EncryptBlock	MISTY1 block cipher encryption on 64-bit data using 16 round-key schedule with S-box table lookups.
0x00AA9E50	245	MISTY1__DecryptBlock	Decrypts a 128-bit MISTY1 block cipher using key schedule with S-box lookups and bit rotation transformations.
0x00AAA080	44	load_uint32_native	Dereferences and returns a 32-bit unsigned integer from the provided pointer address.
0x00AAA0B0	52	load_uint32_interleaved	Extracts interleaved 32-bit value from two consecutive dwords using byte-level masking and shifting operations.
0x00AAA0F0	83	sbox_init_and_lookup	Initializes 256-entry S-box with increments of 4 mod 256, returns lookup value for MISTY1 cipher.
0x00AAA150	23	MISTY1__S7_lookup	MISTY1 S7 cipher sbox lookup wrapper that initializes and queries substitution box with summed parameters.
0x00AAA170	25	MISTY1__S9_lookup	Performs MISTY1 S9 sbox substitution lookup by summing param_1, param_2, and 1 as index
0x00AAA190	438	MISTY1__DecryptRound	MISTY1 block cipher decryption round function processing 8-byte data blocks with S-box substitutions
0x00AAA350	420	MISTY1__EncryptRound	Performs one encryption round of MISTY1 block cipher on 8-byte data using S-box table lookups and iterative mixing
0x00AAA500	1276	MISTY1__KeySchedule	MISTY1 cipher key schedule generator - expands 8-byte key and IV into round subkeys via rotation and XOR operations
0x00AAAA40	1243	CAST5__DecryptBlock	CAST-128 block cipher decryption with 12/16 rounds; decrypts 8-byte blocks using S-box lookups and rotation
0x00AAAF20	1255	CAST5__EncryptBlock	CAST5__EncryptBlock performs CAST-128 block cipher encryption on 8-byte blocks using 4 S-boxes with 12-16 rounds.
0x00AAB410	1762	CAST5__KeySchedule	CAST-5 cipher key schedule initialization: expands key material into 4 32-bit words and generates round subkeys using S-box tables.
0x00AAC730	3207	Camellia__EncryptBlock	Implements Camellia block cipher encryption round with S-box substitution and XOR mixing using 4 lookup tables and round keys.
0x00AAD3C0	3207	Camellia__DecryptBlock	Decrypts a 128-bit block using Camellia cipher with precomputed decryption round keys via S-box lookups.
0x00AAE050	3275	Camellia__KeySchedule	Initializes Camellia cipher S-boxes on first call; expands 128/192/256-bit encryption keys into round keys
0x00AAED20	120	MISTY1__FO_function	MISTY1 cipher FO function applying S-box substitutions to mix 32-bit input with round subkey
0x00AAEDA0	124	MISTY1__Decrypt8Byte	Decrypts 8-byte MISTY1 cipher blocks using Feistel network with 8 rounds and global subkey tables
0x00AAEE20	151	MISTY1__Encrypt8Byte	Encrypts 8-byte block using MISTY1 cipher with 8 Feistel rounds and subkey XOR operations.
0x00AAEEC0	461	MISTY1__ExpandKey	Expands 8-byte MISTY1 cipher key into 8 round subkey pairs via FO function and derives 4 whitening keys.
0x00AAF090	76	Skipjack__G_permutation	Skipjack cipher G-permutation: mixes 16-bit values using two S-box tables for cryptographic transformation.
0x00AAF0E0	107	Skipjack__EncryptRoundA	Performs one round of Skipjack block cipher encryption with subkey XOR and substitution operations on 16-bit words.
0x00AAF150	107	Skipjack__DecryptRoundA	Performs inverse Skipjack block cipher decryption round (type A) using key schedule tables and 16-bit word manipulation.
0x00AAF1C0	313	Skipjack__RoundB	Skipjack cipher round B variant applying G permutation 3 times with subkey XOR operations for RO packet encryption
0x00AAF670	175	DES__GenerateSBoxPermutationTables	Generates DES S-box lookup tables and expanded permutation tables for encryption operations using XOR operations on hardcoded lookup data.
0x00AAF720	80	RC4__Init	Initializes dual RC4 cipher states (encrypt/decrypt) with KSA, validates params, resets counters to 0.
0x00AAF770	181	RC4__PRGA	Generates one RC4 keystream byte using quad S-box configuration with counter-based S-box rotation for Ragnarok packet encryption.
0x00AAF830	236	RC4__KSA	Initializes multiple RC4 S-boxes with identity permutation, then performs 8-pass key scheduling shuffling using provided key material.
0x00AAF920	1081	SEED__DecryptBlock	Decrypts a 64-bit block using SEED cipher (Korean standard) with 8 Feistel rounds on 4x16-bit words
0x00AAFD60	1081	SEED__EncryptBlock	SEED block cipher encryption with 8 rounds of Feistel network using S-box substitution on 4x16-bit state blocks.
0x00AB01A0	884	SEED__GenerateSBoxTable	Generates a 64K S-box lookup table for SEED cipher by combining bit permutations from multiple sub-tables using bit extraction and indexing.
0x00AB0520	209	DES__KeySchedule	Generates 48 DES subkeys from 16-byte input key via permuted choice and iterative encryption blocks.
0x00AB0600	412	Skipjack__EncryptBlock	Skipjack block cipher encryption: encrypts 64-bit block using 8 rounds with alternating RoundB calls and subkey operations.
0x00AB07A0	257	Skipjack__DecryptBlock	Decrypts a 64-bit block using Skipjack cipher with 32 rounds of alternating EncryptRoundA and RoundB operations
0x00AB08B0	23	crypto_clear_128bytes	Securely clears 128 bytes of memory (typically cryptographic key/state structures) by zeroing.
0x00AB08D0	921	SEAL__KeySchedule	SEAL stream cipher key schedule: expands 128-bit key into subkeys using 7-bit and 9-bit S-boxes for RO packet encryption
0x00AB0C70	1235	DEAL__ProcessBlock	Recursive Feistel cipher block processor for DEAL encryption with S-box table lookup and 64-byte SIMD XOR mixing rounds
0x00AB1150	582	SEAL__GenerateKeystream	SEAL cipher PRGA: generates keystream output from internal state using 9-bit S-box lookups and modular arithmetic
0x00AB13A0	114	SEAL__XorEncrypt	Encrypts data using SEAL stream cipher by XORing param_2 buffer with generated keystream, advancing cipher state every 1024 bytes.
0x00AB1420	114	SEAL__XorDecrypt	Decrypts data using SEAL stream cipher by XORing param_3 32-bit words with generated keystream blocks.
0x00AB14A0	418	SEAL__InitTables	Initializes SHA1-derived lookup tables by transforming seed values with varying indices into table offsets.
0x00AB1650	436	SEAL__FullKeyInit	Initializes SEAL cipher state by running SHA1 transforms to populate S-boxes and key schedule tables.
0x00AB1810	48	SEAL__RefillBuffer	Refills SEAL cipher keystream buffer by generating new keystream and incrementing block counter.
0x00AB1840	27	SEAL__SetPosition	Sets seal object position to param_2 and initializes associated state value to 0x400.
0x00AB1970	3355	MARS__ProcessBlock	MARS block cipher encryption round processor; applies Feistel network transformations with S-box substitution and bit rotation for 128-bit block encryption.
0x00AB2690	1109	DEAL__DecryptBuffer	Decrypts buffer using multi-block XOR cipher with 64-byte blocks and session-specific keys from packet header.
0x00AB2AF0	1013	DEAL__EncryptBuffer	Encrypts buffer using XOR cipher with key material, processing data in 64-byte blocks with multiple passes
0x00AB2EF0	627	RC4__BuildPermutationTables	Initializes RC4 S-box permutation tables (4-8 dimensions) using KSA for Ragnarok client cipher key scheduling.
0x00AB31C0	164	CryptoPP__InitSingleton	Initializes a 16-byte singleton object for Crypto++ with first-byte flag set to 0x01, returns success status.
0x00AB3280	18	CryptoPP__DestroySingleton	Destroys singleton instance by freeing 16-byte allocated memory if non-null pointer exists.
0x00AB3320	22	CryptoPP__CheckSingletonInit	Initializes a Crypto++ singleton and sets output parameter to 1 on success, 0 on failure.
0x00AB3340	54	CryptoPP__CleanupSingleton	Wrapper that cleans up CryptoPP singleton instance with stack canary protection during process termination.
0x00B40460	118	anticheat__check_hooks_and_debugger	Detects inline hooks and debuggers; crashes client if detected and g_serviceType is 0.
0x00C13EF0	161	DetectInlineHooks	Verifies ws2_32.dll socket functions (connect, closesocket, send, select) haven't been inline-hooked by comparing IAT pointers.
0x00C15490	105	packet_copy_buffer_noop	Identity transform that copies packet buffer to stack and back, returning original size for encryption slot passthrough.
0x00C15590	116	find_packet_signature_bytes	Locates a 6-byte packet signature pattern in memory for encryption hook installation in CPacket class.
0x00C15670	151	CPacket__InstallEncryptionHook	Initializes packet buffers and patches encryption hook by replacing code with CALL instruction to redirect packet processing.
0x00C168D0	147	Camellia__DecryptWithStoredKey	Initializes Camellia cipher key schedule on first call, then decrypts a block using hardcoded 256-bit key.
0x00C169E0	135	CPacketKey__InitScramble	Initializes packet encryption keys by extracting nibbles from seed param_2, computing XOR-scrambled values stored at offsets +4 and +0xC using param_3.
0x00C40C20	1628	entity_render_bounds_check	Validates entity rendering bounds against viewport dimensions; returns 0 if entity is outside visible area.
0x00C65BF0	132	backup_admin_equipment_log	Creates backup file of admin equipment slot 7 data by formatting JSON and appending .bak extension
0x00CFD560	755	pkt_handler__stove_purchase_request	Handles Stove SDK purchase request packets with error codes, fetches terms/starts purchase flow, formats error messages to UI.
0x00CFD8E0	397	pkt_handler__stove_item_effect_message	Handles STOVE item effect packet by displaying UI dialogs with localized messages and triggering visual effects based on effect type.
0x00CFF370	966	pkt_handler__stove_tooltip_item_info	Processes STOVE tooltip packet by parsing item data and building display name string from item table
0x00D582B0	364	CItemOwner__ScrambleValue	Obfuscates item values through iterative XOR with bit-rotated nibbles of a seed parameter for anti-cheat protection.
0x00D58420	1475	CItemOwner__DecodeObfuscatedItemId	Decodes obfuscated item IDs by removing last char, applying digit substitution cipher (0→4,1→5,etc), returns numeric ID via atoi.
0x00D58B70	381	CItemOwner__UnscrambleValue	Decrypts item value using param_2 as key via iterative bit rotation and XOR operations based on (param_2 % 6).
0x00D969C0	138	CMode__SetEncryptedData	Copies 64 bytes of encrypted data into object buffer at offset 0x794, then XOR-decrypts using key table.
0x00DBC32B	40	crt_unhandled_exception_terminate	Clears unhandled exception filter, reports exception, then terminates process with stack buffer overrun exit code.
0x00DBC353	250	crt_report_gs_failure	Captures CPU context and registers, constructs stack buffer overrun exception record (0xc0000409), invokes termination handler.
0x00DBC44D	12	crt_report_range_check_failure	CRT runtime function that terminates process with failure code 8 when a range check assertion fails
0x00DBC459	207	crt_failfast_with_code	CRT fail-fast handler capturing CPU context and exception info (STATUS_STACK_BUFFER_OVERRUN) before termination
0x00DBC528	277	crt_failfast_with_extra_params	Captures CPU context and exception parameters, then triggers fast-fail termination with context dump to global exception handler structure.
0x00DBD38D	31	crt_guard_check_icall_fastfail	Control Flow Guard (CFG) validation for indirect calls; triggers fastfail exception (int 0x29) on invalid targets
0x00DBD3AF	57	crt_guard_check_icall_dispatch	Validates indirect call target against CFG guard bitmap, then dispatches callback if target passes security checks.
0x00DBD3E8	27	crt_guard_check_icall_nop	Validates indirect call target against CFG (Control Flow Guard) valid range using arithmetic overflow check
0x00DBD403	45	crt_guard_ehcont_check_int3	CRT EH continuation guard validation - checks address range bounds and triggers breakpoint (int3) on guard violation
0x00DBD430	49	crt_guard_ehcont_check_fastfail	CRT guard validates exception handling continuation target against image bounds; triggers fastfail if out of range
0x00DBD464	76	crt_guard_ehcont_check_dispatch	CRT guard validation for exception handling continuation targets with callback dispatch to registered handler.
0x00DBD4B0	26	crt_guard_ehcont_check_nop	Validates EH continuation target address against bounds using arithmetic check for control flow guard protection.
0x00DBD4EC	283	crt_invoke_watson	CRT runtime function that creates exception record (0x40000015), invokes unhandled exception filter, and handles Watson crash reporting.
0x00DBD640	67	crt_check_pe_cfg_support	Verifies if the current PE module supports Control Flow Guard (CFG) by parsing PE headers.
0x00DEBF60	18	gg_check_status	Checks if GG (Game Guard) is initialized; if so, logs and returns GG status message result.
0x00DEBF80	188	gg_init_dep_policy	Initializes Windows dependency policy by loading and calling a system function with error logging via encrypted strings.
0x00DEC040	8	gg_identity_passthrough	Identity function that returns its parameter unchanged; used for trivial passthrough operations or callback compatibility.
0x00DEC050	65	gg_protect_memory_readonly	Sets memory region to read-only (PAGE_READONLY=2) via VirtualProtect, logs via encrypted string if handler active.
0x00DEC0A0	65	gg_protect_memory_readwrite	Sets memory page protection to PAGE_EXECUTE_READWRITE (0x4) and logs the operation if logging is enabled.
0x00DEC0F0	557	gg_initialize_context	Initializes global game context structure with mutexes, event handles, crypto/pipe subsystems, and main loop configuration.
0x00DEC320	97	gg_initialize_context_wide	Converts wide-character string to ANSI and initializes game context with the resulting buffer.
0x00DEC3A0	68	gg_start_monitoring	Initializes game guard monitoring state and writes activation command to pipe if not already active
0x00DEC3F0	30	gg_set_game_path	Wrapper that validates game path initialization flag before delegating to noop handler function.
0x00DEC410	109	gg_set_game_path_wide	Converts wide-character game path to ANSI and delegates to gg_set_game_path for path configuration.
0x00DEC480	30	gg_check_process	Wrapper that conditionally invokes game guard process verification check if anti-cheat module is enabled
0x00DEC4A0	33	gg_check_process_ex	Wrapper that conditionally invokes process check reporting if anti-cheat gate is enabled via DAT_01604a0c flag.
0x00DEC4D0	36	check_gameguard_enabled_wrapper	Wrapper that checks if GameGuard is enabled (DAT_01604a0c) before delegating to stack probe check.
0x00DEC500	30	gg_check_module	Checks if a game module is loaded/enabled, then reports the module check result if conditions are met.
0x00DEC520	52	gg_start_and_check	Conditionally initiates GameGuard monitoring and reporting if enabled and param is non-null.
0x00DEC560	98	gg_start_and_check_wide	Converts wide-char string to multibyte and calls gg_start_and_check for game guard initialization
0x00DEC5D0	13	gg_set_callback	Sets the GameGuard manager callback function pointer for protection event handling
0x00DEC5E0	98	gg_set_server_address	Sets game server address after validation, logs encrypted change if logging enabled
0x00DEC650	31	gg_send_auth_data	Validates authentication callback state and delegates to gg_call_auth_callback with parameters; returns error code 2 if uninitialized.
0x00DEC670	23	gg_notify_event	Conditional wrapper that routes authentication events to processing if global flag DAT_01604a0c is enabled.
0x00DEC690	110	gg_set_game_dir_ansi	Sets game directory from ANSI string, validates path length <260 chars, stores in global buffers and converts to wide char
0x00DEC700	129	gg_set_game_dir_wide	Sets game directory from wide-char string, converts to ANSI, validates path length < 260 chars
0x00DEC7A0	71	gg_set_ini_path_ansi	Validates and copies ANSI INI file path (max 260 chars) to global buffer at offset 0x1603dcf
0x00DEC7F0	157	gg_set_ini_path_wide	Converts wide-character INI file path to ANSI and delegates to gg_set_ini_path_ansi with length validation.
0x00DEC8D0	29	gg_get_filename_from_path_ansi	Extracts filename from a file path by finding the last backslash and returning the substring after it, or the original path if no backslash exists.
0x00DEC8F0	30	gg_get_filename_from_path_wide	Extracts filename from wide-character path string by finding last backslash separator.
0x00DEC910	69	gg_count_matching_entries	Counts guild members matching a given name by iterating through 50-entry guild member array with case-insensitive string comparison.
0x00DECAA0	42	gg_find_free_slot	Finds first non-zero slot in array of 50 elements, skipping specified index, returns slot index or 0xFFFFFFFF if none found
0x00DECB00	53	gg_hash_string_ci_ansi	Computes case-insensitive hash of ANSI string using polynomial rolling hash (multiplier 0x1f, OR 0x20 for lowercase).
0x00DECB40	66	gg_hash_string_ci_wide	Computes case-insensitive hash of wide-character (UTF-16) string using polynomial rolling hash with multiplier 31.
0x00DECB90	77	gg_find_entry_by_name	Searches a fixed-size array of 50 entries (800 bytes each) for matching name using case-insensitive comparison, returns index or -1.
0x00DECBE0	76	gg_find_entry_by_prefix	Searches a fixed-size array (50 entries × 800 bytes) for first non-null entry matching prefix, returns index or -1
0x00DECC30	238	gg_find_entry_by_hwnd	Searches a fixed-size array of 50 entries for a window handle match, supporting parent/child hierarchy checks via param_2 flag.
0x00DECD20	46	gg_find_entry_by_field1	Linear search through guild member/guild info array (50 entries, 200-byte stride) by field offset +4, returns index or 0xffffffff if not found
0x00DECD50	40	gg_hash_string_cs	Computes case-sensitive hash of null-terminated string using polynomial rolling hash (multiplier 0x1f).
0x00DECD80	121	gg_is_window_in_rect	Checks if a window's rectangle intersects with a given rectangular bounds using left/right and top/bottom comparisons.
0x00DECE00	105	gg_any_entry_overlaps_rect	Iterates through up to 50 window entries checking if any overlap with given rectangle using collision detection.
0x00DECEA0	32	gg_entry_has_flags	Checks if a guild entry at index param_1 has specific flags set in its flag field (offset +32 bytes)
0x00DECED0	48	gg_any_entry_has_flags	Iterates through max 50 game entries checking if any has matching flags set in bitfield at offset +32 bytes
0x00DECF00	48	gg_entry_has_type	Checks if game entry at index param_1 exists and has type matching param_2 from fixed-size array at DAT_01604a6c
0x00DECF30	48	gg_has_entry_with_field7	Searches up to 50 entries (200-byte stride) for a match on field[7]; returns 1 if found, 0 otherwise.
0x00DECF60	55	gg_entry_matches_field7_and_flags	Validates guild/group entry: checks bounds, existence, matches field7 (ID), and flags bitwise AND with param3.
0x00DECFA0	66	gg_find_entry_field7_with_flags	Searches entry table (max 50 entries) for matching ID at offset +28, validates flags at offset +32 against param_2 mask.
0x00DECFF0	59	gg_has_entry_in_pid_range	Searches a fixed-size array (50 entries) for a PID within valid range bounds; returns 1 if found, 0 if not.
0x00DED030	48	gg_has_entry_with_pid	Searches a fixed-size array of 50 entries (200-byte stride) for a matching process ID at offset +4, returns 1 if found.
0x00DED060	48	gg_has_entry_with_field6	Searches array of ~50 entries (200-byte stride) for match on field offset +24, returns 1 if found else 0
0x00DED090	29	gg_is_hwnd_tracked	Checks if a window handle is tracked by searching for a matching entry in the tracking list.
0x00DED0B0	47	gg_string_starts_with_ci	Case-insensitive string prefix comparison using multibyte character support (_mbsnbicmp).
0x00DED0E0	39	gg_is_slot_active	Validates if equipment slot param_1 is active by checking bounds (< 50) and non-null slot data at offset in DAT_01604a6c array.
0x00DED110	483	gg_decrypt_string_ansi	Decrypts/encrypts ANSI strings using XOR cipher with thread-local buffer caching for RO network packets.
0x00DED300	419	gg_decrypt_string_ansi_global	Decrypts ANSI strings with XOR cipher using seed bytes; caches and re-encrypts previous string in global buffer.
0x00DED4B0	128	gg_decrypt_string_ansi_simple	Decrypts ANSI string with 0x01 header marker using XOR cipher with derived key from bytes 1-3.
0x00DED530	242	gg_encrypt_string_ansi	Encrypts ANSI string using XOR cipher with seed-derived keys, stores result in static buffer with length metadata.
0x00DED630	230	gg_decrypt_hex_string	Decodes hex string to bytes, then decrypts using XOR cipher with key derived from bytes 1-3 and length from bytes 2-3.
0x00DED720	365	gg_encrypt_to_hex_string	Encrypts data with XOR cipher using param_2 as key, encodes result as hex string with length header
0x00DED890	123	gg_unescape_hex_string	Converts escaped hex sequences (\\xx format) in strings to raw bytes, then applies simple decryption.
0x00DED910	441	gg_decrypt_and_cache_string_wide	Decrypts wide-char string with marker byte, caches result, and re-encrypts previous cached string using XOR cipher.
0x00DEDAD0	145	gg_decrypt_string_wide_simple	Decrypts wide-character string with XOR cipher using derived keys from header bytes at indices 1-3.
0x00DEDB70	235	gg_encrypt_string_wide	Encrypts wide-character string using XOR cipher with key derived from first character, stores result in static buffer with length metadata.
0x00DEDC60	102	gg_get_critical_section	Thread-safe lazy initialization of a critical section with epoch-based synchronization for multi-threaded access.
0x00DEDCD0	170	gg_stristr_ansi	Case-insensitive substring search using multi-byte string duplication and lowercase conversion for RO client text matching.
0x00DEDD80	182	gg_stristr_wide	Case-insensitive wide-character substring search; returns pointer to first match in haystack or original pointer if needle is empty
0x00DEDE40	178	gg_pipe_context_init	Initializes pipe context structure with zeroed buffers, timestamp-based seed, and sentinel values for connection state.
0x00DEDF90	1674	gg_pipe_reader_thread	Thread function that reads from a named pipe, processes game commands (0x60e-0x618), and handles heartbeat/timeout logic for RO client-server communication.
0x00DEE640	46	gg_pipe_context_set_handles	Initializes pipe context with read/write handles and starts reader thread if both handles are valid
0x00DEE6B0	67	gg_pipe_start_reader	Initializes a named pipe reader by creating an event and spawning a dedicated reader thread to handle pipe communications.
0x00DEE700	4	gg_pipe_get_auth_data_ptr	Returns pointer to authentication data field at offset 0x1c within a pipe/packet structure.
0x00DEE710	7	gg_pipe_get_stderr_read_handle	Returns stderr pipe read handle from process structure at offset 0x2a50
0x00DEE720	7	gg_pipe_get_stderr_write_handle	Retrieves the stderr write handle stored at offset 0x2a5c from a pipe/process management object.
0x00DEE730	7	gg_pipe_get_update_buf_ptr	Returns pointer to update buffer at offset 0x238 within a pipe/connection structure
0x00DEE740	7	gg_pipe_get_update_buf_size	Retrieves the update buffer size from a pipe structure at offset 0x638.
0x00DEE750	7	gg_pipe_get_data_buf_ptr	Returns pointer to data buffer within pipe structure at fixed offset 0x63c from base address
0x00DEE760	7	gg_pipe_get_data_buf_size	Returns the data buffer size field from a pipe/IPC structure at offset 0x163c
0x00DEE770	4	gg_pipe_get_name_buf_ptr	Returns pointer to name buffer at offset 0x34 within pipe structure/object at param_1
0x00DEE790	288	gg_pipe_setup_stdio_redirect	Sets up stdio redirection by creating pipes for stdout/stderr and duplicating handles for subprocess communication.
0x00DEE8B0	1010	gg_pipe_write_message	Writes formatted messages to pipe file handle; handles packet types 0x63c/0x63d (basic), 0x630/0x632 (loop copy), 0x613 (string)
0x00DEECD0	103	gg_pipe_restore_and_start_reader	Restores stdout/stderr handles, creates manual-reset event, and spawns pipe reader thread for IPC communication.
0x00DEED40	140	gg_pipe_write_with_dedup	Deduplicates consecutive identical game packets (0x619-0x61d) by tracking repetition count, suppresses after 2 duplicates.
0x00DEEDD0	30	gg_init_buffer_struct	Initializes a buffer structure by zeroing 0x204 bytes and setting size field to 0x208 (520 bytes total).
0x00DEEDF0	199	gg_crypto_init	Initializes a cryptographic provider handle via CryptoAPI, with thread-safe critical section protection for concurrent access.
0x00DEEEC0	162	gg_crypto_cleanup	Cleans up cryptographic resources including hash objects, keys, crypto provider context, and mapped file memory with thread synchronization.
0x00DEEF90	128	gg_crypto_ensure_buffer	Allocates or reallocates a buffer to requested size with thread-safe synchronization; returns success status.
0x00DEF010	1485	gg_crypto_verify_signature_v1	Verifies digital signature on PE executable by reading/loading file, parsing PE headers, and validating signature data.
0x00DEF5E0	1363	gg_crypto_verify_signature_v2	Verifies digital signature on PE executable by extracting certificate from file/buffer and validating against embedded signature data.
0x00DEFB40	55	gg_checksum_words	GameGuard: computes checksum over 16-bit word array for integrity verification
0x00DEFB80	947	gg_crypto_decrypt_file_to_buf	Decrypts Ragnarok game data file to buffer using CryptoAPI, validates magic headers (0x32812622/0x32812621)
0x00DEFF40	896	gg_crypto_decrypt_file_to_buf2	Decrypts a Ragnarok Online game file, validates magic signatures (0x32812622, 0x32812624), extracts headers and compressed data into buffer
0x00DF02C0	155	gg_crypto_hash_and_transform	Extracts hash from crypto context, derives RC4 key, and decrypts/encrypts data payload using RC4 cipher.
0x00DF0360	333	gg_crypto_mmap_file	Memory-maps a file into process space, optionally computing CRC32 checksum for integrity verification with thread-safe critical section locking.
0x00DF04B0	153	gg_pe_checksum_verify	Verifies PE checksum by computing word checksum and comparing against embedded PE header value, outputs computed vs expected checksums.
0x00DF0550	60	gg_crypto_set_flag	Sets a flag byte at offset 0x10 in a crypto object with thread-safe critical section protection.
0x00DF0590	173	gg_crc32_generate_table	Generates standard CRC32 lookup table with polynomial 0xEDB88320 for 256 entries used in packet/data validation
0x00DF0640	3	gg_noop	Empty function stub with no operation; used as placeholder or intentional no-op in control flow.
0x00DF0650	323	gg_crc32_compute_file	Computes CRC32 checksum of a file by reading it in 4KB chunks and updating hash with lookup table
0x00DF07A0	323	gg_crc32_compute_file_wide	Computes CRC32 checksum of a wide-character file path by reading in 4KB chunks and XORing with lookup table.
0x00DF08F0	37	gg_crc32_compute_buffer	Computes CRC32 checksum of a buffer by initializing to 0xFFFFFFFF, processing data, and inverting final result.
0x00DF0920	432	gg_crc32_compute_file_partial	Computes partial CRC32 checksum of file from offset, reading in 4KB chunks and updating hash via lookup table.
0x00DF0AD0	34	gg_crc32_compute_memory	Computes CRC32 checksum of memory buffer by initializing state, updating with data, and finalizing with bitwise complement.
0x00DF0B00	80	gg_crc32_update_buffer	Updates CRC32 checksum by processing buffer bytes using lookup table at param_1 offset, returns error if buffer null
0x00DF0B50	94	gg_destroy_string_range	Gg destroy string range
0x00DF0BC0	157	gg_copy_string_to_slot	Copies a C++ std::string to a fixed/dynamic slot, handling SSO and heap allocation based on string length.
0x00DF0C60	46	gg_sprintf_safe	Allocates JSON memory and performs safe formatted string printing, returning result or -1 on error.
0x00DF0C90	78	gg_read_line	Reads a single line from a string buffer into output buffer, handles \r\n line endings, max 1022 chars.
0x00DF0CE0	343	gg_parse_config_entry	Parses a game config entry from JSON, validates it via Lua, and stores error codes or appends to a string vector.
0x00DF0E40	129	gg_read_config_value	Reads formatted config value from INI, parses it via JSON allocator, and converts result to integer using Lua sscanf.
0x00DF0ED0	208	gg_parse_ini_sections	Parses INI file section headers (bracketed names) into a null-terminated buffer, returns count of sections parsed or -1 on error.
0x00DF0FA0	585	gg_parse_ini_value_with_log	Parses INI file for section and key match, extracts value into buffer with logging and vector storage.
0x00DF11F0	425	gg_parse_ini_value	Parses INI file to extract value for given section and key, returns length or default if not found.
0x00DF13A0	1166	gg_rc4_crypt	RC4 stream cipher encryption/decryption with 8-byte loop unrolling for RO packet obfuscation
0x00DF1830	350	gg_rc4_key_setup	RC4 key scheduling algorithm (KSA) initialization for Ragnarok Online packet encryption with custom S-box setup.
0x00DF1990	47	gg_encrypt_blocks_16	Encrypts multiple 16-byte blocks sequentially by calling gg_block_encrypt_16 on each block until param_2 bytes are processed.
0x00DF19C0	3333	gg_block_encrypt_16	Encrypts 16-byte block using CAST-128 cipher with 32 round keys from param_2 schedule
0x00DF26D0	2701	xtea_key_schedule	Expands 128-bit XTEA cipher key into 6 round subkeys using TEA constants and S-box lookups
0x00DF3160	138	gg_decrypt_blocks_padded	Decrypts padded data blocks in 16-byte chunks, padding final block with zeros before decryption.
0x00DF31F0	3333	gg_block_decrypt_16	Decrypts 16-byte Ragnarok packet block using TEA-like cipher with 6 rounds of table-based substitution
0x00DF3F00	241	gg_init_crypto_keys	Initializes XTEA encryption keys by XORing input string with hardcoded values, then schedules keys for two cipher contexts.
0x00DF4000	240	gg_decrypt_and_verify_block	Decrypts game packet block, verifies magic number and CRC32 checksum, returns payload size or 0 on failure
0x00DF40F0	240	gg_decrypt_and_verify_block2	Decrypts and verifies a 16-byte block using CRC32 checksum, returns decrypted size or 0 on failure.
0x00DF41E0	287	gg_encrypt_and_sign_block	Appends packet counter, CRC32 checksum, and packet size to block, then encrypts it for RO network transmission.
0x00DF4310	126	gg_hashmap_find	Searches a hash map for a key, returns pointer to node and insertion position via output parameters.
0x00DF4390	542	gg_hashmap_insert	Inserts a key-value pair into a hash map with automatic rehashing when load factor threshold exceeded.
0x00DF4620	15	gg_hash_xor_deadbeef	XORs a 32-bit value with magic constant 0xdeadbeef; likely packet encryption/decryption in RO network protocol
0x00DF4630	31	gg_fill_range	GameGuard: fills a memory range with a constant value
0x00DF4650	513	gg_hashmap_init	Initializes a hash map structure with linked list buckets, critical section lock, and resizes to initial capacity of 16.
0x00DF4860	23	gg_context_memzero	Zeroes 0x268 bytes of memory, likely initializing a game context structure to all zeros.
0x00DF48A0	53	gg_free_aligned_buffer	Frees aligned buffer with validation; checks alignment and delegates to operator delete with size parameter.
0x00DF4930	52	gg_free_aligned_buffer2	Frees aligned buffer with validation; checks alignment offset and deallocates via operator delete with size parameter.
0x00DF49E0	145	gg_hashmap_destroy	Destroys hashmap by freeing allocated memory, virtual memory, clearing zip hash, and deleting critical section lock.
0x00DF4A80	170	gg_register_entry	Validates and inserts a game entry structure into a hashmap, extracting 17 fields from input buffer starting at offsets 0x0-0x4c.
0x00DF4B30	593	gg_load_config_file	Loads and parses a game configuration file from disk, resolving relative paths and mapping file contents into memory for processing.
0x00DF4D90	141	gg_save_config_file	Writes configuration data to file at offset 0x1b9, deleting existing file first; returns error code on validation failure.
0x00DF4E20	74	validate_config_param	Validates a configuration parameter pointer; returns error code 0x164 if null, otherwise halts on corrupted data.
0x00DF5250	101	str_replace_char	Replaces all occurrences of param_2 with param_3 in a string; returns pointer to string end or decrypted fallback string.
0x00DF52C0	97	gg_close_internet_handles	Closes WinINet handles (connection and request) stored at offsets 0x90 and 0x8c when conditions are met.
0x00DF5330	657	gg_collect_and_zip_logs	Collects filtered log files from game directory, compresses them into ZIP archive with temporary copies.
0x00DF55D0	202	gg_prepare_http_request	Throttles HTTP requests to 100ms intervals, validates state flags, manages critical section locks for thread safety
0x00DF5770	337	gg_get_error_string	Maps error code (1-19) to encrypted error message strings, decrypts and copies to output buffer via _mbsnbcpy.
0x00DF58D0	165	gg_hashmap_remove	Removes a hashmap entry by key, unlinks it from collision chain, decrements count, and frees the 96-byte node.
0x00DF5980	66	gg_unregister_entry	Removes a hashmap entry by lookup key pair; returns 0 on success or error code (0x6f/0x70) on invalid params/not found.
0x00DF59D0	29	gg_enter_critical_section	Conditionally enters a critical section if param_2 is null and DebugInfo is initialized.
0x00DF59F0	216	gg_load_config_and_log	Loads configuration file with decrypted path, validates checksum (0x162e), logs result, returns config hash.
0x00DF5AD0	186	gg_start_session	Initiates a game session with critical section protection; returns error code if param invalid or session already active.
0x00DF5BE0	215	gg_session_init	Initializes session structures with zeroed buffers (1024+100+100 bytes); corrupted/incomplete function with bad instruction data
0x00DF6500	204	gg_update_entry	Wrapper for gg_update_entry_impl with validation checks and critical section locking for thread-safe entry updates.
0x00DF6630	511	gg_update_entry_impl	Updates a game entry by hashing and encoding file data across multiple character encodings for patch/update verification.
0x00DF6E20	574	gg_generate_hwid	Generates hardware ID by collecting CPUID info, disk serial, and hashing them for client authentication.
0x00DF7060	31	gg_validate_entry	Validates a game entry string by checking if non-empty, then performs lookup operation on the entry with 32-byte offset.
0x00DF7080	152	concatenate_and_hash_strings	Concatenates two strings and returns case-sensitive hash of result without storing concatenated string.
0x00DF7120	175	gg_lookup_entry_wide	Converts ANSI string to wide char and performs game guard entry lookup with validation flags.
0x00DF71D0	1391	resolve_game_guard_file_path	Resolves GameGuard file paths by constructing system directory paths and decrypting/caching string resources for file validation
0x00DF7740	586	gg_scan_processes	Scans process entries against a lookup table, matches names/flags, and accumulates bit flags into output parameter based on matched attributes.
0x00DF7990	186	gg_get_module_info	Retrieves module information with thread-safe critical section protection; returns status codes (100, 107, or wide query result).
0x00DF7AA0	215	initialize_module_info_buffers	Initializes local buffers for module information storage; corrupted/incomplete function with bad instruction data preventing full analysis.
0x00DF83B0	216	gg_log_encrypted_message	Logs an encrypted message to file with hash verification and decryption, returning encrypted output for further processing.
0x00DF8490	851	gg_get_hardware_ids	Retrieves hardware MAC addresses from network adapters via GetAdaptersInfo, prioritizing non-loopback/non-PPP adapters.
0x00DF87F0	115	gg_get_cached_value_or_default	Retrieves cached value from hashmap by XOR-hashed key, returns default if not found or key is null.
0x00DF8870	47	gg_get_cached_hashed_value	Returns cached value from hashed concatenation of two strings, or zero if params invalid.
0x00DF88A0	989	gg_enumerate_adapters	Enumerates network adapters from Windows Registry, queries adapter properties and MAC addresses using RegCreateKeyExA/RegQueryValueExA APIs.
0x00DF8C80	936	gg_enumerate_adapters2	Enumerates network adapters via Windows Registry, decrypts config keys using time-based cipher, stores adapter data in JSON format.
0x00DF9030	1871	gg_network_init	Initializes network session with decrypted credentials; opens WinINet connection and formats JSON configuration for GameGuard authentication.
0x00DF97E0	9	gg_retrieve_global_flag_from_cache	Wrapper that retrieves a cached hashed global flag value from storage.
0x00DF97F0	156	gg_set_global_state	Conditionally invokes virtual method at offset 0x5c with multiple parameters, checks global disable flag at 0x01606869
0x00DF98F0	29	gg_leave_critical_section	Conditionally leaves a critical section if param_2 is null and DebugInfo is initialized.
0x00DF9910	123	gg_log_message	Formats a message using vsprintf into a buffer and invokes a callback function pointer stored at offset 0x6c.
0x00DF9990	619	gg_log_to_file	Loads log file into memory, validates CRC32 checksum, and caches the data for game logging operations.
0x00DF9C00	141	gg_log_flush	Writes data buffer to a log file, deleting existing file first; returns error codes 0x151/0x152 on invalid params.
0x00DF9C90	69	validate_log_handle	Validates log handle parameter; returns error code 0x154 if handle is null/invalid.
0x00DF9FD0	707	resolve_module_export	Resolves exported function addresses from PE modules, handling forwarded exports and recursive module loading via GetProcAddress.
0x00DFA2F0	320	gg_verify_downloaded_file	Validates downloaded file integrity by checking critical data structures (offsets 0x8c, 0x90, 0x204, 0x424, 0x864) before performing update.
0x00DFA490	1340	gg_perform_update	Initializes game guard update process, establishes wininet connection, clears buffers, prepares decryption structures for client patching.
0x00DFBE90	231	gg_http_connect	Validates HTTP connection state and initiates POST request with critical section protection; returns error codes for invalid state.
0x00DFBFD0	1043	gg_http_post	HTTP POST request handler for RO client that establishes WinInet connection and processes encrypted game server communication data.
0x00DFD590	226	gg_http_download_file	Wrapper for HTTP file download with validation checks for critical section and download state flags.
0x00DFD6D0	1025	gg_http_download_impl	Downloads HTTP content for RO client; initializes WinINet connection, buffers URL/headers, handles request parameters
0x00DFED00	236	gg_http_send_data	Validates HTTP send prerequisites and dispatches multipart data transmission with critical section protection and error codes.
0x00DFEE50	291	gg_http_multipart_prepare_or_corrupt	Initializes multipart HTTP request buffers; corrupted/incomplete function with bad instruction data halting execution.
0x00DFF900	13	set_game_state_field_at_0x6c	Sets a 4-byte value at offset 0x6c in a game state structure; likely stores game state or configuration data.
0x00DFF910	208	gg_hashmap_resize	Resizes a dynamic array container by allocating new memory, copying existing elements, and freeing old allocation.
0x00DFF9F0	363	gg_hashmap_rehash	Rehashes a hash map by resizing its bucket array and reordering entries based on hash values and priority.
0x00DFFB60	385	gg_wininet_init	Initializes WinINet module by loading library and resolving 8 exported function pointers with encrypted names.
0x00DFFCF0	229	decode_hex_string_with_xor_decryption	Decodes hex string to bytes, then XORs decrypted payload using derived key based on magic byte 0x02
0x00DFFDE0	332	decode_buffer_with_xor_cipher	Decodes/decrypts a buffer using XOR cipher with param_2 as key material, outputs hex string representation.
0x00DFFF30	360	gg_initialize_connection_context	Initializes connection context with default values, system info, hardware ID, and time-based decrypted configuration data.
0x00E02580	435	gg_detect_windows_version	Detects Windows version via RtlGetVersion, sets global DAT_01606874 with GameGuard-specific version identifier codes.
0x00E02740	675	gg_get_proc_address_manual	Manually walks PE export table to resolve function addresses by name/ordinal, handling forwarded exports recursively to bypass IAT hooks.