Security
CCipher (AES/DES/Rijndael/CAST5/ARIA/etc.), SHA/MD5, MT19937, BCrypt, CAntiCheat, XOR decrypt, TLS encrypted strings, XXH3
| Address | Size | Name | Description |
|---|---|---|---|
| 0x00401CD0 | 1668 | md5_transform_block | MD5 compression: 64-round transform on 16-dword block per RFC 1321 |
| 0x00402360 | 187 | md5_update | MD5 update: processes input in 64-byte blocks via md5_transform_block |
| 0x00402420 | 254 | md5_finalize | MD5 finalize: pads with 0x80, appends 64-bit length, outputs 16-byte digest |
| 0x00402520 | 94 | md5_compute_hash | Initializes MD5 state, updates and finalizes in one call |
| 0x00402580 | 190 | md5_hash_to_uint32 | Computes MD5 of data+size, XOR-folds 16-byte digest to 4-byte hash |
| 0x00402640 | 207 | md5_hash_string_to_uint32 | Computes MD5 of null-terminated string, XOR-folds to 4-byte hash |
| 0x00402770 | 472 | md5_hash_file_to_uint32 | Memory-maps file (capped 500MB), computes MD5, XOR-folds to 4 bytes |
| 0x00402B60 | 108 | CCrypto__release_handles | Releases CryptoAPI handles: hash, keys, context via CryptDestroy* |
| 0x00410780 | 262 | tls_decrypt_string_00410780 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x00410F40 | 262 | tls_decrypt_string_00410f40 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x00411FB0 | 246 | tls_decrypt_string_00411fb0 | Decrypts shorter TLS encrypted string using XOR key pair, stores in global pointer |
| 0x00412660 | 246 | tls_decrypt_string_00412660 | Decrypts shorter TLS encrypted string using XOR key pair, stores in global pointer |
| 0x00412D10 | 262 | tls_decrypt_string_00412d10 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x00412F20 | 262 | tls_decrypt_string_00412f20 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x00413130 | 262 | tls_decrypt_string_00413130 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x004137F0 | 232 | tls_decrypt_string_004137f0 | Decrypts TLS encrypted string variant using XOR key pair, stores in global pointer |
| 0x00415750 | 262 | tls_decrypt_string_00415750 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x00415FE0 | 262 | tls_decrypt_string_00415fe0 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x004163F0 | 232 | tls_decrypt_string_004163f0 | Decrypts TLS encrypted string variant using XOR key pair, stores in global pointer |
| 0x00416B90 | 248 | tls_decrypt_string_00416b90 | Decrypts TLS string at offset 0x14f8 with XOR keys 0x6d070127/0x2ff3c503 |
| 0x004199B0 | 262 | tls_decrypt_string_004199b0 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x0041A010 | 262 | tls_decrypt_string_0041a010 | Decrypts TLS-stored encrypted string using XOR key pair, stores in global pointer |
| 0x004A5310 | 246 | tls_init_encrypted_string_004a5310 | TLS static init: copies 10-byte encrypted blob to TLS field at offset 0xa970, decrypts via xor_decrypt_buffer on first access, stores pointer in global. Uses TLS destructor for cleanup. |
| 0x004D3320 | 198 | XXH32_hash_buffer | XXH32 hash function for arbitrary-length input buffer |
| 0x004D33F0 | 15 | XXH32_canonicalize | Converts 32-bit hash to canonical big-endian byte order |
| 0x004D3400 | 33 | XXH3_state_copy_48bytes | Copies 48-byte (12 dwords) XXH3 state structure |
| 0x004D3440 | 76 | XXH3_state_finalize_digest | Finalizes XXH3 streaming state and produces hash digest |
| 0x004D3490 | 131 | XXH32_finalize_tail | Processes remaining tail bytes for XXH32 hash with avalanche mixing |
| 0x004D3540 | 12 | XXH32_read_canonical | Reads and byte-swaps 32-bit canonical hash value |
| 0x004D3550 | 102 | XXH3_state_reset_with_seed | Resets XXH3 state with initial seed and prime constants |
| 0x004D35C0 | 413 | XXH3_state_update | Updates XXH3 streaming hash state with input data block |
| 0x004D3760 | 2736 | XXH3_128bit_hash | Computes XXH3 128-bit hash of input buffer with default secret |
| 0x004D48E0 | 44 | XXH3_state_reset_default | Resets XXH3 hash state with default secret key at DAT_010d4c40 |
| 0x004D4910 | 55 | XXH3_state_reset_custom_secret | Resets XXH3 hash state with custom secret, validates min 136 bytes |
| 0x004D4950 | 69 | XXH3_state_reset_with_seed_secret | Resets XXH3 hash state with seed and custom secret, min 136 bytes |
| 0x004D49A0 | 193 | XXH3_state_reset_rekeyed | Resets XXH3 hash state with new seed, re-derives internal keys |
| 0x004D7930 | 2932 | XXH3_128bit_hash_with_seed | Computes XXH3 128-bit hash with seed using length-dependent paths |
| 0x004D84B0 | 1619 | XXH3_64bit_hash_default | Computes XXH3 64-bit hash with default secret key |
| 0x004D9120 | 44 | XXH3_64bit_state_reset_default | Resets XXH3 64-bit hash state with default secret |
| 0x004D9150 | 55 | XXH3_64bit_state_reset_custom | Resets XXH3 64-bit hash state with custom secret, min 136 bytes |
| 0x004D9190 | 69 | XXH3_64bit_state_reset_seeded | Resets XXH3 64-bit state with seed and custom secret, min 136 bytes |
| 0x004D91E0 | 193 | XXH3_64bit_state_reset_rekeyed | Resets XXH3 64-bit state with new seed, re-derives internal keys |
| 0x004DB600 | 1818 | XXH3_64bit_hash_with_seed | Computes XXH3 64-bit hash with seed using length-dependent paths |
| 0x004DBD20 | 166 | XXH3_accumulate_stripe_128 | Accumulates one 64-byte stripe into XXH3 128-bit accumulator state |
| 0x004DBDD0 | 22 | XXH3_copy_state_576bytes | Copies 576-byte (0x90 dwords) XXH3 internal state structure |
| 0x004DBE30 | 30 | XXH3_free_aligned_buffer | Frees aligned buffer using stored offset byte before pointer |
| 0x004DBE50 | 401 | XXH3_encrypt_buffer_ctr | XOR-encrypts buffer using XXH3 128-bit hash in CTR mode |
| 0x004DC090 | 1041 | XXH3_128bit_hash_long_internal | Internal XXH3 128-bit hash for inputs >= 241 bytes with striping |
| 0x004DC930 | 2230 | XXH3_128bit_hash_long_seeded | XXH3 128-bit hash for long inputs >= 241 bytes with seed |
| 0x004DD1F0 | 978 | XXH3_64bit_hash_long_default | XXH3 64-bit hash for long inputs >= 241 bytes with default secret |
| 0x004DDA00 | 2054 | XXH3_64bit_hash_long_seeded | XXH3 64-bit hash for long inputs >= 241 bytes with seed |
| 0x004DE210 | 88 | XXH3_derive_secret_from_seed | Derives custom secret by adding seed pair to default secret (DAT_010d4c40). Iterates 12 times over 16-byte blocks, adding +seed to first 8 bytes and -seed to second 8 bytes of each block. |
| 0x004DE270 | 1457 | XXH3_128bit_hash_medium | XXH3 128-bit hash for medium inputs 129-240 bytes |
| 0x004DE830 | 629 | XXH3_64bit_hash_medium | XXH3 64-bit hash for medium inputs 129-240 bytes |
| 0x004DEAB0 | 235 | XXH3_scramble_accumulator | Scrambles XXH3 accumulator state with secret key material |
| 0x004DEBA0 | 204 | XXH3_init_custom_secret | Initializes XXH3 custom secret from base secret and seed pair |
| 0x004DEC70 | 115 | XXH3_len4to8_64bit | XXH3 64-bit hash specialized for 4-8 byte inputs |
| 0x004DECF0 | 206 | XXH3_mix16bytes_seed | Mixes 16 bytes of input with secret and seed for XXH3 |
| 0x004DEDC0 | 850 | XXH3_mix16bytes_accumulate | Accumulates 16-byte input block into XXH3 hash state |
| 0x004DF120 | 77 | XXH64_avalanche | XXH64 avalanche finalization step. Applies three rounds of multiply-shift-xor mixing to produce the final hash value. |
| 0x004DF170 | 23 | XXH64_canonicalize | Converts 64-bit hash value to canonical big-endian byte order. Byte-swaps both 32-bit halves and stores them in reversed order for network-portable representation. |
| 0x004DF190 | 59 | XXH64_state_copy_88bytes | Copies 88 bytes (22 uint32 fields) from source struct to destination struct. Used for XXH64 state copy operations. |
| 0x004DF1E0 | 530 | XXH64_avalanche_step3 | Third step of XXH64 avalanche hash finalization |
| 0x004DF400 | 413 | XXH3_len1to3_64bit | XXH3 64-bit hash specialized for 1-3 byte inputs |
| 0x004DF5E0 | 144 | XXH3_init_custom_secret_from_seed | Initializes an XXH3 custom secret array (80 bytes / 20 uint32s) from a seed value. Applies seed offsets derived from XXH prime constants (0xc2b2ae3d, 0x27d4eb4f, 0x9e3779b1, 0x85ebca87) to generate 5 64-bit secret segments. |
| 0x004DF670 | 61 | XXH64_round | XXH64 round function. Multiplies input by PRIME2, adds to accumulator, rotates left by 31, then multiplies by PRIME1. |
| 0x004DF6B0 | 557 | XXH64_update | XXH64 streaming update: processes input data in 32-byte blocks using XXH64_round on 4 accumulator lanes. Buffers incomplete blocks for later processing. Standard XXH64 update implementation. |
| 0x005A45E0 | 87 | xor_decrypt_buffer | XOR decrypts buffer in-place using 64-bit key |
| 0x005A4760 | 450 | load_encrypted_effect_resource_A | Decrypts resource path from TLS, creates effect at positions |
| 0x005A4930 | 450 | load_encrypted_effect_resource_B | Decrypts resource path from TLS, creates effect at positions |
| 0x005A50B0 | 497 | load_encrypted_effect_resource_C | Decrypts 0x12-byte resource path, loads effect at +0x110 |
| 0x005A52B0 | 497 | load_encrypted_effect_resource_D | Decrypts 0x10-byte resource path, loads effect at +0x110 |
| 0x005A54B0 | 518 | load_encrypted_effect_resource_E | Decrypts 8-byte resource path, loads effect, sets scale 0.9f |
| 0x005A56C0 | 497 | load_encrypted_effect_resource_F | Decrypts 0x14-byte resource path, loads effect at +0x110 |
| 0x005A58C0 | 497 | load_encrypted_effect_resource_G | Decrypts 0x14-byte resource path, loads effect at +0x110 |
| 0x005A6260 | 513 | load_encrypted_effect_resource_H | Decrypts 0x10-byte resource, loads effect, calls vtable+0x38 |
| 0x005A6A00 | 497 | load_encrypted_effect_resource_J | Decrypts 0x11-byte resource, loads effect at +0x110 |
| 0x00617D60 | 152 | CRijndael__encrypt_cbc_18 | Rijndael CBC encryption wrapper with 0x18-byte block size. Constructs CRijndael, calls make_key with key/IV at global DAT_010e9e14/010e9e34 (0x18,0x18), encrypts via encrypt_block, then destructs. |
| 0x00617E00 | 152 | CRijndael__encrypt_cbc_20 | Rijndael CBC encryption wrapper with 0x20-byte block size. Same as encrypt_cbc_18 but uses 0x20 for both key and block length parameters to make_key. |
| 0x00617EA0 | 152 | CRijndael__decrypt_cbc_18 | Rijndael CBC decryption wrapper with 0x18-byte block size. Constructs CRijndael, calls make_key with key/IV at global DAT_010e9e14/010e9e34 (0x18,0x18), decrypts via decrypt_block, then destructs. |
| 0x00617F40 | 152 | CRijndael__decrypt_cbc_20 | Rijndael CBC decryption wrapper with 0x20-byte block size. Same as decrypt_cbc_18 but uses 0x20 for both key and block length parameters to make_key. |
| 0x00617FE0 | 13 | CRijndael__ctor | CRijndael constructor. Sets vtable pointer to PTR_util_00618070_010ed938 and initializes initialized flag (this+4) to 0. |
| 0x00617FF0 | 99 | CRijndael__create_exception | Creates a CRijndael exception object from a C string message. Sets vtable to STL_json_exception_base_dtor vtable (reused exception class), copies the exception message via __std_exception_copy. |
| 0x00618060 | 7 | CRijndael__reset_vtable | Resets the CRijndael vtable pointer without full destruction. Called during exception cleanup paths. |
| 0x00618070 | 39 | CRijndael__scalar_deleting_dtor | CRijndael scalar deleting destructor. Resets vtable, then conditionally frees memory (0x474 bytes = sizeof CRijndael) if bit 0 of param_2 is set. |
| 0x006180A0 | 384 | CRijndael__encrypt_decrypt_blocks | Rijndael block cipher mode processor for encryption. Processes multiple blocks of data. Mode 1 = CBC encrypt (XOR with prev ciphertext, then encrypt), mode 2 = CBC decrypt (decrypt, then XOR with prev ciphertext), default = ECB encrypt (no chaining). Validates initialized state and block alignment. Throws on error. |
| 0x00618230 | 759 | CRijndael__encrypt_block | Rijndael encrypt_block: encrypts one block using the forward S-box and T-tables (DAT_010eb858/010ebc58/010ec058/010ec458). Dispatches to encrypt_block_128 for 16-byte blocks. Handles variable block sizes (16/24/32 bytes). Uses round keys at this+0x1E8 with this+0x3D0 rounds. |
| 0x00618530 | 919 | CRijndael__encrypt_block_128 | Rijndael encrypt for 128-bit (16-byte) block size only. Optimized path with hardcoded 4-word state. Uses forward T-tables (DAT_010eb858..010ec458) for round transformation and S-box (DAT_010ea758) for final round. Round keys at this+0x1E8, rounds at this+0x3D0. |
| 0x006188D0 | 916 | CRijndael__decrypt_block_128 | Rijndael decrypt for 128-bit (16-byte) block size only. Uses inverse T-tables (DAT_010ea858..010eb458) for round transformation and inverse S-box (DAT_010ea658) for final round. Decryption round keys at this+0x8, rounds at this+0x3D0. |
| 0x00618C70 | 390 | CRijndael__decrypt_blocks | Rijndael block cipher mode processor for decryption. Processes multiple blocks. Mode 1 = CBC decrypt (XOR IV with ciphertext before decrypt), mode 2 = OFB-like decrypt, default = ECB decrypt. Validates initialized state and block alignment. Throws on error. |
| 0x00618E00 | 756 | CRijndael__decrypt_block | Rijndael decrypt_block: decrypts one block using the inverse S-box and inverse T-tables (DAT_010ea858/010eac58/010eb058/010eb458). Dispatches to decrypt_block_128 for 16-byte blocks. Handles variable block sizes. Uses decryption round keys at this+0x8. |
| 0x00619100 | 1118 | CRijndael__make_key | Rijndael key schedule setup. Validates key (non-null), key length (16/24/32), and block length (16/24/32). Computes number of rounds (10/12/14), expands key into encryption round keys (this+0x1E8) and decryption round keys (this+0x8). Applies InvMixColumns to decryption subkeys. Sets initialized flag. Object size ~0x474 bytes. |
| 0x00619560 | 88 | CRijndael__xor_blocks | XORs two blocks byte-by-byte. Length determined by this+0x3CC (block size). Used for CBC mode chaining. Validates initialized flag first. |
| 0x006195C0 | 1835 | base64_decode | Base64 decode. Supports both standard and URL-safe base64 (handles +/- and /_). If param in_stack_00000020 is nonzero, strips newlines from input first. Decodes 4-char groups into 3 bytes, handles = and . padding. Returns decoded string. |
| 0x00619CF0 | 115 | base64_decode_string | Convenience wrapper: copies the input std::string, then calls base64_decode to decode it. Returns decoded result as std::string. |
| 0x00619D70 | 155 | base64_encode_string | Convenience wrapper: copies the input std::string, extracts its raw buffer and length, then calls base64_encode with the specified mode param. Returns encoded result as std::string. |
| 0x00619E10 | 2874 | base64_encode | Base64 encode. Encodes raw bytes (param_2, param_3 length) into base64 string. param_4 selects alphabet: 0=standard (ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/), nonzero=URL-safe variant. Uses '=' padding for standard, '.' for URL-safe. Processes 3 bytes at a time into 4 base64 chars. |
| 0x0061A950 | 222 | base64_encode_with_linebreaks_76 | Base64 encode with linebreaks every 76 characters. Encodes input string with standard alphabet (mode 0), then inserts newlines every 0x4C (76) characters via base64_insert_linebreaks. MIME-standard line length. |
| 0x0061AA30 | 222 | base64_encode_with_linebreaks_64 | Base64 encode with linebreaks every 64 characters. Encodes input string with standard alphabet (mode 0), then inserts newlines every 0x40 (64) characters via base64_insert_linebreaks. PEM-standard line length. |
| 0x0061AB10 | 499 | base64_insert_linebreaks | Inserts newline characters into a base64-encoded string at every param_8 characters. If input is empty, returns empty string. Operates in-place on the string buffer, shifting content to make room for newlines. |
| 0x0061AD10 | 90 | base64_char_to_value | Converts a single base64 character to its 6-bit value. Handles uppercase (A-Z=0-25), lowercase (a-z=26-51), digits (0-9=52-61), and both standard (+,/) and URL-safe (-,_) special chars (62,63). |
| 0x0061AD80 | 119 | CBCrypt__dtor | CBCrypt destructor. Destroys the BCrypt key handle (BCryptDestroyKey) and closes the algorithm provider (BCryptCloseAlgorithmProvider), then deallocates the internal key object buffer. |
| 0x0061AE00 | 131 | CBCrypt__dtor_full | CBCrypt full destructor. Destroys BCrypt key handle and algorithm provider, then deallocates both the key object buffer and an additional IV buffer (two STL_vector_dealloc calls). |
| 0x0061AE90 | 45 | CBCrypt__close_handles | Closes BCrypt handles: destroys key handle at this[1] via BCryptDestroyKey, then closes algorithm provider at this[0] via BCryptCloseAlgorithmProvider. Sets both to NULL after closing. |
| 0x0061AEC0 | 45 | CBCrypt__close_handles_0061aec0 | Identical to CBCrypt__close_handles at 0061ae90. Closes BCrypt key handle and algorithm provider. Duplicate function for a different CBCrypt instance or subclass. |
| 0x0061AEF0 | 62 | CBCrypt__decrypt_no_iv | BCrypt decryption without IV. Calls BCryptDecrypt with NULL IV and padding flags=0. Returns output size on success, 0xFFFFFFFF on failure. |
| 0x0061AF30 | 128 | CBCrypt__decrypt_with_iv | BCrypt decryption with optional IV from internal vector at this+0x14..0x18. Initializes a 16-byte zeroed local buffer for small outputs. Uses IV from internal storage if this+0x20 is nonzero. param_6 controls padding flags. Returns output size or 0xFFFFFFFF on error. |
| 0x0061AFB0 | 97 | CBCrypt__derive_key_pbkdf2 | Derives a key using PBKDF2-SHA256 via BCryptDeriveKeyPBKDF2. Opens HMAC-SHA256 algorithm provider (flag 8), derives key from password+salt with iteration count, then closes provider. Returns 1 on success, 0 on failure. |
| 0x0061B020 | 62 | CBCrypt__encrypt_no_iv | BCrypt encryption without IV. Calls BCryptEncrypt with NULL IV and padding flags=0. Returns output size on success, 0xFFFFFFFF on failure. |
| 0x0061B060 | 128 | CBCrypt__encrypt_with_iv | BCrypt encryption with optional IV from internal vector at this+0x14..0x18. Same structure as decrypt_with_iv but calls BCryptEncrypt. param_6 controls padding flags. Returns output size or 0xFFFFFFFF on error. |
| 0x0061B0E0 | 189 | CBCrypt__init_symmetric_key | Initializes a symmetric BCrypt key. Closes any existing handles, opens algorithm provider (from PTR_LAB_010edab4), queries ObjectLength property, resizes internal buffer, generates symmetric key via BCryptGenerateSymmetricKey. Key size must be 5-260 bytes. Returns 1 on success. |
| 0x0061B1A0 | 544 | CBCrypt__init_aes_with_chaining_mode | Initializes CBCrypt for AES encryption with chaining mode. Only accepts 16-byte IV (copies to this+0x14 vector). Opens AES provider, gets ObjectLength, generates symmetric key. On Windows 6.2+ (Win8+), sets chaining mode: 0=ECB, 1=CBC, 2=CFB. On older Windows with mode 1, falls back to software CBC. Returns 1 on success. |
| 0x0061B3C0 | 70 | CCrypto__process_with_16byte_buffer | Wrapper that calls process_func_0061b1a0 with a zeroed 16-byte local buffer. Used for block cipher operations. |
| 0x0061B410 | 46 | CCrypto__copy_16byte_result_to_vector | Copies a 16-byte (128-bit) result from param_2 into this->vector at offset 0x14. Returns 0 if size != 16, 1 on success. Resizes vector to 16 bytes first. |
| 0x0061B440 | 299 | CCrypto__set_bcrypt_chaining_mode | Sets BCrypt block cipher chaining mode. On Windows 8+ (version >= 6.2), uses BCryptSetProperty to set ChainingMode to ECB(0)/CBC(1)/CFB(2). On older OS with mode=1, sets flag at offset 0x20. Stores mode at this+0x20. |
| 0x0061B570 | 107 | SHA3__init_state | SHA-3 state initialization. Sets bit_size at offset 0x168, calculates rate = (100 - bit_size/8) * 2 at offset 0xD0. Zeroes the 25x2 = 50 dwords of Keccak state (1600-bit). Resets buffer position and counters. |
| 0x0061B5E0 | 172 | SHA3__hash_string | SHA-3 convenience: initializes state, absorbs data from an std::string (param_3), then finalizes into param_2. One-shot hash from string to hex result. |
| 0x0061B690 | 162 | SHA3__hash_raw_data | SHA-3 convenience: initializes state, absorbs raw data (param_3 ptr, param_4 length), then finalizes into param_2. One-shot hash from raw bytes to hex result. |
| 0x0061B740 | 213 | SHA3__absorb_data | SHA-3 absorb/update: feeds input data into the sponge state. Buffers partial blocks at this+0xD8, tracks position at this+0xD4. When buffer is full (equals rate at this+0xD0), calls keccak_f1600_permutation and updates 64-bit bit counter at this+0xC8. |
| 0x0061B820 | 2268 | SHA3__finalize_to_hex_string | SHA-3 finalize to hex string. Applies SHA-3 padding (0x06 byte, zero-fill, 0x80 at end), runs final Keccak permutation, then converts state words to lowercase hex string using "0123456789abcdef" lookup. Returns std::string with hex digest. Saves/restores state. |
| 0x0061C100 | 447 | SHA3__finalize_to_bytes | SHA-3 finalize to raw bytes. Applies SHA-3 padding (0x06, zeros, 0x80), runs final Keccak permutation, extracts raw hash bytes (bit_size/8 bytes) into output buffer. Returns 0 if output buffer too small, 1 on success. Saves/restores state. |
| 0x0061CBD0 | 13 | CCrypto__set_member_value | Simple setter: stores param_2 into *param_1. 13 bytes. |
| 0x0061CBE0 | 317 | mt19937_fill_random_bytes | Fills a byte buffer [param_1, param_1+param_2) with random bytes from MT19937. Seeds the generator with param_3 first, then generates one random byte per position. |
| 0x0061CD20 | 241 | mt19937_fisher_yates_shuffle_bytes_seeded | Fisher-Yates shuffle for a byte array [param_1, param_2). Seeds MT19937 with param_3 first. Uses rejection sampling to get unbiased random indices. Swaps elements in-place. |
| 0x0061CE20 | 243 | mt19937_fisher_yates_shuffle_uint32_seeded | Fisher-Yates shuffle for a uint32 array [param_1, param_2). Seeds MT19937 with param_3 first. Uses rejection sampling for unbiased random indices. Identical logic to byte version but operates on 4-byte elements. |
| 0x0061CF20 | 207 | mt19937_fisher_yates_shuffle_bytes_bitlimited | Fisher-Yates shuffle for byte array [param_1, param_2) using bit-limited RNG from param_3 config struct. Generates random values with bounded bit width, accumulates multi-word random numbers for larger ranges. |
| 0x0061D000 | 211 | mt19937_fisher_yates_shuffle_uint32_bitlimited | Fisher-Yates shuffle for uint32 array [param_1, param_2) using bit-limited RNG from param_3 config struct. Same algorithm as byte version but operates on 4-byte elements. |
| 0x0061D0E0 | 142 | mt19937_fisher_yates_shuffle_bytes | Fisher-Yates shuffle for byte array [param_1, param_2) using the global (unseeded) MT19937 generator. Uses rejection sampling for unbiased random indices. |
| 0x0061D170 | 146 | mt19937_fisher_yates_shuffle_uint32 | Fisher-Yates shuffle for uint32 array [param_1, param_2) using the global (unseeded) MT19937 generator. Uses rejection sampling for unbiased random indices. |
| 0x0061D210 | 76 | MT19937__seed | MT19937 seed/init. Sets state[0] = 0x270 (624 = N, triggers first twist), then fills 624 state words using the standard initialization recurrence: state[i] = 0x6C078965 * (state[i-1] ^ (state[i-1] >> 30)) + i. Sets tempering mask at offset 0x1384 to 0xFFFFFFFF. |
| 0x0061D2C0 | 388 | MT19937__generate_uint32 | MT19937 generate: produces one 32-bit random number. If index == 624 (N), performs the twist step. Applies standard MT19937 tempering: y ^= (y >> 11) & mask; y ^= (y << 7) & 0xFF3A58AD; y ^= (y << 15) & 0xFFFFDF8C; y ^= (y >> 18). Uses magic number 0x9908B0DF. Supports extended state (index > 0x4DF) for split twist optimization. |
| 0x0061D450 | 73 | CCrypto__get_hardcoded_key_8byte | Stores a hardcoded 8-byte key into param_2 (its value is left out of this catalog). Protected by Themida null stub. Used for crypto key initialization. |
| 0x0061D5D0 | 64 | CCrypto__get_obfuscated_key_16byte_A | Copies a 16-byte obfuscated key from static data section (s_8_JBz_EcNb_<c2h__010edb94) into param_1. Protected by Themida null stub. Key A for crypto operations. |
| 0x0061DAA0 | 61 | CCrypto__get_obfuscated_key_16byte_B | Copies a 16-byte obfuscated key from static data section (s_A_L_A_i_bAoK2_xS_010edba8) into param_1. Protected by Themida null stub. Key B for crypto operations. |
| 0x0061DC60 | 400 | MT19937__generate_bounded | MT19937: generate bounded |
| 0x00632580 | 423 | CAntiCheat__lookup_encrypted_effect_id | Anti-cheat obfuscated function. Decrypts an XOR-encrypted string from TLS storage, then looks up the corresponding effect ID via CEffectDataMgr. Uses xor_decrypt_buffer with keys 0x4149D5DD/0x2D3B1577. |
| 0x00642580 | 394 | CWatermark__ctor | Constructor for CWatermark. Creates a bitmap font surface (0x136 x 0xf), sets transparent background, draws a hex string watermark text with black outline (5x5 grid offsets) and white center text. The watermark string is an MD5-like hash 'f1ba2ef88470b435d29c2af87cc553e4'. |
| 0x00642710 | 31 | CWatermark__dtor | Destructor for CWatermark. Sets vtable pointer, releases the bitmap surface if allocated by calling its Release(1) method. |
| 0x00642730 | 56 | CWatermark__scalar_deleting_dtor | Scalar deleting destructor for CWatermark. Calls dtor then optionally frees 0xc bytes of memory if bit 0 of param is set. |
| 0x00642770 | 488 | CWatermark__get_or_create_instance | Gets or creates the singleton CWatermark instance. If global DAT_0138bea8 is null, allocates a new CWatermark (0xc bytes), constructs it with the hash watermark text. Returns 1 if instance is valid (ready flag set), 0 otherwise. Destroys failed instances. |
| 0x00642980 | 34 | CWatermark__render_to_surface | Renders the watermark onto a target surface by calling the bitmap surface's draw method at vtable+0x30 with coordinates (param_2, param_3) and dimensions 0x136 x 0xf. Only renders if param_1 is non-null. |
| 0x00642A60 | 7 | CCipher__set_vtable | Sets the vtable pointer for a CCipher base class instance. Points to PTR__scalar_deleting_destructor__0110cd90. |
| 0x00642A70 | 93 | CCipher__dtor | Destructor for CCipher base class. Sets vtable, clears two internal vectors via STL_vector_clear_and_free. |
| 0x00642B00 | 114 | CCipher__scalar_deleting_dtor_00642b00 | Scalar deleting destructor for CCipher. Sets vtable, clears two internal vectors, then optionally frees 0x20 bytes if bit 0 of param is set. |
| 0x00642B80 | 250 | CCipher__process_blocks | Processes multiple cipher blocks. Gets block size from vtable, then loops through data in block-sized chunks. Supports CBC mode (XOR with previous block before encryption), optional counter increment (flag bit 2), and address offset modes (flag bit 1). Returns remaining unprocessed bytes. |
| 0x00642C80 | 71 | CCipher__compute_padded_size | Computes the padded data size for block cipher operations. If encrypt mode (param_3!=0), adds one full block for padding. Otherwise rounds up to block boundary. Returns 0 if input size is 0 (encrypt mode returns block_size instead). |
| 0x00642CD0 | 61 | CCipher__round_up_to_block_size | Rounds up a data size to the nearest block boundary. If encrypt mode, adds extra block for padding. If decrypt mode, rounds up to nearest block size. Returns 0 for zero input in decrypt mode. |
| 0x00642D30 | 36 | CCipher__increment_counter | Increments the cipher counter (big-endian byte array). Iterates from the last byte backwards, incrementing by 1 with carry propagation. Stops when no carry or all bytes processed. |
| 0x00642D60 | 186 | CCipherCBC__decrypt | CBC mode decryption. Saves ciphertext to temp buffer, decrypts via block cipher, XORs with previous ciphertext (stored in IV buffer), then swaps IV and temp buffers. Handles multi-block data by calling process_blocks for remaining data beyond one block. |
| 0x00642E20 | 135 | CCipherCBC__encrypt | CBC mode encryption. XORs plaintext with IV (stored in state buffer), encrypts the result via block cipher, then copies ciphertext to IV buffer for next block chaining. Handles multi-block data beyond the first block. |
| 0x00642EB0 | 186 | CCipherCFB__decrypt | CFB mode decryption. Saves ciphertext, encrypts IV via block cipher to produce keystream, XORs ciphertext with keystream to recover plaintext, then swaps IV and saved ciphertext buffers. Handles multi-block data with process_blocks flag=2. |
| 0x00642F70 | 132 | CCipherCFB__encrypt | CFB mode encryption. Encrypts IV via block cipher to produce keystream, XORs plaintext with keystream, then copies ciphertext to IV buffer for next block chaining. Handles multi-block data with process_blocks flag=0. |
| 0x00643000 | 225 | CCipherCTR__process | CTR mode encryption/decryption (symmetric). Encrypts the counter to produce keystream, XORs data with keystream, then increments the counter. Processes in chunks up to (256 - counter_low_byte) blocks at a time to handle counter overflow. Uses process_blocks with flag=4 for counter increment mode. |
| 0x006430F0 | 106 | CCipherOFB__process | OFB mode encryption/decryption (symmetric). Encrypts the feedback register via block cipher, then XORs the result with data. Repeats for each block. Uses process_blocks internally for multi-block processing. |
| 0x00643160 | 311 | CCipher__process_with_padding | Processes data with PKCS7 padding support for block ciphers. Encrypts full blocks first, then handles the final partial block: on encrypt, pads with PKCS7 bytes and encrypts one more block. On decrypt, decrypts the last block and strips PKCS7 padding. Returns total output size or 0xFFFFFFFF on error. |
| 0x006432A0 | 28 | CCipher__set_iv | Sets the initialization vector (IV) for the cipher by copying param_2 data into the internal state buffer at offset +8. Copy size is determined by (field_0xc - field_0x8). |
| 0x006432C0 | 109 | CCipher__resize_state_buffer | Resizes the cipher's internal state buffer (at offset +0x20) to match the block size from the underlying block cipher. Calls apply_cipher_round first, then adjusts the vector size: truncates if too large, zero-fills if too small, or reallocates if capacity is insufficient. |
| 0x00644230 | 34 | CCipher__copy_buffer_if_size_matches | Copies buffer from source to destination only if both size parameters match. Returns 1 on success, 0 if sizes differ. Used to safely copy cipher key/IV material with size validation. |
| 0x00644260 | 110 | CCipher__apply_xor_round | Applies XOR round on data block with key schedule |
| 0x006442D0 | 423 | CCipher__derive_key_scheme_a | Derives encryption key using scheme A |
| 0x00644480 | 423 | CCipher__derive_key_scheme_b | Derives encryption key using scheme B |
| 0x00644630 | 423 | CCipher__derive_key_scheme_c | Derives encryption key using scheme C |
| 0x006447E0 | 423 | CCipher__derive_key_scheme_d | Derives encryption key using scheme D |
| 0x00644990 | 423 | CCipher__derive_key_scheme_e | Derives encryption key using scheme E |
| 0x00644B40 | 410 | CCipher__expand_schedule_a | Expands key schedule using algorithm A |
| 0x00644CE0 | 410 | CCipher__expand_schedule_b | Expands key schedule using algorithm B |
| 0x00644E80 | 410 | CCipher__expand_schedule_c | Expands key schedule using algorithm C |
| 0x00645020 | 410 | CCipher__expand_schedule_d | Expands key schedule using algorithm D |
| 0x006469E0 | 168 | CCipherStream__ctor_a | CCipherStream constructor variant A. Initializes base via init_base, sets CCipherRound vtables, zeroes state fields, calls CFileSystem__set_cipher_key. |
| 0x00646A90 | 168 | CCipherStream__ctor_b | CCipherStream constructor variant B. Initializes via init_sub, sets CCipherRound vtables, zeroes state fields, calls CFileSystem__apply_cipher_round. |
| 0x00646B40 | 149 | CCipherStream__ctor_c | CCipherStream constructor variant C. Initializes base, sets mix_cols CCipherRound vtables with extra state field, calls CFileSystem__set_cipher_key. |
| 0x00646BE0 | 149 | CCipherStream__ctor_d | CCipherStream constructor variant D. Initializes sub, sets inv_mix_cols CCipherRound vtables with extra state field, calls CFileSystem__apply_cipher_round. |
| 0x00646C80 | 261 | CCipherStream__ctor_with_buffer | CCipherStream constructor with buffer initialization. Zeroes 8 dwords, sets mix_cols CCipherRound vtables, calls CFileSystem__set_cipher_iv. |
| 0x00646D90 | 157 | CCipherStream__ctor_e | CCipherStream constructor variant E. Initializes sub, sets inv_mix_cols CCipherRound vtables, calls CFileSystem__apply_cipher_round. |
| 0x00646E30 | 168 | CCipherStream__ctor_f | CCipherStream constructor variant F. Initializes base, sets add_rkey CCipherRound vtables, calls CFileSystem__set_cipher_key. |
| 0x00646EE0 | 168 | CCipherStream__ctor_g | CCipherStream constructor variant G. Initializes sub, sets add_rkey CCipherRound vtables, calls CFileSystem__apply_cipher_round. |
| 0x00646F90 | 149 | CCipherStream__ctor_h | CCipherStream constructor variant H. Initializes base, sets mix_cols CCipherRound vtables with extra state field, calls CFileSystem__set_cipher_key. |
| 0x00647030 | 149 | CCipherStream__ctor_i | CCipherStream constructor variant I. Initializes sub, sets mix_cols CCipherRound vtables with extra state field, calls CFileSystem__apply_cipher_round. |
| 0x006470D0 | 233 | CCipherStream__ctor_with_large_buffer | CCipherStream constructor with large buffer. Zeroes 8 dwords + memset 0xD0 bytes. Sets shift_rows CCipherRound vtables, calls CFileSystem__apply_cipher_round. |
| 0x006471C0 | 175 | CCipherStream__init_base | CCipherStream base initializer. Zeroes 8 dwords for stream buffer pointers, sets initial CCipherRound vtable. Shared by multiple ctor variants. |
| 0x00647270 | 149 | CCipherStream__init_sub | CCipherStream sub-object initializer. Zeroes 7 dwords for stream buffer, sets CCipherRound vtable. Used by ctor variants that build on a sub-stream. |
| 0x006498D0 | 91 | CCipherState__reset_a | Resets CCipherState variant A: zeros 12 bytes at offset+4, then calls CFileSystem__cleanup_resource. SEH-protected. |
| 0x00649930 | 91 | CCipherState__reset_b | Resets CCipherState variant B: zeros 208 (0xD0) bytes at offset+4, then calls CFileSystem__cleanup_resource. Handles large state buffer. |
| 0x00649990 | 65 | CCipherState__dtor_wrapper_a | Destructor wrapper for CCipherState variant A. SEH-wrapped call to CCipherKey__clear_and_free_key_a. |
| 0x006499E0 | 91 | CCipherState__reset_c | Resets CCipherState variant C: zeros 16 bytes at offset+4, then calls CFileSystem__cleanup_resource. SEH-protected. |
| 0x00649A40 | 91 | CCipherState__reset_d | Resets CCipherState variant D: zeros 12 bytes at offset+4, then calls CFileSystem__cleanup_resource. SEH-protected. |
| 0x00649AA0 | 65 | CCipherState__dtor_wrapper_b | Destructor wrapper for CCipherState variant B. SEH-wrapped call to CCipherKey__clear_and_free_key_b. |
| 0x00649AF0 | 91 | CCipherState__reset_e | Resets CCipherState variant E: zeros 16 bytes at offset+4, then calls CFileSystem__cleanup_resource. SEH-protected. |
| 0x00649B50 | 146 | CCipherCtx__dtor_with_vector_a | Destructor for CCipherCtx variant A. Clears key via clear_and_free_key_a, zeros and deallocates internal vector, calls resource cleanup. |
| 0x00649BF0 | 95 | CCipherCtx__dtor_key_only_a | Simple destructor for CCipherCtx variant A. Only clears key via clear_and_free_key_a and calls resource cleanup (no vector dealloc). |
| 0x00649C50 | 163 | CCipherCtx__destroy_a | Destroys CCipherCtx variant A: zeros 16 bytes at offset+0x30, calls resource cleanup, zeros and frees internal vector at offset+0x20. |
| 0x00649D00 | 117 | CCipherCtx__finalize_a | Finalizes CCipherCtx variant A: zeros 16 bytes at offset+0x24, calls resource cleanup. Lighter than full destroy (no vector dealloc). |
| 0x00649D80 | 163 | CCipherCtx__destroy_b | Destroys CCipherCtx variant B: zeros 12 bytes at offset+0x30, calls resource cleanup, zeros and frees internal vector at offset+0x20. |
| 0x00649E30 | 117 | CCipherCtx__finalize_b | Finalizes CCipherCtx variant B: zeros 12 bytes at offset+0x24, calls resource cleanup. Lighter than full destroy (no vector dealloc). |
| 0x00649EB0 | 146 | CCipherCtx__dtor_with_vector_b | Destructor for CCipherCtx variant B. Clears key via clear_and_free_key_b, zeros and deallocates internal vector, calls resource cleanup. |
| 0x00649F50 | 95 | CCipherCtx__dtor_key_only_b | Simple destructor for CCipherCtx variant B. Only clears key via clear_and_free_key_b and calls resource cleanup (no vector dealloc). |
| 0x00649FB0 | 163 | CCipherCtx__destroy_c | Destroys CCipherCtx variant C: zeros 16 bytes at offset+0x30, calls resource cleanup, zeros and frees internal vector at offset+0x20. |
| 0x0064A060 | 117 | CCipherCtx__finalize_c | Finalizes CCipherCtx variant C: zeros 16 bytes at offset+0x24, calls resource cleanup. Lighter than full destroy (no vector dealloc). |
| 0x0064A0E0 | 117 | CCipherCtx__finalize_d | Finalizes CCipherCtx variant D: zeros 208 (0xD0) bytes at offset+0x24, calls resource cleanup. Handles large cipher state buffers. |
| 0x0064A1C0 | 102 | CCipherUtil__zero_memory | Securely zeros a vector buffer (dword-aligned iteration), then frees the vector via STL_vector_free. Used for secure key/data cleanup. |
| 0x0064A230 | 67 | CCipherUtil__dtor_small_obj_a | Destructor for small (0x10-byte) cipher object. Checks if member at offset+4 is non-null, deletes it. |
| 0x0064A280 | 67 | CCipherUtil__dtor_large_obj_a | Destructor for large (0x38-byte) cipher object. Checks if member at offset+4 is non-null, deletes it. |
| 0x0064A2D0 | 33 | CCipherUtil__release_key_obj | Releases cipher key object at member[9] via virtual destructor (vtable+0x10), then zeroes the pointer. Prevents dangling key references. |
| 0x0064A300 | 131 | CCipherUtil__cleanup_round_key_list | Cleans up round key data: calls free_vector_buffer_a, then traverses and deletes a linked list of 0x10-byte nodes, frees the list container. |
| 0x0064A390 | 102 | CCipherUtil__cleanup_round_key_and_list | Cleans up round key data: calls free_vector_buffer_b, then destroys list nodes with ref release, frees the 0x38-byte container. |
| 0x0064A400 | 125 | CCipherUtil__free_vector_buffer_a | Frees an STL vector buffer. Handles large allocations (>0xFFF) by looking up the original allocation pointer at [-4]. Zeroes the 3 vector fields (begin/end/capacity). |
| 0x0064A490 | 125 | CCipherUtil__free_vector_buffer_b | Frees an STL vector buffer variant B. Same logic as free_vector_buffer_a: handles large allocs via [-4] lookup, zeroes 3 vector fields. |
| 0x0064A520 | 78 | CCipherUtil__dtor_small_obj_b | Destructor for small (0x10-byte) cipher object variant B. Checks if member at offset+4 is non-null, deletes it. |
| 0x0064A570 | 147 | CCipherUtil__destroy_key_schedule | Destroys cipher key schedule: releases virtual object at offset+0x34 via vtable+0x10, then deletes the 0x38-byte key schedule container. |
| 0x0064A610 | 92 | CCipherUtil__release_virtual_obj | Releases object at member[9] via virtual destructor (vtable+0x10), then zeroes the pointer. Used for cipher mode/key objects. |
| 0x0064A670 | 103 | CCipherUtil__destroy_linked_list | Destroys a singly-linked list of 0x10-byte nodes. Traverses from head, zeroes sentinel count, deletes each node, then deletes the list head. |
| 0x0064A6E0 | 73 | CCipherUtil__destroy_list_and_free | Destroys a list with reference-counted nodes via STL_list_destroy_nodes_with_ref_release, then frees the 0x38-byte container. |
| 0x0064A730 | 130 | CCipherKey__clear_and_free_key_a | Clears cipher key buffer by zeroing vector contents (dword-aligned), then frees the vector and calls resource cleanup. Secure key erasure. |
| 0x0064A7C0 | 91 | CCipherKey__zero_key_16_and_cleanup_a | Zeros 16 bytes of key data at offset+4, then calls resource cleanup. Part of cipher key destruction sequence. |
| 0x0064A820 | 91 | CCipherKey__zero_key_12_and_cleanup_a | Zeros 12 bytes of key data at offset+4, then calls resource cleanup. Part of cipher key destruction sequence. |
| 0x0064A880 | 130 | CCipherKey__clear_and_free_key_b | Clears cipher key buffer variant B by zeroing vector contents (dword-aligned), then frees the vector and calls resource cleanup. Secure key erasure. |
| 0x0064A910 | 91 | CCipherKey__zero_key_16_and_cleanup_b | Zeros 16 bytes of key data at offset+4, then calls resource cleanup. Part of cipher key destruction sequence (variant B). |
| 0x0064A970 | 91 | CCipherKey__zero_key_208_and_cleanup | Zeros 208 (0xD0) bytes of key data at offset+4, then calls resource cleanup. Handles large key schedule state. |
| 0x0064A9D0 | 119 | CCipherKey__clear_and_free_iv_a | Clears IV buffer by zeroing vector contents, then frees the vector and calls resource info cleanup. Secure IV erasure. |
| 0x0064AA50 | 65 | CCipherKey__dtor_wrapper_a | Destructor wrapper for CCipherKey variant A. SEH-wrapped call to CFileSystem__get_resource_info for cleanup. |
| 0x0064AAA0 | 119 | CCipherKey__clear_and_free_iv_b | Clears IV buffer variant B by zeroing vector contents, then frees the vector and calls resource info cleanup. Secure IV erasure. |
| 0x0064AB20 | 91 | CCipherKey__zero_iv_12_and_cleanup | Zeros 12 bytes of IV data at offset+4, then calls resource cleanup. Part of IV destruction sequence. |
| 0x0064AB80 | 65 | CCipherKey__dtor_wrapper_b | Destructor wrapper for CCipherKey variant B. SEH-wrapped call to CCipherKey__clear_and_free_key_a for cleanup. |
| 0x0064ABD0 | 91 | CCipherKey__clear_buffer_b | Zeros 16 bytes at this+4 then calls CFileSystem__cleanup_resource. Destructor/cleanup that wipes key material in buffer B. |
| 0x0064AC30 | 91 | CCipherKey__clear_buffer_c | Zeros 12 bytes at this+4 then calls CFileSystem__cleanup_resource. Destructor/cleanup that wipes key material in buffer C. |
| 0x0064AC90 | 65 | CCipherKey__cleanup_wrapper_c | SEH cleanup wrapper that calls CCipherKey__set_key_b. Exception handler destructor for cipher key state C. |
| 0x0064ACE0 | 91 | CCipherKey__clear_buffer_d | Zeros 16 bytes at this+4 then calls CFileSystem__cleanup_resource. Destructor/cleanup that wipes key material in buffer D. |
| 0x0064AD40 | 65 | CCipherKey__cleanup_wrapper_d | SEH cleanup wrapper that calls CFileSystem__get_resource_info. Exception handler destructor for cipher key state D. |
| 0x0064ADA0 | 103 | CCipherRound__clear_hash_map | Clears a hash map/linked list structure. If element count < threshold/8, erases range; otherwise destroys all nodes, resets head pointers, zeros count, and fills bucket array. |
| 0x0064AE50 | 126 | CCipherKey__scalar_deleting_dtor_12byte | MSVC scalar deleting destructor for 0x10 byte object. Zeros 12 bytes at this+4, calls CFileSystem__cleanup_resource, optionally frees this (16 bytes). |
| 0x0064AED0 | 129 | CCipherRound__scalar_deleting_dtor_d4byte | MSVC scalar deleting destructor for 0xD4 byte object. Zeros 0xD0 bytes at this+4, calls CFileSystem__cleanup_resource, optionally frees this (0xD4 bytes). |
| 0x0064AF60 | 90 | CCipherKey__scalar_deleting_dtor_10byte_a | MSVC scalar deleting destructor for 0x10 byte object. Calls CCipherKey__set_key_a for cleanup, optionally frees this (16 bytes). |
| 0x0064AFC0 | 126 | CCipherKey__scalar_deleting_dtor_14byte | MSVC scalar deleting destructor for 0x14 byte object. Zeros 16 bytes at this+4, calls CFileSystem__cleanup_resource, optionally frees this (20 bytes). |
| 0x0064B040 | 126 | CCipherKey__scalar_deleting_dtor_10byte_b | MSVC scalar deleting destructor for 0x10 byte object. Zeros 12 bytes at this+4, calls CCipher__set_vtable for cleanup, optionally frees this (16 bytes). |
| 0x0064B0C0 | 90 | CCipherKey__scalar_deleting_dtor_10byte_c | MSVC scalar deleting destructor for 0x10 byte object. Calls CCipherKey__set_key_b for cleanup, optionally frees this (16 bytes). |
| 0x0064B120 | 126 | CCipherKey__scalar_deleting_dtor_14byte_b | MSVC scalar deleting destructor for 0x14 byte object. Zeros 16 bytes at this+4, calls CCipher__set_vtable for cleanup, optionally frees this (20 bytes). |
| 0x0064B1A0 | 35 | CCipherCtx__scalar_deleting_dtor_3c | MSVC scalar deleting destructor for 0x3C byte object. Calls CCipherCtx__init_a for cleanup, optionally frees this (60 bytes). |
| 0x0064B1D0 | 116 | CCipher__scalar_deleting_dtor_30_a | MSVC scalar deleting destructor for 0x30 byte object. Calls CCipherKey__set_key_a then CCipher__dtor, optionally frees this (48 bytes). Two-phase cleanup with SEH. |
| 0x0064B250 | 35 | CCipherCtx__scalar_deleting_dtor_40 | MSVC scalar deleting destructor for 0x40 byte object. Calls CCipherCtx__destroy_a for cleanup, optionally frees this (64 bytes). |
| 0x0064B280 | 138 | CCipher__scalar_deleting_dtor_34_a | MSVC scalar deleting destructor for 0x34 byte object. Zeros 16 bytes at this+0x24, calls CCipher__set_vtable then CCipher__dtor, optionally frees this (52 bytes). |
| 0x0064B310 | 35 | CCipherCtx__scalar_deleting_dtor_3c_b | MSVC scalar deleting destructor for 0x3C byte object. Calls CCipherCtx__destroy_b for cleanup, optionally frees this (60 bytes). |
| 0x0064B340 | 138 | CCipher__scalar_deleting_dtor_30_b | MSVC scalar deleting destructor for 0x30 byte object. Zeros 12 bytes at this+0x24, calls CCipher__set_vtable then CCipher__dtor, optionally frees this (48 bytes). |
| 0x0064B3D0 | 35 | CCipherCtx__scalar_deleting_dtor_3c_c | MSVC scalar deleting destructor for 0x3C byte object. Calls CCipherCtx__init_b for cleanup, optionally frees this (60 bytes). |
| 0x0064B400 | 116 | CCipher__scalar_deleting_dtor_30_c | MSVC scalar deleting destructor for 0x30 byte object. Calls CCipherKey__set_key_b then CCipher__dtor, optionally frees this (48 bytes). Two-phase SEH cleanup. |
| 0x0064B480 | 35 | CCipherCtx__scalar_deleting_dtor_40_b | MSVC scalar deleting destructor for 0x40 byte object. Calls CCipherCtx__destroy_c for cleanup, optionally frees this (64 bytes). |
| 0x0064B4B0 | 138 | CCipher__scalar_deleting_dtor_34_b | MSVC scalar deleting destructor for 0x34 byte object. Zeros 16 bytes at this+0x24, calls CCipher__set_vtable then CCipher__dtor, optionally frees this (52 bytes). |
| 0x0064B540 | 141 | CCipher__scalar_deleting_dtor_f4 | MSVC scalar deleting destructor for 0xF4 byte object. Zeros 0xD0 bytes at this+0x24, calls CCipher__set_vtable then CCipher__dtor, optionally frees this (244 bytes). |
| 0x0064B5D0 | 35 | CCipherKey__scalar_deleting_dtor_10byte_d | MSVC scalar deleting destructor for 0x10 byte object. Calls CCipherKey__clear_and_free_key_a for cleanup, optionally frees this (16 bytes). |
| 0x0064B600 | 126 | CCipherKey__scalar_deleting_dtor_14byte_c | MSVC scalar deleting destructor for 0x14 byte object. Zeros 16 bytes at this+4, calls CCipher__set_vtable, optionally frees this (20 bytes). |
| 0x0064B680 | 126 | CCipherKey__scalar_deleting_dtor_10byte_e | MSVC scalar deleting destructor for 0x10 byte object. Zeros 12 bytes at this+4, calls CCipher__set_vtable, optionally frees this (16 bytes). |
| 0x0064B700 | 35 | CCipherKey__scalar_deleting_dtor_10byte_f | MSVC scalar deleting destructor for 0x10 byte object. Calls CCipherKey__clear_and_free_key_b for cleanup, optionally frees this (16 bytes). |
| 0x0064B730 | 126 | CCipherKey__scalar_deleting_dtor_14byte_d | MSVC scalar deleting destructor for 0x14 byte object. Zeros 16 bytes at this+4, calls CCipher__set_vtable, optionally frees this (20 bytes). |
| 0x0064B7B0 | 129 | CCipherRound__scalar_deleting_dtor_d4byte_b | MSVC scalar deleting destructor for 0xD4 byte object. Zeros 0xD0 bytes at this+4, calls CCipher__set_vtable, optionally frees this (0xD4 bytes). |
| 0x0064B840 | 140 | CCipher__scalar_deleting_dtor_2c_a | MSVC scalar deleting destructor for 0x2C byte object. Zeros vector buffer at this+0x20..this+0x24, calls STL_vector_dealloc_raw_buffer_v2 then CCipher__dtor, optionally frees this (44 bytes). |
| 0x0064B8D0 | 90 | CCipher__scalar_deleting_dtor_20 | MSVC scalar deleting destructor for 0x20 byte object. Calls CCipher__dtor for cleanup, optionally frees this (32 bytes). |
| 0x0064B930 | 140 | CCipher__scalar_deleting_dtor_2c_b | MSVC scalar deleting destructor for 0x2C byte object. Zeros vector buffer at this+0x20..this+0x24, calls STL_vector_dealloc_raw_buffer_v2 then CCipher__dtor, optionally frees this (44 bytes). |
| 0x0064B9C0 | 126 | CCipherKey__scalar_deleting_dtor_10byte_g | MSVC scalar deleting destructor for 0x10 byte object. Zeros 12 bytes at this+4, calls CCipher__set_vtable, optionally frees this (16 bytes). |
| 0x0064BA40 | 90 | CCipherKey__scalar_deleting_dtor_10byte_h | MSVC scalar deleting destructor for 0x10 byte object. Calls CCipherKey__clear_and_free_key_a for cleanup, optionally frees this (16 bytes). |
| 0x0064BAA0 | 126 | CCipherKey__scalar_deleting_dtor_14byte_e | MSVC scalar deleting destructor for 0x14 byte object. Zeros 16 bytes at this+4, calls CCipher__set_vtable, optionally frees this (20 bytes). |
| 0x0064BB20 | 126 | CCipherKey__scalar_deleting_dtor_10byte_i | MSVC scalar deleting destructor for 0x10 byte object. Zeros 12 bytes at this+4, calls CCipher__set_vtable, optionally frees this (16 bytes). |
| 0x0064BBA0 | 90 | CCipherKey__scalar_deleting_dtor_10byte_j | MSVC scalar deleting destructor for 0x10 byte object. Calls CCipherKey__clear_and_free_key_b for cleanup, optionally frees this (16 bytes). |
| 0x0064BC00 | 126 | CCipherKey__scalar_deleting_dtor_14byte_f | MSVC scalar deleting destructor for 0x14 byte object. Zeros 16 bytes at this+4, calls CCipher__set_vtable, optionally frees this (20 bytes). |
| 0x0064BC80 | 90 | CCipher__scalar_deleting_dtor_20_b | MSVC scalar deleting destructor for 0x20 byte object. Calls CCipher__dtor for cleanup, optionally frees this (32 bytes). |
| 0x0064BCE0 | 573 | CCipher__encrypt_mode_a | AES-CBC cipher operation variant A. Derives key via scheme_a, inits CBC with key at param_3[0..16] and IV at param_3[16..32], mode=1. Processes data in 0x400-byte chunks with 0x10-byte padding (0x410 total). XOR round applied before each CBC operation. Returns 1 on success, 0 on failure. |
| 0x0064BF20 | 573 | CCipher__encrypt_mode_b | AES-CBC cipher operation variant B. Derives key via scheme_b, inits CBC with key at param_3+0x10 and IV at param_3+0x20, mode=2. Processes data in 0x400-byte chunks with 0x10-byte padding (0x410 total). XOR round applied before each CBC operation. Returns 1 on success, 0 on failure. |
| 0x0064C160 | 573 | CCipher__encrypt_mode_c | AES-CBC cipher operation variant C. Derives key via scheme_e, inits CBC with key at param_3+0x2C and IV at param_3+0x1C, mode=1. Processes data in 0x400-byte chunks with 0x10-byte padding (0x410 total). XOR round applied before each CBC operation. Returns 1 on success, 0 on failure. |
| 0x0064C3A0 | 626 | CCipher__encrypt_mode_d | AES-CBC cipher operation variant D. Derives key via scheme_c, inits CBC with key at param_3[0..16] and IV at param_3[16..32], mode=1. Processes data in 0x800-byte chunks with 0x10-byte padding (0x810 total), first 0x400 bytes XOR'd then 0x400 CBC'd per chunk. Returns 1 on success, 0 on failure. |
| 0x0064C620 | 626 | CCipher__encrypt_mode_e | AES-CBC cipher operation variant E. Derives key via expand_schedule_a, inits CBC with key at param_3+0x10 and IV at param_3+0x20, mode=1. Processes data in 0x800-byte chunks with 0x10-byte padding (0x810 total), first 0x400 bytes XOR'd then 0x400 CBC'd per chunk. Returns 1 on success, 0 on failure. |
| 0x0064C8A0 | 626 | CCipher__encrypt_mode_f | AES-CBC cipher operation variant F. Derives key via scheme_e, inits CBC with key at param_3+0x2C and IV at param_3+0x1C, mode=2. Processes data in 0x800-byte chunks with 0x10-byte padding (0x810 total), first 0x400 bytes XOR'd then 0x400 CBC'd per chunk. Returns 1 on success, 0 on failure. |
| 0x0064CB20 | 573 | CCipher__encrypt_mode_g | AES-CBC cipher operation variant G. Derives key via scheme_d, inits CBC with key at param_3+0x10 and IV at param_3+0x20, mode=2. Processes data in 0x800-byte chunks with 0x10-byte padding (0x810 total). XOR round applied before each CBC operation. Returns 1 on success, 0 on failure. |
| 0x0064CD60 | 626 | CCipher__decrypt_mode_a | AES-CBC cipher operation variant H (decrypt_mode_a). Derives key via expand_schedule_c, inits CBC with key at param_3+0x14 and IV at param_3+0x24, mode=2. Processes data in 0xC00-byte chunks with 0x10-byte padding (0xC10 total), first 0x400 bytes XOR'd then 0x800 CBC'd per chunk. Returns 1 on success, 0 on failure. |
| 0x0064CFE0 | 626 | CCipher__decrypt_mode_b | AES-CBC cipher operation variant I (decrypt_mode_b). Derives key via scheme_a, inits CBC with key at param_3+0x2C and IV at param_3+0x18, mode=2. Processes data in 0x800-byte chunks with 0x10-byte padding (0x810 total), first 0x400 bytes XOR'd then 0x400 CBC'd per chunk. Returns 1 on success, 0 on failure. |
| 0x0064D260 | 626 | CCipher__decrypt_mode_c | AES-CBC cipher operation variant J (decrypt_mode_c). Derives key via expand_schedule_b, inits CBC with key at param_3+0x2C and IV at param_3+0x10, mode=1. Processes data in 0xC00-byte chunks with 0x10-byte padding (0xC10 total), first 0x800 bytes XOR'd then 0x400 CBC'd per chunk. Returns 1 on success, 0 on failure. |
| 0x0064D4E0 | 626 | CCipher__decrypt_mode_d | Decrypts block with extended key schedule D |
| 0x0064D760 | 626 | CCipher__decrypt_mode_e | Decrypts block with extended key schedule E |
| 0x0064D9E0 | 626 | CCipher__decrypt_mode_f | Decrypts block with extended key schedule F |
| 0x0064DC60 | 1087 | CCipher__encrypt_chunked_a | Encrypts stream in 0x400-byte chunks mode A |
| 0x0064E0A0 | 1087 | CCipher__encrypt_chunked_b | Encrypts stream in 0x400-byte chunks mode B |
| 0x0064E4E0 | 1087 | CCipher__encrypt_chunked_c | Encrypts stream in 0x400-byte chunks mode C |
| 0x0064E920 | 1087 | CCipher__encrypt_chunked_d | Encrypts stream in 0x400-byte chunks mode D |
| 0x0064ED60 | 659 | CCipher__encrypt_with_copy_a | Copies then encrypts data, verifies round-trip A |
| 0x0064F000 | 743 | CCipher__encrypt_xxh3_a | Encrypts using XXH3 hash for key derivation A |
| 0x0064F2F0 | 620 | CCipher__encrypt_stream_a | Encrypts file stream with chunked processing A |
| 0x0064F560 | 656 | CCipher__encrypt_stream_b | Encrypts file stream with chunked processing B |
| 0x0064F7F0 | 743 | CCipher__encrypt_xxh3_b | Encrypts using XXH3 hash for key derivation B |
| 0x0064FAE0 | 734 | CCipher__decrypt_stream_a | Decrypts file stream with chunked processing A |
| 0x0064FDC0 | 734 | CCipher__decrypt_stream_b | Decrypts file stream with chunked processing B |
| 0x006500A0 | 683 | CCipher__decrypt_verified_a | Decrypts file with integrity verification A |
| 0x00650350 | 656 | CCipher__encrypt_stream_c | Encrypts file stream with chunked processing C |
| 0x006505E0 | 596 | CCipher__encrypt_direct_a | Direct file encryption without chunking A |
| 0x00650840 | 620 | CCipher__encrypt_stream_d | Encrypts file stream with chunked processing D |
| 0x00650AB0 | 794 | CCipher__decrypt_xxh3_a | Decrypts using XXH3 hash key derivation A |
| 0x00650DD0 | 683 | CCipher__decrypt_verified_b | Decrypts file with integrity verification B |
| 0x00651080 | 656 | CCipher__encrypt_stream_e | Encrypts file stream with chunked processing E |
| 0x00651310 | 680 | CCipher__decrypt_verified_c | Decrypts file with integrity verification C |
| 0x006515C0 | 794 | CCipher__decrypt_xxh3_b | Decrypts using XXH3 hash key derivation B |
| 0x006518E0 | 743 | CCipher__encrypt_xxh3_c | Encrypts using XXH3 hash for key derivation C |
| 0x00651BD0 | 596 | CCipher__encrypt_direct_b | Direct file encryption without chunking B |
| 0x00651E30 | 683 | CCipher__decrypt_verified_d | Decrypts file with integrity verification D |
| 0x006520E0 | 620 | CCipher__encrypt_stream_f | Encrypts file stream with chunked processing F |
| 0x00652350 | 620 | CCipher__encrypt_stream_g | Encrypts file stream with chunked processing G |
| 0x006525C0 | 743 | CCipher__encrypt_xxh3_d | Encrypts using XXH3 hash for key derivation D |
| 0x006528B0 | 794 | CCipher__decrypt_xxh3_c | Decrypts using XXH3 hash key derivation C |
| 0x00652BD0 | 734 | CCipher__decrypt_stream_c | Decrypts file stream with chunked processing C |
| 0x00652EB0 | 683 | CCipher__decrypt_verified_e | Decrypts file with integrity verification E |
| 0x00653160 | 1060 | CCipher__encrypt_full_a | Full file encrypt: key derive, cipher setup, chunked A |
| 0x00653590 | 1084 | CCipher__encrypt_full_b | Full file encrypt: key derive, cipher setup, chunked B |
| 0x006539D0 | 1060 | CCipher__decrypt_full_a | Full file decrypt: key derive, cipher setup, chunked A |
| 0x00653E00 | 1084 | CCipher__decrypt_full_b | Full file decrypt: key derive, cipher setup, chunked B |
| 0x00654460 | 40 | CCipher__get_mode_constant_5 | Returns cipher mode constant value 5 |
| 0x00654490 | 40 | CCipher__get_mode_constant_6 | Returns cipher mode constant value 6 |
| 0x006544C0 | 40 | CCipher__get_mode_constant_7 | Returns cipher mode constant value 7 |
| 0x006544F0 | 40 | CCipher__get_mode_constant_8 | Returns cipher mode constant value 8 |
| 0x00654520 | 40 | CCipher__get_mode_constant_9 | Returns cipher mode constant value 9 |
| 0x00654550 | 40 | CCipher__get_mode_constant_10 | Returns cipher mode constant value 10 |
| 0x00654580 | 40 | CCipher__get_mode_constant_0x201 | Returns cipher mode constant value 0x201 (513) |
| 0x006545B0 | 40 | CCipher__get_mode_constant_0x80 | Returns cipher mode constant value 0x80 (128) |
| 0x006545E0 | 40 | CCipher__get_mode_constant_11 | Returns cipher mode constant value 11 (0xb) |
| 0x00654610 | 40 | CCipher__get_mode_constant_12 | Returns cipher mode constant value 12 (0xc) |
| 0x00654640 | 40 | CCipher__get_mode_constant_13 | Returns cipher mode constant value 13 (0xd) |
| 0x00654670 | 40 | CCipher__get_mode_constant_14 | Returns cipher mode constant value 14 (0xe) |
| 0x006546A0 | 40 | CCipher__get_mode_constant_6546a0 | Returns cipher mode constant |
| 0x006546D0 | 40 | CCipher__get_mode_constant_6546d0 | Returns cipher mode constant |
| 0x0076E270 | 1464 | rc4_crypt | RC4 stream cipher encrypt/decrypt. Processes data in 8-byte chunks with unrolled loop for aligned data, falls back to byte-by-byte for unaligned. State stored in param_1 (i at [0], j at [1], S-box at [2..257]). XORs keystream with input param_3 to produce output param_4. |
| 0x0076E9F0 | 350 | rc4_key_schedule | RC4 Key Scheduling Algorithm (KSA). Initializes the 256-byte S-box at param_1[2..257] with identity permutation plus an offset, then performs the key-mixing pass using the key at param_3 of length param_2. Resets i and j counters to 0. |
| 0x00A59FE0 | 40 | xor_decrypt_stub_00a59fe0 | XOR decrypt stub. Decrypts 6-byte buffer with keys 0x79878559/0xe33f2ff7 if flag at +6 is set, then clears flag. |
| 0x00A5A010 | 40 | xor_decrypt_stub_00a5a010 | XOR decrypt stub. Decrypts 6-byte buffer with keys 0xeb61598f/0xc70319b5 if flag at +6 is set, then clears flag. |
| 0x00A5A040 | 40 | xor_decrypt_stub_00a5a040 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A070 | 40 | xor_decrypt_stub_00a5a070 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A0A0 | 40 | xor_decrypt_stub_00a5a0a0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A0D0 | 40 | xor_decrypt_stub_00a5a0d0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A100 | 40 | xor_decrypt_stub_00a5a100 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A130 | 40 | xor_decrypt_stub_00a5a130 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A160 | 40 | xor_decrypt_stub_00a5a160 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A190 | 40 | xor_decrypt_stub_00a5a190 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A1C0 | 40 | xor_decrypt_stub_00a5a1c0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A1F0 | 40 | xor_decrypt_stub_00a5a1f0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A220 | 40 | xor_decrypt_stub_00a5a220 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A250 | 40 | xor_decrypt_stub_00a5a250 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A280 | 40 | xor_decrypt_stub_00a5a280 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A2B0 | 40 | xor_decrypt_stub_00a5a2b0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A2E0 | 40 | xor_decrypt_stub_00a5a2e0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A310 | 40 | xor_decrypt_stub_00a5a310 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A340 | 40 | xor_decrypt_stub_00a5a340 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A370 | 40 | xor_decrypt_stub_00a5a370 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A3A0 | 40 | xor_decrypt_stub_00a5a3a0 | XOR decrypt stub. Decrypts 6-byte buffer if flag at +6 is set, then clears flag. |
| 0x00A5A550 | 204 | tls_init_encrypted_string_00a5a550 | TLS static initializer for an encrypted string. Initializes encrypted bytes {0x0e, 0x18, 0x13, 0x8a, 0xaa, 0x01} in thread-local storage slot, registers atexit handler. Returns pointer to TLS data. Uses TSS guard pattern with bit flag at +0x97b4. |
| 0x00A5A620 | 220 | tls_init_encrypted_string_00a5a620 | TLS static initializer for a 0x30-byte encrypted string. Copies encrypted data from ROM to TLS slot at +0x97b8, registers atexit handler. |
| 0x00A5A700 | 236 | tls_init_encrypted_string_00a5a700 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern with bit flag check. |
| 0x00A5A7F0 | 220 | tls_init_encrypted_string_00a5a7f0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5A8D0 | 220 | tls_init_encrypted_string_00a5a8d0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5A9B0 | 204 | tls_init_encrypted_string_00a5a9b0 | TLS static initializer for a 6-byte encrypted string {0x46, 0x00, 0x91, 0xb0, 0x42, 0xbd}. TLS offset +0x9894. |
| 0x00A5AA80 | 236 | tls_init_encrypted_string_00a5aa80 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5AB70 | 222 | tls_init_encrypted_string_00a5ab70 | TLS static initializer for a 0x2c-byte encrypted string. TLS offset +0x98d4. |
| 0x00A5AC50 | 236 | tls_init_encrypted_string_00a5ac50 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5AD40 | 236 | tls_init_encrypted_string_00a5ad40 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5AE30 | 204 | tls_init_encrypted_string_00a5ae30 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5AF00 | 236 | tls_init_encrypted_string_00a5af00 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5AFF0 | 236 | tls_init_encrypted_string_00a5aff0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B0E0 | 236 | tls_init_encrypted_string_00a5b0e0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B1D0 | 236 | tls_init_encrypted_string_00a5b1d0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B2C0 | 204 | tls_init_encrypted_string_00a5b2c0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B390 | 236 | tls_init_encrypted_string_00a5b390 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B480 | 236 | tls_init_encrypted_string_00a5b480 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B570 | 236 | tls_init_encrypted_string_00a5b570 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B660 | 236 | tls_init_encrypted_string_00a5b660 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B750 | 204 | tls_init_encrypted_string_00a5b750 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B820 | 236 | tls_init_encrypted_string_00a5b820 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B910 | 222 | tls_init_encrypted_string_00a5b910 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5B9F0 | 236 | tls_init_encrypted_string_00a5b9f0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5BAE0 | 236 | tls_init_encrypted_string_00a5bae0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5BBD0 | 222 | tls_init_encrypted_string_00a5bbd0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5BCB0 | 220 | tls_init_encrypted_string_00a5bcb0 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5BD90 | 220 | tls_init_encrypted_string_00a5bd90 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00A5BE70 | 220 | tls_init_encrypted_string_00a5be70 | TLS static initializer for an encrypted string buffer. Uses TSS guard pattern. |
| 0x00AE8460 | 21 | CDesCipher__generate_subkeys | Generates DES subkeys by calling FUN_00ae92f0 with the key. Returns the this pointer. |
| 0x00AE84A0 | 686 | CDesCipher__encrypt_buffer | Encrypts a buffer using DES with byte-level obfuscation. Processes 8-byte blocks. First 20 blocks always encrypted; after that, encrypts every param_6-th block. Non-encrypted blocks get byte shuffling with a substitution table (switch on specific byte values). Stores output size in param_5. |
| 0x00AE8870 | 569 | CDesCipher__encrypt_single_pass | Single-pass DES encryption on a buffer. Copies input to output, then processes 8-byte blocks through the DES Feistel network using subkeys from offset +0x78. Uses expansion (DAT_01159fc0), S-boxes (DAT_0115a010), and P-box (DAT_01159ff0) permutations. Max 20 iterations. |
| 0x00AE8AB0 | 511 | CDesCipher__decrypt_buffer | Decrypts a buffer using DES with byte-level deobfuscation. Inverse of encrypt_buffer. Processes 8-byte blocks, first 20 always decrypted, then every param_6-th. Non-decrypted blocks get reverse byte shuffling. Computes padded output size in param_5. |
| 0x00AEA430 | 288 | CProcessHelper__init | Initializes the process helper. On NT-class systems, loads kernel32.dll and gets Toolhelp32 API addresses (CreateToolhelp32Snapshot, Module32First/Next, Process32First/Next). On older systems, loads psapi.dll for EnumProcessModules/GetModuleFileNameExA. Sets debug privilege if needed. |
| 0x00AEA550 | 84 | CProcessHelper__dtor | CProcessHelper destructor. Frees the loaded DLL (kernel32 or psapi) and revokes debug privilege if on older OS. |
| 0x00AEA8F0 | 217 | CProcessHelper__enum_processes | Enumerates processes using Toolhelp32 API (Process32First/Next). Takes a snapshot (TH32CS_SNAPPROCESS=8), iterates all processes calling param_3 callback for each with the process name and param_4 userdata. |
| 0x00AEA9D0 | 509 | CProcessHelper__enum_modules_for_pid | Enumerates modules for a specific PID. On Toolhelp32 systems, uses Module32First/Next. On PSAPI systems, uses EnumProcessModules + OpenProcess. Calls param_3 callback for each module handle with param_4 userdata. |
| 0x00AEABD0 | 244 | CProcessHelper__enum_modules_psapi | Enumerates modules for a PID using PSAPI (EnumProcessModules). Opens process with PROCESS_QUERY_INFORMATION\|PROCESS_VM_READ, dynamically grows buffer, calls param_3 callback for each module handle. |
| 0x00AEAD30 | 220 | CProcessHelper__find_module_by_id | Finds a specific module by ID in Toolhelp32 snapshot. Creates TH32CS_SNAPMODULE snapshot, iterates with Module32First/Next, copies module data to param_4 when field matches param_3. Returns 1 if found, 0 if not. |
| 0x00AEB220 | 268 | CProcessHelper__init_no_privilege | Initializes the process helper without setting debug privilege. Same API loading logic as CProcessHelper__init but skips the privilege call. |
| 0x00B0A0E0 | 1120 | CCipher__init_key_schedule | Initializes the AES/Rijndael cipher with a given key and block size. Validates key length (16/24/32 bytes) and block length (16/24/32 bytes), computes the number of rounds (10/12/14), converts the user key into big-endian 32-bit words, generates the full encryption key schedule via Rijndael key expansion (using S-box and rcon), copies to decryption key schedule in reverse order, and applies inverse MixColumns to inner decryption round keys. Constructor-like initialization (sets vtable). |
| 0x00B0A550 | 172 | CCipher__reset_state | Resets a cipher object's internal state. Sets the vtable pointer (PTR_FUN_01180994), then zeros out multiple internal buffers: two 0x1E0-byte blocks (round keys/state), and five 0x20-byte blocks (IV, counter, etc). Total object size is approximately 0x474 bytes. |
| 0x00B0A600 | 38 | CCipher__scalar_deleting_dtor | Scalar deleting destructor for the cipher object. Calls CCipher__reset_state to clear sensitive data, then frees the 0x474-byte object if the flag bit is set. |
| 0x00B0A630 | 313 | CCipher__encrypt_ecb | ECB mode block cipher encryption. Validates the cipher is initialized and data is a multiple of the block size. Processes data block-by-block using CCipher__encrypt_single_block, writing results to a local 128-byte buffer, then copies to the output. Throws CRijndael exception if not initialized or data size is not block-aligned. Resets cipher state after completion. |
| 0x00B0A770 | 313 | CCipher__decrypt_ecb | ECB mode block cipher decryption. Same structure as CCipher__encrypt_ecb but uses CCipher__decrypt_single_block instead. Validates initialization and block size alignment, processes blocks into local buffer, copies result, and resets state. Throws CRijndael exception on error. |
| 0x00B0A8B0 | 384 | CCipher__process_encrypt | Block cipher encryption dispatch with 3 modes via param_5. Mode 0 (default): ECB - raw block encrypt. Mode 1: encrypt each input block, XOR result with IV, save input as next IV (non-standard chaining). Mode 2: decrypt IV into output, XOR with input block, save input as next IV (non-standard chaining). Validates initialization and block alignment. Block size at offset 0x3CC, IV at offset 0x3F4. |
| 0x00B0AA40 | 759 | CCipher__encrypt_single_block | Encrypts a single block using the cipher's round keys. Core block cipher encryption operation. |
| 0x00B0AD40 | 919 | CCipher__encrypt_block_128bit | Encrypts a single 128-bit (16-byte) block using AES/Rijndael. This is the optimized path called by CCipher__encrypt_single_block when block size is 0x10. Takes 16-byte input, XORs with initial round key, performs round_count-1 rounds of SubBytes+ShiftRows+MixColumns+AddRoundKey using T-tables, then final round with S-box substitution and AddRoundKey. Writes 16-byte output. |
| 0x00B0B0E0 | 916 | CCipher__expand_decrypt_key | Expands the decryption key into round keys for the cipher. Generates the inverse key schedule for decryption. |
| 0x00B0B480 | 390 | CCipher__process_decrypt | Main decrypt dispatch for block cipher. Supports 3 modes via param_5: mode 1 = CBC decrypt (XOR plaintext with IV, decrypt, save ciphertext as next IV), mode 2 = variant CBC decrypt, mode 0/default = ECB decrypt. Block size at offset 0x3CC, IV at offset 0x3F4. |
| 0x00B0B610 | 756 | CCipher__decrypt_single_block | Decrypts a single block using the cipher's inverse round keys. Core block cipher decryption operation. |
| 0x00B0B910 | 1118 | CCipher__set_key | Sets the encryption/decryption key for the cipher object. Validates key length, expands both encrypt and decrypt round keys, and initializes the cipher state including block size and IV. |
| 0x00B0BD70 | 88 | CCipher__xor_blocks | XORs two byte blocks together for cipher block chaining. XORs param_2[i] ^= (param_3 offset)[i] for block_size bytes (at offset 0x3CC in the cipher object). Throws if the cipher is not initialized. |
| 0x00B0BDD0 | 35 | store_uint32_le | Stores a 32-bit integer in little-endian byte order to the destination buffer. |
| 0x00B0BE00 | 19 | store_uint16_le | Stores a 16-bit integer in little-endian byte order to the destination buffer. |
| 0x00B0CD90 | 1243 | cast5_decrypt_block | CAST-128 (CAST5) block decryption. Operates on 8-byte block. Uses 4 S-boxes at DAT_01180998/01180d98/01181198/01181598. 16 rounds with alternating +/-/^ key mixing and variable left rotations. param_1 = expanded key (32 subkeys + 32 rotation amounts). |
| 0x00B0D270 | 1255 | cast5_encrypt_block | CAST-128 (CAST5) block encryption. Forward direction. Same S-boxes and structure as cast5_decrypt_block but rounds applied in forward order. 12 or 16 rounds depending on key length (param_1[0x20]). |
| 0x00B0D760 | 904 | cast5_key_schedule | CAST-128 key schedule generation. Expands key bytes into 16 subkeys and 16 rotation amounts at param_1. Uses auxiliary S-boxes at DAT_01181998/01181d98/01182198/01182598. Sets round count (12 or 16) at param_1[0x20] based on key length. |
| 0x00B0EA80 | 3207 | aria_encrypt_block | ARIA block cipher encryption. 128-bit block. Uses S-boxes at DAT_016f5b18/016f5f18/016f6318/016f6718 for round transformations and DAT_016f5918/016f5a18 for final round substitution. Round keys from PTR_DAT_013510e4. 12 rounds for 128-bit key. |
| 0x00B0F710 | 3207 | aria_decrypt_block | ARIA block cipher decryption. 128-bit block. Uses same S-boxes as aria_encrypt_block. Decryption round keys from PTR_DAT_013510e0. 12 rounds for 128-bit key, final round uses byte-level S-box substitution. |
| 0x00B103A0 | 3275 | aria_key_expansion | ARIA key expansion. Initializes S-boxes (lazy init via DAT_016f5910), then expands key (param_1) of size param_2 bits into encryption round keys (PTR_DAT_013510e0) and decryption round keys (PTR_DAT_013510e4). Supports 128/192/256-bit keys. |
| 0x00B11070 | 120 | misty1_fi_function | MISTY1 FI function (Feistel round function). Takes 32-bit input and subkey. Uses crypto_gf_add and crypto_gf_add_one for S-box substitution and mixing. Returns 32-bit transformed output. |
| 0x00B110F0 | 124 | misty1_decrypt_block | MISTY1 block decryption. 64-bit block. Reads two 32-bit words, XORs with final whitening keys, iterates FI rounds in reverse using subkeys from DAT_016f6cd4 downward. Writes decrypted result to param_2. |
| 0x00B11170 | 151 | misty1_encrypt_block | MISTY1 block encryption. 64-bit block. Reads two 32-bit words, XORs with whitening keys, iterates FI rounds forward using subkeys from DAT_016f6cb8. Writes encrypted 8-byte result to param_2. |
| 0x00B11210 | 461 | misty1_key_schedule | MISTY1 key expansion. Takes 8-byte key, generates 8 rounds of subkeys stored at DAT_016f6cb8-016f6cd4. Also derives 4 whitening keys (DAT_016f5914, DAT_016f6cf8, DAT_016f6cfc, DAT_016f6d00). Uses GF operations for key mixing. |
| 0x00B113E0 | 76 | skipjack_g_permutation | Skipjack G permutation. Uses F-table at DAT_01353108 and lookup table at DAT_01353188. Takes 16-bit input and returns permuted 16-bit result. Core component of Skipjack cipher rounds. |
| 0x00B11430 | 107 | skipjack_rule_a | Skipjack Rule A round function. Applies subkey mixing with XOR/AND/OR operations on 32-bit data word using 8 subkeys from param_1. Round counter param_3 selects subkey and controls even/odd behavior. |
| 0x00B114A0 | 107 | skipjack_rule_b | Skipjack Rule B round function (inverse of Rule A). Applies subkey mixing in reverse direction for decryption. Uses same subkey structure as skipjack_rule_a. |
| 0x00B11510 | 313 | skipjack_round_pair | Skipjack combined round pair. Applies 3 G-permutations and subkey mixing operations in sequence. Uses F-table at DAT_01353108 and DAT_01353188. Returns 32-bit result combining upper and lower halves. |
| 0x00B11650 | 796 | sha1_compress | SHA-1 compression function. Takes 20-byte state (param_1), message schedule word count (param_2), outputs 5 uint state (param_3). 80 rounds in 4 groups of 20 with constants 0x5a827998, 0x6ef9eba1, 0x7f1cbcdc, 0xaa62d1d6. Message expansion via XOR of prior words. |
| 0x00B11970 | 79 | sha1_derive_subkey | Derives a specific 32-bit subkey from SHA-1 hash. Calls sha1_compress with param_2/5 as schedule count, then returns the (param_2 % 5)th word of the resulting 5-word hash state. |
| 0x00B119C0 | 175 | aria_init_sbox_tables | Initializes ARIA S-box and related lookup tables. Generates 256-entry S-box (DAT_016f5918), inverse S-box (DAT_016f5a18), and 4 diffusion tables (DAT_016f5b18, DAT_016f5f18, DAT_016f6318, DAT_016f6718) using affine transformations from DAT_013510b0/c0/d0. |
| 0x00B11A70 | 80 | rc4_multi_init | Initializes RC4-variant cipher with multiple S-box instances. Sets up two 1024-byte key schedules (at offsets +8 and +0x408) via rc4_key_schedule_init. Initializes counter and state fields to zero. Returns 0 on success, -1 on null input. |
| 0x00B11AC0 | 181 | rc4_multi_generate_byte | RC4-variant PRNG byte generation. Uses multi-S-box state (4 interleaved 256-byte tables). Swaps S-box entries, advances counters with carry logic across 4 sub-tables. Returns pseudorandom byte. State wraps when counter reaches 4. |
| 0x00B11B80 | 236 | rc4_key_schedule_init | RC4-variant key schedule initialization. Initializes param_4 interleaved 256-byte S-boxes (param_1) with identity permutation, then applies key-scheduling algorithm (KSA) using key (param_2) of length param_3. 8 passes per sub-table with staggered offsets. |
| 0x00B11C70 | 1081 | multi2_decrypt_block | MULTI2 block cipher decryption. 64-bit block (4 x 16-bit words). 8 rounds processing 4 sub-blocks using S-box table at DAT_016d5910 with bit-selected lookups. Key schedule from param_2 traversed in reverse (offset 0xC0 down to 0). |
| 0x00B120B0 | 1081 | multi2_encrypt_block | MULTI2 block cipher encryption. 64-bit block (4 x 16-bit words). 8 rounds processing 4 sub-blocks using S-box table at DAT_016d5910 with bit-selected lookups. Key schedule from param_2 traversed forward. |
| 0x00B124F0 | 884 | multi2_init_sbox_table | Initializes MULTI2 S-box lookup table at DAT_016d5910 (65536 entries). Constructs table from 8 smaller 64-entry S-boxes (DAT_0134cc90 through DAT_0134d010) using bit-extraction controlled by 48 parameters at DAT_01353988-01353a44. |
| 0x00B12870 | 209 | multi2_key_schedule | MULTI2 key schedule generation. Initializes S-box table, copies 16-byte key (8+8 halves) from param_1, then performs 32 rounds of multi2_encrypt_block for each half to derive 0xC0 bytes of round subkeys into param_2. |
| 0x00B12950 | 412 | skipjack_encrypt_block | Skipjack block cipher encryption. 64-bit block (2 x 32-bit words). 8 rounds using skipjack_round_pair with 16 subkeys from param_1 (8 for each half). Uses Rule A/B mixing with G-permutations. |
| 0x00B12AF0 | 257 | skipjack_encrypt_extended | Extended Skipjack encryption with more rounds. Uses skipjack_rule_a and skipjack_round_pair alternately for 10 round pairs. Takes key schedule (param_1), input block (param_2), output block (param_3). |
| 0x00B12C00 | 23 | skipjack_clear_key_state | Clears 128-byte (0x80) Skipjack key state buffer to zero using memset. |
| 0x00B12C20 | 921 | skipjack_key_schedule | Skipjack key expansion. Takes 16-byte key (param_2, 4 uints), byte-swaps into 8 x 16-bit subkeys (param_1[0..7]), then derives 24 additional subkeys (param_1[8..31]) using G-permutation and F-table lookups. Stores low 9 bits and high 7 bits separately. |
| 0x00B134A0 | 582 | snow2_keystream_generate | SNOW 2.0 keystream generator. Uses LFSR with 512-entry S-box table (param_1). Generates 128 keystream words per call into param_3. Two outer passes with 64 inner rounds each. Feedback via 9-bit right rotation and S-box lookups. |
| 0x00B136F0 | 114 | snow2_encrypt_stream | SNOW 2.0 stream cipher encrypt/decrypt. XORs param_3 words at param_2 with keystream. Automatically generates new keystream block (1024 words) via snow2_keystream_generate when buffer exhausted. |
| 0x00B13770 | 114 | snow2_decrypt_stream | SNOW 2.0 stream cipher decrypt. Identical to snow2_encrypt_stream (symmetric cipher). XORs param_3 words at param_2 with keystream from state at param_1. |
| 0x00B137F0 | 418 | snow2_key_setup | SNOW 2.0 key setup. Derives S-box table (510 words), mixing keys, and initial state from SHA-1 hash of key material (param_2). Multiple sha1_compress calls with different indices to fill different key regions. |
| 0x00B139A0 | 436 | snow2_key_setup_with_init | SNOW 2.0 key setup with state initialization. Same as snow2_key_setup but also initializes keystream counter (param_1+0xc94=0) and buffer index (param_1+0x1c98=0x400, forces regeneration on first use). |
| 0x00B13B60 | 48 | snow2_generate_block | Forces generation of a new SNOW 2.0 keystream block. Calls snow2_keystream_generate, resets buffer index to 0, increments counter. |
| 0x00B13B90 | 27 | snow2_set_counter | Sets SNOW 2.0 keystream counter to param_2. Also sets buffer index to 0x400 to force regeneration on next use. |
| 0x00B13BB0 | 259 | tiger_hash | Tiger hash function. Computes 192-bit hash. Initializes state with IV (0x89abcdef, 0x01234567, 0x76543210, 0xfedcba98, 0xc3b2e187, 0xf096a5b4). Processes 64-byte blocks via tiger_compress (FUN_00b13cc0). Standard Merkle-Damgard padding with 0x01 pad byte. |
| 0x00B13CC0 | 3355 | tiger_compress | Tiger hash compression function. Processes 64-byte block (16 uints from param_1) into 6-word state (param_2). 3 passes with different multipliers (5/7/9). Uses 4 Tiger S-box tables at DAT_01351108-01352908. Includes key schedule mixing between passes. |
| 0x00B157E0 | 121 | CryptoMap__delete_subtree | Deletes a subtree of crypto map nodes. Walks linked list starting at param_3, recursively deletes child subtrees, frees 0xA8-byte nodes. Stops when sentinel node (byte 0xD=1) is reached. |
| 0x00B15860 | 75 | CryptoMap__lower_bound | Performs lower_bound search on a red-black tree (crypto map). Traverses tree comparing keys (int at node+0x10). Returns iterator (node pointer, found flag, parent) in param_2. |
| 0x00B158B0 | 248 | CryptoMap__insert_or_find | Inserts a key into crypto map or finds existing entry. Uses lower_bound to check for duplicates. If not found, allocates 0xA8-byte node, initializes via move-construct, and calls Insert_node. Returns iterator and inserted flag in param_2. |
| 0x00B159B0 | 476 | CryptoMapEntry__move_ctor | Move constructor for crypto map entry (0xA8 bytes). Copies header fields and 6 string-like members (each 24 bytes with size/capacity at offsets +16/+20). Steals string buffers from source and resets source to empty (size=0, capacity=0xF). |
| 0x00B15B90 | 239 | CryptoMapEntry__default_ctor | Default constructor for crypto map entry. Initializes 6 string-like members to empty state (size=0, capacity=0xF, null-terminated) with SEH. |
| 0x00B15C80 | 414 | CryptoManager__ctor | Constructor for CryptoManager object. Initializes vectors, allocates 3 red-black tree sentinel nodes (0x20, 0xA8, 0xA8 bytes), sets initial values. Clears existing tree data and vectors. Sets enabled flag and multiple sentinel indices to -1. |
| 0x00B15E20 | 70 | CryptoMapNode__delete_with_seh | Deletes a crypto map node (0xA8 bytes) with SEH. Checks if node pointer at param_1+4 is non-null before freeing. |
| 0x00B15E70 | 79 | CryptoMap__dtor_tree_and_sentinel | Destructor that deletes crypto map tree and frees sentinel node (0xA8 bytes). Calls CryptoMap__delete_subtree on root, then frees sentinel. |
| 0x00B15ED0 | 107 | CryptoMapEntry__dtor_with_strings | Destroys crypto map entry: calls string destructor for 6 string members, then frees the 0xA8-byte node. Checks for non-null pointer before freeing. |
| 0x00B15F40 | 81 | CryptoMapNode__free_if_nonnull | Frees a crypto map node (0xA8 bytes) if the pointer at param_1+4 is non-null. SEH-wrapped. |
| 0x00B15FA0 | 90 | CryptoMap__dtor_tree_and_free | Deletes crypto map tree and frees sentinel. Calls CryptoMap__delete_subtree then frees 0xA8-byte sentinel node. SEH-wrapped. |
| 0x00B16000 | 147 | CryptoMapEntry__dtor_6strings | Destroys 6 string members of a crypto map entry by calling STL_string_dtor 6 times in reverse order. SEH-wrapped with descending exception state (5 to 0). |
| 0x00B160A0 | 147 | CryptoMapEntry__dtor_6strings_00b160a0 | Duplicate of CryptoMapEntry__dtor_6strings. Destroys 6 string members by calling STL_string_dtor 6 times. SEH-wrapped. |
| 0x00B16140 | 202 | CryptoManager__dtor | Destructor for CryptoManager. Deletes 3 tree structures (at offsets +0x24, +0x1C, +0x14), frees sentinel nodes (0xA8, 0xA8, 0x20 bytes), then calls parent destructor (CFmt__func_0058c230). SEH-wrapped. |
| 0x00B16810 | 611 | CryptoManager__process_pending_entries | Processes pending crypto entries from tree at offset +0x24 into active tree at +0x1C. Iterates up to 10 entries, copies each via move constructor, inserts into active map. If only 1 entry remains, clears pending tree entirely. Frees processed entries. |
| 0x00B16A80 | 72 | CryptoManager__clear_both_maps | Clears both crypto maps (at offsets +0x1C and +0x24). Deletes all tree nodes, resets sentinel self-references, sets counts to 0. |
| 0x00B16AD0 | 177 | CryptoManager__remove_entry_by_key | Removes a crypto entry by integer key from both maps (+0x1C and +0x24). Uses lower_bound search to find entry, then erases and frees the node if found in either map. |
| 0x00B16B90 | 320 | CryptoMap__erase_range_by_key | Erases a range of entries from crypto map by key range. Finds lower and upper bounds via tree traversal, counts entries in range, then erases them. If range covers entire tree, clears all at once. |
| 0x00B16CD0 | 19 | CryptoMap__erase_range_wrapper | Simple wrapper that calls CryptoMap__erase_range_by_key with parameters from stack. |
| 0x00B16CF0 | 2237 | CryptoManager__add_service_entry | Adds a service entry to the CryptoManager. Takes multiple parameters including strings, timestamps, and service indices. Looks up channel by index, constructs formatted time/level strings, builds item descriptions from resource string IDs (0x658+, 0x6AF+). Returns result pointer. |
| 0x00B17BA0 | 147 | CryptoManager__check_service_filter | Checks if a service entry passes filter criteria. Validates against 3 filter values at param_1+0x38/0x3C/0x40 (range check, equality check, and list membership). Returns 1 if entry passes filter, 0 otherwise. |
| 0x00B17C40 | 89 | CryptoManager__reset_maps | Resets CryptoManager state. Sets flag at +0x2C=1, sentinel at +0x30=-1, counter to 0. Clears both crypto maps (at offsets +0x1C and +0x24) by deleting all tree nodes and resetting sentinels. |
| 0x00B18210 | 25 | CryptoManager__set_filter_values | Sets 3 filter values at offsets +0x38, +0x3C, +0x40 of the CryptoManager object. |
| 0x00BA81B0 | 285 | anticheat_gdi_hook_check | Anti-cheat check that detects GDI32.dll hooking. Loads GDI32.dll, gets address of TextOutW, and compares it to the import table entry. If they differ (function is hooked/detoured), proceeds to anti-cheat response. Also checks IsDebuggerPresent. If tampering detected and DAT_016d3b10==0, randomly selects a penalty action (rand%6): shows warning dialog (msg 0x359 or 800) and forces quit via CGameMode__on_quit. The randomization makes the anti-cheat response non-deterministic to complicate analysis. |
| 0x00C7E440 | 225 | MD5__update | MD5 update function. Adds data to the hash state. Tracks bit count in state[0..1], buffers partial blocks at state+0x18, and processes complete 64-byte blocks via the MD5 transform function. Handles alignment of partial buffered data with new input. |
| 0x00C7E530 | 351 | MD5__finalize | MD5 finalize function. Appends padding (0x80 + zeros) to fill the block, appends the 8-byte bit length, processes the final block via MD5 transform, then extracts the 16-byte digest from the 4 state registers (A/B/C/D) into param_2 in little-endian byte order. |
| 0x00C7E690 | 42 | MD5__init | Initializes MD5 hash context. Sets bit count to 0 and initializes the standard MD5 initial hash values: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476. |
| 0x00C7E6C0 | 1991 | MD5__transform | MD5 block transform. Processes a single 64-byte (512-bit) block through all 4 rounds of MD5 (F/G/H/I rounds, 16 operations each = 64 total). Reads 16 dwords from the input block, applies the MD5 round constants and rotations, then adds the results to the running hash state at this+8/0xC/0x10/0x14. Handles unaligned input by copying to stack. |
| 0x00DC7350 | 40 | xor_decrypt_wrapper_00dc7350 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7380 | 40 | xor_decrypt_wrapper_00dc7380 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC73B0 | 40 | xor_decrypt_wrapper_00dc73b0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC73E0 | 40 | xor_decrypt_wrapper_00dc73e0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7410 | 40 | xor_decrypt_wrapper_00dc7410 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7440 | 40 | xor_decrypt_wrapper_00dc7440 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7470 | 40 | xor_decrypt_wrapper_00dc7470 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC74A0 | 40 | xor_decrypt_wrapper_00dc74a0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC74D0 | 40 | xor_decrypt_wrapper_00dc74d0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7500 | 40 | xor_decrypt_wrapper_00dc7500 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7530 | 40 | xor_decrypt_wrapper_00dc7530 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7560 | 40 | xor_decrypt_wrapper_00dc7560 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7590 | 40 | xor_decrypt_wrapper_00dc7590 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC75C0 | 40 | xor_decrypt_wrapper_00dc75c0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC75F0 | 40 | xor_decrypt_wrapper_00dc75f0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7620 | 40 | xor_decrypt_wrapper_00dc7620 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7650 | 40 | xor_decrypt_wrapper_00dc7650 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7680 | 40 | xor_decrypt_wrapper_00dc7680 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC76B0 | 40 | xor_decrypt_wrapper_00dc76b0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC76E0 | 40 | xor_decrypt_wrapper_00dc76e0 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7710 | 40 | xor_decrypt_wrapper_00dc7710 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7740 | 40 | xor_decrypt_wrapper_00dc7740 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC7770 | 40 | xor_decrypt_wrapper_00dc7770 | XOR decryption wrapper. Applies XOR cipher to a data buffer using a key. |
| 0x00DC77A0 | 40 | xor_decrypt_wrapper_00dc77a0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC77D0 | 40 | xor_decrypt_wrapper_00dc77d0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7800 | 40 | xor_decrypt_wrapper_00dc7800 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7830 | 40 | xor_decrypt_wrapper_00dc7830 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7860 | 40 | xor_decrypt_wrapper_00dc7860 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7890 | 40 | xor_decrypt_wrapper_00dc7890 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC78C0 | 40 | xor_decrypt_wrapper_00dc78c0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC78F0 | 40 | xor_decrypt_wrapper_00dc78f0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7920 | 40 | xor_decrypt_wrapper_00dc7920 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7950 | 40 | xor_decrypt_wrapper_00dc7950 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7980 | 40 | xor_decrypt_wrapper_00dc7980 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC79B0 | 40 | xor_decrypt_wrapper_00dc79b0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC79E0 | 40 | xor_decrypt_wrapper_00dc79e0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7A10 | 40 | xor_decrypt_wrapper_00dc7a10 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7A40 | 40 | xor_decrypt_wrapper_00dc7a40 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7A70 | 40 | xor_decrypt_wrapper_00dc7a70 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7AA0 | 40 | xor_decrypt_wrapper_00dc7aa0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7AD0 | 40 | xor_decrypt_wrapper_00dc7ad0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7B00 | 40 | xor_decrypt_wrapper_00dc7b00 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7B30 | 40 | xor_decrypt_wrapper_00dc7b30 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7B60 | 40 | xor_decrypt_wrapper_00dc7b60 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7B90 | 40 | xor_decrypt_0x0a_00dc7b90 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7BC0 | 40 | xor_decrypt_0x0a_00dc7bc0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7BF0 | 40 | xor_decrypt_0x0a_00dc7bf0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7C20 | 40 | xor_decrypt_0x0a_00dc7c20 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7C50 | 40 | xor_decrypt_0x0a_00dc7c50 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7C80 | 40 | xor_decrypt_0x0a_00dc7c80 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7CB0 | 40 | xor_decrypt_0x0a_00dc7cb0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7CE0 | 40 | xor_decrypt_0x0a_00dc7ce0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7D10 | 40 | xor_decrypt_0x0a_00dc7d10 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7D40 | 40 | xor_decrypt_0x0a_00dc7d40 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7D70 | 40 | xor_decrypt_0x0a_00dc7d70 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7DA0 | 40 | xor_decrypt_0x0a_00dc7da0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7DD0 | 40 | xor_decrypt_0x0a_00dc7dd0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7E00 | 40 | xor_decrypt_0x0a_00dc7e00 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7E30 | 40 | xor_decrypt_0x0a_00dc7e30 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7E60 | 40 | xor_decrypt_0x0a_00dc7e60 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7E90 | 40 | xor_decrypt_0x0a_00dc7e90 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7EC0 | 40 | xor_decrypt_0x0a_00dc7ec0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7EF0 | 40 | xor_decrypt_0x0a_00dc7ef0 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7F20 | 40 | xor_decrypt_0x0a_00dc7f20 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7F50 | 40 | xor_decrypt_0x0a_00dc7f50 | XOR-decrypts a 10-byte buffer at offset 0x0a with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7F80 | 40 | xor_decrypt_0x10_00dc7f80 | XOR-decrypts a 0x10-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7FB0 | 40 | xor_decrypt_0x10_00dc7fb0 | XOR-decrypts a 0x10-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC7FE0 | 40 | xor_decrypt_0x10_00dc7fe0 | XOR-decrypts a 0x10-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8010 | 40 | xor_decrypt_0x10_00dc8010 | XOR-decrypts a 0x10-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8040 | 40 | xor_decrypt_0x10_00dc8040 | XOR-decrypts a 0x10-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8070 | 40 | xor_decrypt_0x12_00dc8070 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC80A0 | 40 | xor_decrypt_0x12_00dc80a0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC80D0 | 40 | xor_decrypt_0x12_00dc80d0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8100 | 40 | xor_decrypt_0x12_00dc8100 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8130 | 40 | xor_decrypt_0x12_00dc8130 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8160 | 40 | xor_decrypt_0x12_00dc8160 | XOR decrypts a 0x12-byte buffer using keys 0xe921ad6f/0xb739073f. Checks flag at +0x12 to avoid double-decryption. One of ~40 identical decrypt stubs with different key pairs, used for obfuscated string decryption. |
| 0x00DC8190 | 40 | xor_decrypt_0x12_00dc8190 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC81C0 | 40 | xor_decrypt_0x12_00dc81c0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC81F0 | 40 | xor_decrypt_0x12_00dc81f0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8220 | 40 | xor_decrypt_0x12_00dc8220 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8250 | 40 | xor_decrypt_0x12_00dc8250 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8280 | 40 | xor_decrypt_0x12_00dc8280 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC82B0 | 40 | xor_decrypt_0x12_00dc82b0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC82E0 | 40 | xor_decrypt_0x12_00dc82e0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8310 | 40 | xor_decrypt_0x12_00dc8310 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8340 | 40 | xor_decrypt_0x12_00dc8340 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8370 | 40 | xor_decrypt_0x12_00dc8370 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC83A0 | 40 | xor_decrypt_0x12_00dc83a0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC83D0 | 40 | xor_decrypt_0x12_00dc83d0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8400 | 40 | xor_decrypt_0x12_00dc8400 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8430 | 40 | xor_decrypt_0x12_00dc8430 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8460 | 40 | xor_decrypt_0x12_00dc8460 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8490 | 40 | xor_decrypt_0x12_00dc8490 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC84C0 | 40 | xor_decrypt_0x12_00dc84c0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC84F0 | 40 | xor_decrypt_0x12_00dc84f0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8520 | 40 | xor_decrypt_0x12_00dc8520 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8550 | 40 | xor_decrypt_0x12_00dc8550 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8580 | 40 | xor_decrypt_0x12_00dc8580 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC85B0 | 40 | xor_decrypt_0x12_00dc85b0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC85E0 | 40 | xor_decrypt_0x12_00dc85e0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8610 | 40 | xor_decrypt_0x12_00dc8610 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8640 | 40 | xor_decrypt_0x12_00dc8640 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8670 | 40 | xor_decrypt_0x12_00dc8670 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC86A0 | 40 | xor_decrypt_0x12_00dc86a0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC86D0 | 40 | xor_decrypt_0x12_00dc86d0 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8700 | 40 | xor_decrypt_0x12_00dc8700 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8730 | 40 | xor_decrypt_0x12_00dc8730 | XOR-decrypts a 0x12-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8760 | 40 | xor_decrypt_0x14_00dc8760 | XOR-decrypts a 0x14-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8790 | 40 | xor_decrypt_0x14_00dc8790 | XOR-decrypts a 0x14-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC87C0 | 40 | xor_decrypt_0x14_00dc87c0 | XOR-decrypts a 0x14-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC87F0 | 40 | xor_decrypt_0x16_00dc87f0 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8820 | 40 | xor_decrypt_0x16_00dc8820 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8850 | 40 | xor_decrypt_0x16_00dc8850 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8880 | 40 | xor_decrypt_0x16_00dc8880 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC88B0 | 40 | xor_decrypt_0x16_00dc88b0 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC88E0 | 40 | xor_decrypt_0x16_00dc88e0 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8910 | 40 | xor_decrypt_0x16_00dc8910 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8940 | 40 | xor_decrypt_0x16_00dc8940 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8970 | 40 | xor_decrypt_0x16_00dc8970 | XOR decrypt entry. Checks flag at offset+0x16, decrypts 0x16 bytes with keys 0x9D235DDF/DAT_01E7898D, clears flag. |
| 0x00DC89A0 | 40 | xor_decrypt_0x16_00dc89a0 | XOR decrypt entry. Checks flag at offset+0x16, decrypts 0x16 bytes with keys 0xF3395587/0x3939079F, clears flag. |
| 0x00DC89D0 | 40 | xor_decrypt_0x16_00dc89d0 | XOR decrypt entry. Checks flag at offset+0x16, decrypts 0x16 bytes with keys 0x97A37DCF/0x3D8387EF, clears flag. |
| 0x00DC8A00 | 40 | xor_decrypt_0x16_00dc8a00 | XOR decrypt entry. Checks flag at offset+0x16, decrypts 0x16 bytes with keys 0x71B701AB/0x4917EB6D, clears flag. |
| 0x00DC8A30 | 40 | xor_decrypt_0x16_00dc8a30 | XOR decrypt entry. Checks flag at offset+0x16, decrypts 0x16 bytes with keys 0x7BF39BE1/0x61FF87ED, clears flag. |
| 0x00DC8A60 | 40 | xor_decrypt_0x16_00dc8a60 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8A90 | 40 | xor_decrypt_0x16_00dc8a90 | XOR-decrypts a 0x16-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8AC0 | 40 | xor_decrypt_0x17_00dc8ac0 | XOR-decrypts a 0x17-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8AF0 | 40 | xor_decrypt_0x17_00dc8af0 | XOR-decrypts a 0x17-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8B20 | 40 | xor_decrypt_0x17_00dc8b20 | XOR-decrypts a 0x17-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8B50 | 40 | xor_decrypt_0x18_00dc8b50 | XOR-decrypts a 0x18-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8B80 | 40 | xor_decrypt_0x18_00dc8b80 | XOR-decrypts a 0x18-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8BB0 | 40 | xor_decrypt_0x19_00dc8bb0 | XOR-decrypts a 0x19-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8BE0 | 40 | xor_decrypt_0x19_00dc8be0 | XOR-decrypts a 0x19-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8C10 | 40 | xor_decrypt_0x19_00dc8c10 | XOR-decrypts a 0x19-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8C40 | 40 | xor_decrypt_0x19_00dc8c40 | XOR-decrypts a 0x19-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8C70 | 40 | xor_decrypt_0x19_00dc8c70 | XOR-decrypts a 0x19-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8CA0 | 40 | xor_decrypt_0x19_00dc8ca0 | XOR-decrypts a 0x19-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8CD0 | 40 | xor_decrypt_0x1a_00dc8cd0 | XOR-decrypts a 0x1a-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8D00 | 40 | xor_decrypt_0x1a_00dc8d00 | XOR-decrypts a 0x1a-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8D30 | 40 | xor_decrypt_0x1a_00dc8d30 | XOR-decrypts a 0x1a-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8D60 | 40 | xor_decrypt_0x1a_00dc8d60 | XOR-decrypts a 0x1a-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8D90 | 40 | xor_decrypt_0x1a_00dc8d90 | XOR-decrypts a 0x1a-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8DC0 | 40 | xor_decrypt_0x1c_00dc8dc0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8DF0 | 40 | xor_decrypt_0x1c_00dc8df0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8E20 | 40 | xor_decrypt_0x1c_00dc8e20 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8E50 | 40 | xor_decrypt_entry_00dc8e50 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8E80 | 40 | xor_decrypt_entry_00dc8e80 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8EB0 | 40 | xor_decrypt_entry_00dc8eb0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8EE0 | 40 | xor_decrypt_entry_00dc8ee0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8F10 | 40 | xor_decrypt_entry_00dc8f10 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8F40 | 40 | xor_decrypt_entry_00dc8f40 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8F70 | 40 | xor_decrypt_entry_00dc8f70 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8FA0 | 40 | xor_decrypt_entry_00dc8fa0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC8FD0 | 40 | xor_decrypt_entry_00dc8fd0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9000 | 40 | xor_decrypt_entry_00dc9000 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9030 | 40 | xor_decrypt_entry_00dc9030 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9060 | 40 | xor_decrypt_entry_00dc9060 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9090 | 40 | xor_decrypt_entry_00dc9090 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC90C0 | 40 | xor_decrypt_entry_00dc90c0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC90F0 | 40 | xor_decrypt_entry_00dc90f0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9120 | 40 | xor_decrypt_entry_00dc9120 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9150 | 40 | xor_decrypt_entry_00dc9150 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9180 | 40 | xor_decrypt_entry_00dc9180 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC91B0 | 40 | xor_decrypt_entry_00dc91b0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC91E0 | 40 | xor_decrypt_entry_00dc91e0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9210 | 40 | xor_decrypt_entry_00dc9210 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9240 | 40 | xor_decrypt_entry_00dc9240 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9270 | 40 | xor_decrypt_entry_00dc9270 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC92A0 | 40 | xor_decrypt_entry_00dc92a0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC92D0 | 40 | xor_decrypt_entry_00dc92d0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9300 | 40 | xor_decrypt_entry_00dc9300 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9330 | 40 | xor_decrypt_entry_00dc9330 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9360 | 40 | xor_decrypt_entry_00dc9360 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9390 | 40 | xor_decrypt_entry_00dc9390 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC93C0 | 40 | xor_decrypt_entry_00dc93c0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC93F0 | 40 | xor_decrypt_entry_00dc93f0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9420 | 40 | xor_decrypt_entry_00dc9420 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9450 | 40 | xor_decrypt_entry_00dc9450 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9480 | 40 | xor_decrypt_entry_00dc9480 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC94B0 | 40 | xor_decrypt_entry_00dc94b0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC94E0 | 40 | xor_decrypt_entry_00dc94e0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9510 | 40 | xor_decrypt_entry_00dc9510 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9540 | 40 | xor_decrypt_entry_00dc9540 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9570 | 40 | xor_decrypt_entry_00dc9570 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC95A0 | 40 | xor_decrypt_entry_00dc95a0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC95D0 | 40 | xor_decrypt_entry_00dc95d0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9600 | 40 | xor_decrypt_entry_00dc9600 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9630 | 40 | xor_decrypt_entry_00dc9630 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9660 | 40 | xor_decrypt_entry_00dc9660 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9690 | 40 | xor_decrypt_entry_00dc9690 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC96C0 | 40 | xor_decrypt_entry_00dc96c0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC96F0 | 40 | xor_decrypt_entry_00dc96f0 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9720 | 40 | xor_decrypt_entry_00dc9720 | XOR-decrypts a 0x1c-byte buffer with unique keys if not already decrypted, then clears the flag byte. |
| 0x00DC9750 | 40 | xor_decrypt_string_00dc9750 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with keys 0x9bbbedf7/0xcbd1f323. Clears decrypt flag after first call. Part of string obfuscation system. |
| 0x00DC9780 | 40 | xor_decrypt_string_00dc9780 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with keys 0x1589b50b/0xc399b709. Clears decrypt flag after first call. Part of string obfuscation system. |
| 0x00DC97B0 | 40 | xor_decrypt_string_00dc97b0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with keys 0xc5a50b6b/0xbdaddd87. Part of string obfuscation system. |
| 0x00DC97E0 | 40 | xor_decrypt_string_00dc97e0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9810 | 40 | xor_decrypt_string_00dc9810 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with keys 0x237315f3/0xb5f3f779. Part of string obfuscation system. |
| 0x00DC9840 | 40 | xor_decrypt_string_00dc9840 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9870 | 40 | xor_decrypt_string_00dc9870 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC98A0 | 40 | xor_decrypt_string_00dc98a0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC98D0 | 40 | xor_decrypt_string_00dc98d0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9900 | 40 | xor_decrypt_string_00dc9900 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9930 | 40 | xor_decrypt_string_00dc9930 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9960 | 40 | xor_decrypt_string_00dc9960 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9990 | 40 | xor_decrypt_string_00dc9990 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC99C0 | 40 | xor_decrypt_string_00dc99c0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC99F0 | 40 | xor_decrypt_string_00dc99f0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9A20 | 40 | xor_decrypt_string_00dc9a20 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9A50 | 40 | xor_decrypt_string_00dc9a50 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9A80 | 40 | xor_decrypt_string_00dc9a80 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9AB0 | 40 | xor_decrypt_string_00dc9ab0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9AE0 | 40 | xor_decrypt_string_00dc9ae0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9B10 | 40 | xor_decrypt_string_00dc9b10 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9B40 | 40 | xor_decrypt_string_00dc9b40 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9B70 | 40 | xor_decrypt_string_00dc9b70 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9BA0 | 40 | xor_decrypt_string_00dc9ba0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9BD0 | 40 | xor_decrypt_string_00dc9bd0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9C00 | 40 | xor_decrypt_string_00dc9c00 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9C30 | 40 | xor_decrypt_string_00dc9c30 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9C60 | 40 | xor_decrypt_string_00dc9c60 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9C90 | 40 | xor_decrypt_string_00dc9c90 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9CC0 | 40 | xor_decrypt_string_00dc9cc0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9CF0 | 40 | xor_decrypt_string_00dc9cf0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9D20 | 40 | xor_decrypt_string_00dc9d20 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9D50 | 40 | xor_decrypt_string_00dc9d50 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9D80 | 40 | xor_decrypt_string_00dc9d80 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9DB0 | 40 | xor_decrypt_string_00dc9db0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9DE0 | 40 | xor_decrypt_string_00dc9de0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9E10 | 40 | xor_decrypt_string_00dc9e10 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9E40 | 40 | xor_decrypt_string_00dc9e40 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9E70 | 40 | xor_decrypt_string_00dc9e70 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9EA0 | 40 | xor_decrypt_string_00dc9ea0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9ED0 | 40 | xor_decrypt_string_00dc9ed0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9F00 | 40 | xor_decrypt_string_00dc9f00 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9F30 | 40 | xor_decrypt_string_00dc9f30 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9F60 | 40 | xor_decrypt_string_00dc9f60 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9F90 | 40 | xor_decrypt_string_00dc9f90 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9FC0 | 40 | xor_decrypt_string_00dc9fc0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DC9FF0 | 40 | xor_decrypt_string_00dc9ff0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA020 | 40 | xor_decrypt_string_00dca020 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA050 | 40 | xor_decrypt_string_00dca050 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA080 | 40 | xor_decrypt_string_00dca080 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA0B0 | 40 | xor_decrypt_string_00dca0b0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA0E0 | 40 | xor_decrypt_string_00dca0e0 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA110 | 40 | xor_decrypt_string_00dca110 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA140 | 40 | xor_decrypt_string_00dca140 | XOR string decryptor. Decrypts 14-byte buffer using xor_decrypt_buffer with unique keys. Part of string obfuscation system. |
| 0x00DCA170 | 206 | tls_encrypted_string_init_00dca170 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS offset 0xca14 (14 bytes). Checks init flag, copies encrypted data from stack, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA240 | 204 | tls_encrypted_string_init_00dca240 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS offset 0xca28 (18 bytes). Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA310 | 206 | tls_encrypted_string_init_00dca310 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS offset 0xca40 (14 bytes). Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA3E0 | 206 | tls_encrypted_string_init_00dca3e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data from stack/globals, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA4B0 | 204 | tls_encrypted_string_init_00dca4b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA580 | 204 | tls_encrypted_string_init_00dca580 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA650 | 204 | tls_encrypted_string_init_00dca650 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA720 | 204 | tls_encrypted_string_init_00dca720 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA7F0 | 204 | tls_encrypted_string_init_00dca7f0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA8C0 | 206 | tls_encrypted_string_init_00dca8c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCA990 | 204 | tls_encrypted_string_init_00dca990 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCAA60 | 206 | tls_encrypted_string_init_00dcaa60 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCAB30 | 204 | tls_encrypted_string_init_00dcab30 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCAC00 | 206 | tls_encrypted_string_init_00dcac00 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCACD0 | 204 | tls_encrypted_string_init_00dcacd0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCADA0 | 204 | tls_encrypted_string_init_00dcada0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCAE70 | 204 | tls_encrypted_string_init_00dcae70 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCAF40 | 206 | tls_encrypted_string_init_00dcaf40 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB010 | 204 | tls_encrypted_string_init_00dcb010 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB0E0 | 206 | tls_encrypted_string_init_00dcb0e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB1B0 | 204 | tls_encrypted_string_init_00dcb1b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB280 | 206 | tls_encrypted_string_init_00dcb280 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB350 | 204 | tls_encrypted_string_init_00dcb350 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB420 | 204 | tls_encrypted_string_init_00dcb420 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB4F0 | 204 | tls_encrypted_string_init_00dcb4f0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB5C0 | 204 | tls_encrypted_string_init_00dcb5c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB690 | 206 | tls_encrypted_string_init_00dcb690 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB760 | 206 | tls_encrypted_string_init_00dcb760 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB830 | 204 | tls_encrypted_string_init_00dcb830 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB900 | 206 | tls_encrypted_string_init_00dcb900 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCB9D0 | 220 | tls_encrypted_string_init_00dcb9d0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS offset 0xcc3c (28 bytes). Checks init flag, copies encrypted data from globals, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBAB0 | 204 | tls_encrypted_string_init_00dcbab0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBB80 | 204 | tls_encrypted_string_init_00dcbb80 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBC50 | 206 | tls_encrypted_string_init_00dcbc50 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBD20 | 204 | tls_encrypted_string_init_00dcbd20 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBDF0 | 204 | tls_encrypted_string_init_00dcbdf0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBEC0 | 204 | tls_encrypted_string_init_00dcbec0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCBF90 | 204 | tls_encrypted_string_init_00dcbf90 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC060 | 220 | tls_encrypted_string_init_00dcc060 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC140 | 206 | tls_encrypted_string_init_00dcc140 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC210 | 204 | tls_encrypted_string_init_00dcc210 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC2E0 | 206 | tls_encrypted_string_init_00dcc2e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC3B0 | 204 | tls_encrypted_string_init_00dcc3b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC480 | 206 | tls_encrypted_string_init_00dcc480 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC550 | 204 | tls_encrypted_string_init_00dcc550 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC620 | 204 | tls_encrypted_string_init_00dcc620 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC6F0 | 204 | tls_encrypted_string_init_00dcc6f0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC7C0 | 204 | tls_encrypted_string_init_00dcc7c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC890 | 206 | tls_encrypted_string_init_00dcc890 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCC960 | 206 | tls_encrypted_string_init_00dcc960 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCA30 | 204 | tls_encrypted_string_init_00dcca30 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCB00 | 206 | tls_encrypted_string_init_00dccb00 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCBD0 | 220 | tls_encrypted_string_init_00dccbd0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCCB0 | 204 | tls_encrypted_string_init_00dcccb0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCD80 | 204 | tls_encrypted_string_init_00dccd80 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCE50 | 206 | tls_encrypted_string_init_00dcce50 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCF20 | 204 | tls_encrypted_string_init_00dccf20 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCCFF0 | 204 | tls_encrypted_string_init_00dccff0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD0C0 | 204 | tls_encrypted_string_init_00dcd0c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD190 | 204 | tls_encrypted_string_init_00dcd190 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD260 | 220 | tls_encrypted_string_init_00dcd260 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD340 | 206 | tls_encrypted_string_init_00dcd340 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD410 | 204 | tls_encrypted_string_init_00dcd410 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD4E0 | 204 | tls_encrypted_string_init_00dcd4e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD5B0 | 204 | tls_encrypted_string_init_00dcd5b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD680 | 206 | tls_encrypted_string_init_00dcd680 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD750 | 206 | tls_encrypted_string_init_00dcd750 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD820 | 204 | tls_encrypted_string_init_00dcd820 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD8F0 | 206 | tls_encrypted_string_init_00dcd8f0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCD9C0 | 204 | tls_encrypted_string_init_00dcd9c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDA90 | 204 | tls_encrypted_string_init_00dcda90 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDB60 | 220 | tls_encrypted_string_init_00dcdb60 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS offset 0xcf9c (28 bytes). Checks init flag, copies encrypted data from globals, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDC40 | 220 | tls_encrypted_string_init_00dcdc40 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDD20 | 220 | tls_encrypted_string_init_00dcdd20 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDE00 | 220 | tls_encrypted_string_init_00dcde00 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDEE0 | 220 | tls_encrypted_string_init_00dcdee0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCDFC0 | 220 | tls_encrypted_string_init_00dcdfc0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE0A0 | 220 | tls_encrypted_string_init_00dce0a0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE180 | 220 | tls_encrypted_string_init_00dce180 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE260 | 220 | tls_encrypted_string_init_00dce260 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE340 | 220 | tls_encrypted_string_init_00dce340 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE420 | 220 | tls_encrypted_string_init_00dce420 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE500 | 204 | tls_encrypted_string_init_00dce500 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE5D0 | 204 | tls_encrypted_string_init_00dce5d0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE6A0 | 206 | tls_encrypted_string_init_00dce6a0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE770 | 206 | tls_encrypted_string_init_00dce770 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE840 | 206 | tls_encrypted_string_init_00dce840 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE910 | 206 | tls_encrypted_string_init_00dce910 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCE9E0 | 204 | tls_encrypted_string_init_00dce9e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCEAB0 | 204 | tls_encrypted_string_init_00dceab0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCEB80 | 204 | tls_encrypted_string_init_00dceb80 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCEC50 | 204 | tls_encrypted_string_init_00dcec50 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCED20 | 204 | tls_encrypted_string_init_00dced20 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCEDF0 | 204 | tls_encrypted_string_init_00dcedf0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCEEC0 | 204 | tls_encrypted_string_init_00dceec0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCEF90 | 204 | tls_encrypted_string_init_00dcef90 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF060 | 206 | tls_encrypted_string_init_00dcf060 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF130 | 206 | tls_encrypted_string_init_00dcf130 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF200 | 204 | tls_encrypted_string_init_00dcf200 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF2D0 | 204 | tls_encrypted_string_init_00dcf2d0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF3A0 | 220 | tls_encrypted_string_init_00dcf3a0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF480 | 220 | tls_encrypted_string_init_00dcf480 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF560 | 220 | tls_encrypted_string_init_00dcf560 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF640 | 204 | tls_encrypted_string_init_00dcf640 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF710 | 204 | tls_encrypted_string_init_00dcf710 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF7E0 | 206 | tls_encrypted_string_init_00dcf7e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF8B0 | 206 | tls_encrypted_string_init_00dcf8b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCF980 | 204 | tls_encrypted_string_init_00dcf980 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFA50 | 204 | tls_encrypted_string_init_00dcfa50 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFB20 | 204 | tls_encrypted_string_init_00dcfb20 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFBF0 | 204 | tls_encrypted_string_init_00dcfbf0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFCC0 | 204 | tls_encrypted_string_init_00dcfcc0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFD90 | 204 | tls_encrypted_string_init_00dcfd90 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFE60 | 204 | tls_encrypted_string_init_00dcfe60 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DCFF30 | 204 | tls_encrypted_string_init_00dcff30 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0000 | 204 | tls_encrypted_string_init_00dd0000 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD00D0 | 206 | tls_encrypted_string_init_00dd00d0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD01A0 | 204 | tls_encrypted_string_init_00dd01a0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0270 | 204 | tls_encrypted_string_init_00dd0270 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0340 | 206 | tls_encrypted_string_init_00dd0340 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0410 | 206 | tls_encrypted_string_init_00dd0410 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD04E0 | 204 | tls_encrypted_string_init_00dd04e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD05B0 | 206 | tls_encrypted_string_init_00dd05b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0680 | 204 | tls_encrypted_string_init_00dd0680 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0750 | 204 | tls_encrypted_string_init_00dd0750 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0820 | 204 | tls_encrypted_string_init_00dd0820 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD08F0 | 204 | tls_encrypted_string_init_00dd08f0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD09C0 | 204 | tls_encrypted_string_init_00dd09c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0A90 | 206 | tls_encrypted_string_init_00dd0a90 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0B60 | 206 | tls_encrypted_string_init_00dd0b60 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0C30 | 206 | tls_encrypted_string_init_00dd0c30 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0D00 | 206 | tls_encrypted_string_init_00dd0d00 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0DD0 | 204 | tls_encrypted_string_init_00dd0dd0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0EA0 | 206 | tls_encrypted_string_init_00dd0ea0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD0F70 | 206 | tls_encrypted_string_init_00dd0f70 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1040 | 206 | tls_encrypted_string_init_00dd1040 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1110 | 206 | tls_encrypted_string_init_00dd1110 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD11E0 | 204 | tls_encrypted_string_init_00dd11e0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD12B0 | 204 | tls_encrypted_string_init_00dd12b0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1380 | 204 | tls_encrypted_string_init_00dd1380 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1450 | 204 | tls_encrypted_string_init_00dd1450 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1520 | 204 | tls_encrypted_string_init_00dd1520 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD15F0 | 204 | tls_encrypted_string_init_00dd15f0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD16C0 | 204 | tls_encrypted_string_init_00dd16c0 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1790 | 204 | tls_encrypted_string_init_00dd1790 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1860 | 204 | tls_encrypted_string_init_00dd1860 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer. Checks init flag, copies encrypted data, registers cleanup callback. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1930 | 204 | tls_encrypted_string_init_00dd1930 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS+0xd670. Checks init flag at TLS+0xd688, copies 0x16 bytes of encrypted data, registers cleanup callback via tls_register_destructor. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1A00 | 204 | tls_encrypted_string_init_00dd1a00 | TLS encrypted string initializer. Lazily initializes a thread-local encrypted string buffer at TLS+0xd68c. Checks init flag at TLS+0xd6a4, copies 0x16 bytes of encrypted data, registers cleanup callback via tls_register_destructor. Returns pointer to TLS string data. Part of string obfuscation system. |
| 0x00DD1AD0 | 204 | tls_init_var_d6a8 | TLS variable initializer. Copies 0x16 bytes to TLS offset 0xd6a8. Registers atexit cleanup. Returns pointer to TLS+0xd6a8. |
| 0x00DD1BA0 | 190 | tls_init_var_d6c4 | TLS variable initializer. Copies 0x10 bytes to TLS offset 0xd6c4. Registers atexit cleanup. Returns pointer to TLS+0xd6c4. |
| 0x00DD1C60 | 204 | tls_init_var_d6dc | TLS variable initializer. Copies 0xc bytes to TLS offset 0xd6dc. Registers atexit cleanup. Returns pointer to TLS+0xd6dc. |
| 0x00DD1D30 | 190 | tls_init_var_d6f0 | TLS variable initializer. Copies 0x10 bytes to TLS offset 0xd6f0. Registers atexit cleanup. Returns pointer to TLS+0xd6f0. |
| 0x00DD1DF0 | 204 | tls_init_var_d708 | TLS variable initializer. Copies 0xc bytes to TLS offset 0xd708. Registers atexit cleanup. Returns pointer to TLS+0xd708. |
| 0x00DD1EC0 | 204 | tls_init_var_d71c | TLS variable initializer. Copies 0x14 bytes to TLS offset 0xd71c. Registers atexit cleanup. Returns pointer to TLS+0xd71c. |
| 0x00DD1F90 | 204 | tls_init_var_d738 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd738. Registers atexit cleanup. Returns pointer to TLS+0xd738. |
| 0x00DD2060 | 220 | tls_init_var_d750 | TLS variable initializer. Copies 0x17 bytes to TLS offset 0xd750. Registers atexit cleanup. Returns pointer to TLS+0xd750. |
| 0x00DD2140 | 204 | tls_init_var_d76c | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd76c. Registers atexit cleanup. |
| 0x00DD2210 | 220 | tls_init_var_d784 | TLS variable initializer. Copies 0x17 bytes to TLS offset 0xd784. Registers atexit cleanup. |
| 0x00DD22F0 | 204 | tls_init_var_d7a0 | TLS variable initializer. Copies 10 bytes to TLS offset 0xd7a0. Registers atexit cleanup. |
| 0x00DD23C0 | 204 | tls_init_var_d7b0 | TLS variable initializer. Copies 10 bytes to TLS offset 0xd7b0. Registers atexit cleanup. |
| 0x00DD2490 | 190 | tls_init_var_d7c0 | TLS variable initializer. Copies 0x10 bytes to TLS offset 0xd7c0. Registers atexit cleanup. |
| 0x00DD2550 | 204 | tls_init_var_d7d8 | TLS variable initializer. Copies 0xc bytes to TLS offset 0xd7d8. Registers atexit cleanup. |
| 0x00DD2620 | 190 | tls_init_var_d7ec | TLS variable initializer. Copies 0x10 bytes to TLS offset 0xd7ec. Registers atexit cleanup. |
| 0x00DD26E0 | 204 | tls_init_var_d804 | TLS variable initializer. Copies 0xc bytes to TLS offset 0xd804. Registers atexit cleanup. |
| 0x00DD27B0 | 204 | tls_init_var_d818 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd818. Registers atexit cleanup. |
| 0x00DD2880 | 204 | tls_init_var_d830 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd830. Registers atexit cleanup. |
| 0x00DD2950 | 204 | tls_init_var_d848 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd848. Registers atexit cleanup. |
| 0x00DD2A20 | 204 | tls_init_var_d860 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd860. Registers atexit cleanup. |
| 0x00DD2AF0 | 204 | tls_init_var_d878 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd878. Registers atexit cleanup. |
| 0x00DD2BC0 | 206 | tls_init_var_d890 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd890. Registers atexit cleanup. |
| 0x00DD2C90 | 206 | tls_init_var_d8a4 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd8a4. Registers atexit cleanup. |
| 0x00DD2D60 | 204 | tls_init_var_d8b8 | TLS variable initializer. Copies 10 bytes to TLS offset 0xd8b8. Registers atexit cleanup. |
| 0x00DD2E30 | 204 | tls_init_var_d8c8 | TLS variable initializer. Copies 10 bytes to TLS offset 0xd8c8. Registers atexit cleanup. |
| 0x00DD2F00 | 204 | tls_init_var_d8d8 | TLS variable initializer. Copies 0x14 bytes to TLS offset 0xd8d8. Registers atexit cleanup. |
| 0x00DD2FD0 | 204 | tls_init_var_d8f4 | TLS variable initializer. Copies 0x14 bytes to TLS offset 0xd8f4. Registers atexit cleanup. |
| 0x00DD30A0 | 204 | tls_init_var_d910 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd910. Registers atexit cleanup. |
| 0x00DD3170 | 206 | tls_init_var_d928 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd928. Registers atexit cleanup. |
| 0x00DD3240 | 204 | tls_init_var_d93c | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd93c. Registers atexit cleanup. |
| 0x00DD3310 | 206 | tls_init_var_d954 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd954. Registers atexit cleanup. |
| 0x00DD33E0 | 204 | tls_init_var_d968 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd968. Registers atexit cleanup. |
| 0x00DD34B0 | 204 | tls_init_var_d980 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd980. Registers atexit cleanup. |
| 0x00DD3580 | 204 | tls_init_var_d998 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd998. Registers atexit cleanup. |
| 0x00DD3650 | 206 | tls_init_var_d9b0 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd9b0. Registers atexit cleanup. |
| 0x00DD3720 | 204 | tls_init_var_d9c4 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xd9c4. Registers atexit cleanup. |
| 0x00DD37F0 | 206 | tls_init_var_d9dc | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd9dc. Registers atexit cleanup. |
| 0x00DD38C0 | 206 | tls_init_var_d9f0 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xd9f0. Registers atexit cleanup. |
| 0x00DD3990 | 206 | tls_init_var_da04 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xda04. Registers atexit cleanup. |
| 0x00DD3A60 | 206 | tls_init_var_da18 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xda18. Registers atexit cleanup. |
| 0x00DD3B30 | 206 | tls_init_var_da2c | TLS variable initializer. Copies 0xe bytes to TLS offset 0xda2c. Registers atexit cleanup. |
| 0x00DD3C00 | 204 | tls_init_var_da40 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xda40. Registers atexit cleanup. |
| 0x00DD3CD0 | 220 | tls_init_var_da58 | TLS variable initializer. Copies 0x17 bytes to TLS offset 0xda58. Registers atexit cleanup. |
| 0x00DD3DB0 | 220 | tls_init_var_da74 | TLS variable initializer. Copies 0x19 bytes to TLS offset 0xda74. Registers atexit cleanup. |
| 0x00DD3E90 | 204 | tls_init_var_da94 | TLS variable initializer. Copies 0x16 bytes to TLS offset 0xda94. Registers atexit cleanup. |
| 0x00DD3F60 | 220 | tls_init_var_dab0 | TLS variable initializer. Copies 0x1d bytes to TLS offset 0xdab0. Registers atexit cleanup. |
| 0x00DD4040 | 204 | tls_init_var_dad4 | TLS variable initializer. Copies 0x12 bytes to TLS offset 0xdad4. Registers atexit cleanup. |
| 0x00DD4110 | 220 | tls_init_var_daec | TLS variable initializer. Copies 0x19 bytes to TLS offset 0xdaec. Registers atexit cleanup. |
| 0x00DD41F0 | 204 | tls_init_var_db0c | TLS variable initializer. Copies obfuscated data to TLS offset 0xdb0c. Registers atexit cleanup. |
| 0x00DD42C0 | 220 | tls_init_var_db24 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdb24. Registers atexit cleanup. |
| 0x00DD4530 | 204 | tls_init_var_db44 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdb44. Registers atexit cleanup. |
| 0x00DD4600 | 220 | tls_init_var_db60 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdb60. Registers atexit cleanup. |
| 0x00DD46E0 | 204 | tls_init_var_db84 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdb84. Registers atexit cleanup. |
| 0x00DD47B0 | 220 | tls_init_var_db98 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdb98. Registers atexit cleanup. |
| 0x00DD4890 | 190 | tls_init_var_dbb8 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdbb8. Registers atexit cleanup. |
| 0x00DD4950 | 220 | tls_init_var_dbd0 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdbd0. Registers atexit cleanup. |
| 0x00DD4A30 | 220 | tls_init_var_dbf4 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdbf4. Registers atexit cleanup. |
| 0x00DD4B10 | 220 | tls_init_var_dc1c | TLS variable initializer. Copies obfuscated data to TLS offset 0xdc1c. Registers atexit cleanup. |
| 0x00DD4BF0 | 221 | tls_init_var_dc40 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdc40. Registers atexit cleanup. |
| 0x00DD4CD0 | 222 | tls_init_var_dc70 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdc70. Registers atexit cleanup. |
| 0x00DD4DB0 | 220 | tls_init_var_dca4 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdca4. Registers atexit cleanup. |
| 0x00DD4E90 | 222 | tls_init_var_dcc8 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdcc8. Registers atexit cleanup. |
| 0x00DD4F70 | 236 | tls_init_var_dcfc | TLS variable initializer. Copies obfuscated data to TLS offset 0xdcfc. Registers atexit cleanup. |
| 0x00DD5060 | 220 | tls_init_var_dd30 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdd30. Registers atexit cleanup. |
| 0x00DD5140 | 205 | tls_init_var_dd50 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdd50. Registers atexit cleanup. |
| 0x00DD5210 | 220 | tls_init_var_dd78 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdd78. Registers atexit cleanup. |
| 0x00DD52F0 | 205 | tls_init_var_dd98 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdd98. Registers atexit cleanup. |
| 0x00DD53C0 | 204 | tls_init_var_ddc0 | TLS variable initializer. Copies obfuscated data to TLS offset 0xddc0. Registers atexit cleanup. |
| 0x00DD5490 | 220 | tls_init_var_dde0 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdde0. Registers atexit cleanup. |
| 0x00DD5570 | 221 | tls_init_var_de00 | TLS variable initializer. Copies obfuscated data to TLS offset 0xde00. Registers atexit cleanup. |
| 0x00DD5650 | 220 | tls_init_var_de24 | TLS variable initializer. Copies obfuscated data to TLS offset 0xde24. Registers atexit cleanup. |
| 0x00DD5730 | 205 | tls_init_var_de44 | TLS variable initializer. Copies obfuscated data to TLS offset 0xde44. Registers atexit cleanup. |
| 0x00DD5800 | 204 | tls_init_var_de6c | TLS variable initializer. Copies obfuscated data to TLS offset 0xde6c. Registers atexit cleanup. |
| 0x00DD58D0 | 220 | tls_init_var_de84 | TLS variable initializer. Copies obfuscated data to TLS offset 0xde84. Registers atexit cleanup. |
| 0x00DD59B0 | 204 | tls_init_var_dea4 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdea4. Registers atexit cleanup. |
| 0x00DD5A80 | 220 | tls_init_var_debc | TLS variable initializer. Copies obfuscated data to TLS offset 0xdebc. Registers atexit cleanup. |
| 0x00DD5B60 | 204 | tls_init_var_dedc | TLS variable initializer. Copies obfuscated data to TLS offset 0xdedc. Registers atexit cleanup. |
| 0x00DD5C30 | 221 | tls_init_var_defc | TLS variable initializer. Copies obfuscated data to TLS offset 0xdefc. Registers atexit cleanup. |
| 0x00DD5D10 | 220 | tls_init_var_df20 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdf20. Registers atexit cleanup. |
| 0x00DD5DF0 | 205 | tls_init_var_df40 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdf40. Registers atexit cleanup. |
| 0x00DD5EC0 | 220 | tls_init_var_df68 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdf68. Registers atexit cleanup. |
| 0x00DD5FA0 | 220 | tls_init_var_df8c | TLS variable initializer. Copies obfuscated data to TLS offset 0xdf8c. Registers atexit cleanup. |
| 0x00DD6080 | 204 | tls_init_var_dfb8 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdfb8. Registers atexit cleanup. |
| 0x00DD6150 | 204 | tls_init_var_dfcc | TLS variable initializer. Copies obfuscated data to TLS offset 0xdfcc. Registers atexit cleanup. |
| 0x00DD6220 | 206 | tls_init_var_dfe0 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdfe0. Registers atexit cleanup. |
| 0x00DD62F0 | 206 | tls_init_var_dff4 | TLS variable initializer. Copies obfuscated data to TLS offset 0xdff4. Registers atexit cleanup. |
| 0x00DD63C0 | 206 | tls_init_var_e008 | TLS variable initializer. Copies obfuscated data to TLS offset 0xe008. Registers atexit cleanup. |
| 0x00DD6490 | 204 | tls_init_var_e01c | TLS variable initializer. Copies 6 bytes to TLS offset 0xe01c. Registers atexit cleanup. |
| 0x00DD6560 | 204 | tls_init_var_e028 | TLS variable initializer. Copies 6 bytes to TLS offset 0xe028. Registers atexit cleanup. |
| 0x00DD6630 | 204 | tls_init_var_e034 | TLS variable initializer. Copies 7 bytes to TLS offset 0xe034. Registers atexit cleanup. |
| 0x00DD6700 | 204 | tls_init_var_e040 | TLS variable initializer. Copies 7 bytes to TLS offset 0xe040. Registers atexit cleanup. |
| 0x00DD67D0 | 204 | tls_init_var_e04c | TLS variable initializer. Copies 7 bytes to TLS offset 0xe04c. Registers atexit cleanup. |
| 0x00DD68A0 | 204 | tls_init_var_e058 | TLS variable initializer. Copies 9 bytes to TLS offset 0xe058. Registers atexit cleanup. |
| 0x00DD6970 | 204 | tls_init_var_e068 | TLS variable initializer. Copies 0xb bytes to TLS offset 0xe068. Registers atexit cleanup. |
| 0x00DD6A40 | 204 | tls_init_var_e078 | TLS variable initializer. Copies 0xd bytes to TLS offset 0xe078. Registers atexit cleanup. |
| 0x00DD6B10 | 206 | tls_init_var_e08c | TLS variable initializer. Copies 0xe bytes to TLS offset 0xe08c. Registers atexit cleanup. |
| 0x00DD6BE0 | 206 | tls_init_var_e0a0 | TLS variable initializer. Copies 0xe bytes to TLS offset 0xe0a0. Registers atexit cleanup. |
| 0x00DD9430 | 2143 | uint_to_obfuscated_string | Converts an unsigned integer to an obfuscated digit string. Maps digits 0-9 to characters '3','8','6','7','0','1','2','4','9','5' respectively. Inserts '-' separators every 3 digits (when the running length is 100 in the divisor). Used for price/quantity obfuscation in the client UI. |
| 0x00DDAD90 | 364 | nibble_xor_cipher | Nibble-level XOR cipher. Extracts 4-bit nibbles from param_2, shifts them by amounts derived from iteration count modulo 0x1C/0x18/0x14/0x10, XORs the combined result into param_1. Also rotates bytes of the intermediate result. Iterates (param_2%6)*2+1 times. Used for packet/value obfuscation. |
| 0x00DDAF00 | 1475 | decode_obfuscated_number_string | Decodes an obfuscated number string back to an integer. Builds an RB-tree mapping '0'->'3', '1'->'8', '2'->'6', '3'->'7', '4'->'0', '5'->'1', '6'->'2', '7'->'4', '8'->'9', '9'->'5' (inverse of uint_to_obfuscated_string). Also handles additional char mappings '6'->'2', '7'->'3', '8'->'1', '9'->'8'. Applies substitution to input string, strips last 4 chars, then calls atoi. |
| 0x00DDB660 | 381 | nibble_xor_decipher | Inverse of nibble_xor_cipher. Reverses the byte rotation first (left-shift by 8 then combine), then XORs with the same nibble-shifted param_2 combination. Iterates (param_2%6)*2+2 times (one more than the encoder). Used to decrypt values encoded by nibble_xor_cipher. |
| 0x00DE8740 | 551 | load_encrypted_table_file | Loads an encrypted table file. Uses TLS to store a 17-byte XOR key. On first call, copies key from static data and registers TLS destructor. Decrypts buffer with xor_decrypt_buffer, then loads via CSVParser. |
| 0x00E08C70 | 214 | xor_decrypt_packet_data | Copies 64 bytes of data from param_1+0x7B4 into global buffer at 0x0173A810, then XORs it with a key from PTR_DAT_01360EA0. Used for packet data decryption/decoding. |
| 0x00E28390 | 40 | xor_decrypt_10byte_b1919533 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0xb1919533, 0xd9115915. Clears the encrypted flag at offset+10 after decryption. Returns pointer to decrypted buffer. |
| 0x00E283C0 | 40 | xor_decrypt_10byte_c5a50b6b | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0xc5a50b6b, 0xbdaddd87. Clears the encrypted flag after decryption. |
| 0x00E283F0 | 40 | xor_decrypt_10byte_db2b77a1 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0xdb2b77a1, 0xfbad074b. Clears the encrypted flag after decryption. |
| 0x00E28420 | 40 | xor_decrypt_10byte_3d7377e3 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0x3d7377e3, 0xa55b7bef. Clears the encrypted flag after decryption. |
| 0x00E28450 | 40 | xor_decrypt_10byte_9bb99bd9 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0x9bb99bd9, 0x99157f15. Clears the encrypted flag after decryption. |
| 0x00E28480 | 40 | xor_decrypt_10byte_358d8705 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0x358d8705, 0x31e3cf9d. Clears the encrypted flag after decryption. |
| 0x00E284B0 | 40 | xor_decrypt_10byte_83630709 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0x83630709, 0x451fd727. Clears encrypted flag after decryption. |
| 0x00E284E0 | 40 | xor_decrypt_10byte_c75b25b9 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0xc75b25b9, 0x50df16f. Clears encrypted flag after decryption. |
| 0x00E28510 | 40 | xor_decrypt_10byte_0bdfe997 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0x0bdfe997, 0x6ba55713. Clears encrypted flag after decryption. |
| 0x00E28540 | 40 | xor_decrypt_10byte_fdffa51b | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0xfdffa51b, 0x73c32959. Clears encrypted flag after decryption. |
| 0x00E28570 | 40 | xor_decrypt_10byte_f5c1c59f | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0xf5c1c59f, 0x0789ebc9. Clears encrypted flag after decryption. |
| 0x00E285A0 | 40 | xor_decrypt_10byte_2173cf49 | Decrypts a 10-byte encrypted buffer using xor_decrypt_buffer with keys 0x2173cf49, 0x79a58b0f. Clears encrypted flag after decryption. |
| 0x00E285D0 | 40 | xor_decrypt_16byte_89f161d1 | Decrypts a 16-byte encrypted buffer using xor_decrypt_buffer with keys 0x89f161d1, 0xd3e5516f. Clears encrypted flag after decryption. |
| 0x00E28600 | 40 | xor_decrypt_16byte_f93f9bdf | Decrypts a 16-byte encrypted buffer using xor_decrypt_buffer with keys 0xf93f9bdf, 0xa7471985. Clears encrypted flag after decryption. |
| 0x00E28630 | 40 | xor_decrypt_16byte_a58f9b6b | Decrypts a 16-byte encrypted buffer using xor_decrypt_buffer with keys 0xa58f9b6b, 0x91e7a7df. Clears encrypted flag after decryption. |
| 0x00E28660 | 40 | xor_decrypt_16byte_67ad47df | Decrypts a 16-byte encrypted buffer using xor_decrypt_buffer with keys 0x67ad47df, 0x2d33791f. Clears encrypted flag after decryption. |
| 0x00E28690 | 40 | xor_decrypt_16byte_cbb5f157 | Decrypts a 16-byte encrypted buffer using xor_decrypt_buffer with keys 0xcbb5f157, 0x45e3f103. Clears encrypted flag after decryption. |
| 0x00E286C0 | 40 | xor_decrypt_18byte_4d353b81 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x4d353b81, 0xe51b2933. Clears encrypted flag after decryption. |
| 0x00E286F0 | 40 | xor_decrypt_18byte_a17d3963 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0xa17d3963, 0xc39fb559. Clears encrypted flag after decryption. |
| 0x00E28720 | 40 | xor_decrypt_18byte_45c1f105 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x45c1f105, 0xb3f1a107. Clears encrypted flag after decryption. |
| 0x00E28750 | 40 | xor_decrypt_18byte_354375c3 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x354375c3, 0xabed6971. Clears encrypted flag after decryption. |
| 0x00E28780 | 40 | xor_decrypt_18byte_3b014d45 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x3b014d45, 0x91df1f5d. Clears encrypted flag after decryption. |
| 0x00E287B0 | 40 | xor_decrypt_18byte_5bdddf89 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x5bdddf89, 0x8b3fa35b. Clears encrypted flag after decryption. |
| 0x00E287E0 | 40 | xor_decrypt_18byte_83695b0d | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x83695b0d, 0x899d11bb. Clears encrypted flag after decryption. |
| 0x00E28810 | 40 | xor_decrypt_18byte_bde7c5bd | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0xbde7c5bd, 0xf5496753. Clears encrypted flag after decryption. |
| 0x00E28840 | 40 | xor_decrypt_18byte_819ffbd7 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x819ffbd7, 0x1c9fba7. Clears encrypted flag after decryption. |
| 0x00E28870 | 40 | xor_decrypt_18byte_addd53cf | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0xaddd53cf, 0x2f371ddd. Clears encrypted flag after decryption. |
| 0x00E288A0 | 40 | xor_decrypt_18byte_3dd1c965 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x3dd1c965, 0x35f59f6f. Clears encrypted flag after decryption. |
| 0x00E288D0 | 40 | xor_decrypt_18byte_97a37dcf | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x97a37dcf, 0x3d8387ef. Clears encrypted flag after decryption. |
| 0x00E28900 | 40 | xor_decrypt_18byte_eb471557 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0xeb471557, 0x47b7bf55. Clears encrypted flag after decryption. |
| 0x00E28930 | 40 | xor_decrypt_18byte_39150b9b | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x39150b9b, 0x6b3917c9. Clears encrypted flag after decryption. |
| 0x00E28960 | 40 | xor_decrypt_18byte_1b5d65c3 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x1b5d65c3, 0x6d05d527. Clears encrypted flag after decryption. |
| 0x00E28990 | 40 | xor_decrypt_18byte_779d19db | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x779d19db, 0x795787b7. Clears encrypted flag after decryption. |
| 0x00E289C0 | 40 | xor_decrypt_18byte_652d07bf | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x652d07bf, 0x7959ffbf. Clears encrypted flag after decryption. |
| 0x00E289F0 | 40 | xor_decrypt_18byte_3fb7f925 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x3fb7f925, 0x7fe563bd. Clears encrypted flag after decryption. |
| 0x00E28A20 | 40 | xor_decrypt_18byte_9f21eb79 | Decrypts an 18-byte encrypted buffer using xor_decrypt_buffer with keys 0x9f21eb79, 0x0df5b33d. Clears encrypted flag after decryption. |
| 0x00E28A50 | 40 | xor_decrypt_20byte_e9cd2b81 | Decrypts a 20-byte encrypted buffer using xor_decrypt_buffer with keys 0xe9cd2b81, 0xa15b555b. Clears encrypted flag after decryption. |
| 0x00E28A80 | 40 | xor_decrypt_20byte_2383718b | Decrypts a 20-byte encrypted buffer using xor_decrypt_buffer with keys 0x2383718b, 0x2f210379. Clears encrypted flag after decryption. |
| 0x00E28AB0 | 40 | xor_decrypt_20byte_e56d3d89 | Decrypts a 20-byte encrypted buffer using xor_decrypt_buffer with keys 0xe56d3d89, 0x2f2701a7. Clears encrypted flag after decryption. |
| 0x00E28AE0 | 40 | xor_decrypt_20byte_27a7c7f7 | Decrypts a 20-byte encrypted buffer using xor_decrypt_buffer with keys 0x27a7c7f7, 0x3b6d9bfd. Clears encrypted flag after decryption. |
| 0x00E28B10 | 40 | xor_decrypt_22byte_afe911f1 | Decrypts a 22-byte encrypted buffer using xor_decrypt_buffer with keys 0xafe911f1, 0xd97dc927. Clears encrypted flag after decryption. |
| 0x00E28B40 | 40 | xor_decrypt_22byte_41076fad | Decrypts a 22-byte encrypted buffer using xor_decrypt_buffer with keys 0x41076fad, 0xbf0f4129. Clears encrypted flag after decryption. |
| 0x00E28B70 | 40 | xor_decrypt_22byte_eb2397b1 | Decrypts a 22-byte encrypted buffer using xor_decrypt_buffer with keys 0xeb2397b1, 0x5d6b3b1d. Clears encrypted flag after decryption. |
| 0x00E28BA0 | 40 | xor_decrypt_22byte_a39f4fab | Decrypts a 22-byte encrypted buffer using xor_decrypt_buffer with keys 0xa39f4fab, 0x07112f85. Clears encrypted flag after decryption. |
| 0x00E28BD0 | 40 | xor_decrypt_22byte_79034de7 | Decrypts a 22-byte encrypted buffer using xor_decrypt_buffer with keys 0x79034de7, 0x7db10507. Clears encrypted flag after decryption. |
| 0x00E28C00 | 40 | xor_decrypt_23byte_7961eff5 | Decrypts a 23-byte encrypted buffer using xor_decrypt_buffer with keys 0x7961eff5, 0xf9b1ef9f. Clears encrypted flag after decryption. |
| 0x00E28C30 | 40 | xor_decrypt_23byte_e95325f5 | Decrypts a 23-byte encrypted buffer using xor_decrypt_buffer with keys 0xe95325f5, 0x2b8725d7. Clears encrypted flag after decryption. |
| 0x00E28C60 | 40 | xor_decrypt_23byte_37c5a1af | Decrypts a 23-byte encrypted buffer using xor_decrypt_buffer with keys 0x37c5a1af, 0x71b76917. Clears encrypted flag after decryption. |
| 0x00E28C90 | 40 | xor_decrypt_24byte_8f216f31 | Decrypts a 24-byte encrypted buffer using xor_decrypt_buffer with keys 0x8f216f31, 0x3bbb5f0f. Clears encrypted flag after decryption. |
| 0x00E28CC0 | 40 | xor_decrypt_24byte_37db892b | Decrypts a 24-byte encrypted buffer using xor_decrypt_buffer with keys 0x37db892b, 0x4b1d0789. Clears encrypted flag after decryption. |
| 0x00E28CF0 | 40 | xor_decrypt_24byte_41e76519 | Decrypts a 24-byte encrypted buffer using xor_decrypt_buffer with keys 0x41e76519, 0x61f59d5d. Clears encrypted flag after decryption. |
| 0x00E28D20 | 40 | xor_decrypt_25byte_0dd531ad | Decrypts a 25-byte encrypted buffer using xor_decrypt_buffer with keys 0x0dd531ad, 0x8ba52b97. Clears encrypted flag after decryption. |
| 0x00E28D50 | 40 | xor_decrypt_25byte_0375530d | Decrypts a 25-byte encrypted buffer using xor_decrypt_buffer with keys 0x0375530d, 0x2529f16b. Clears encrypted flag after decryption. |
| 0x00E28D80 | 40 | xor_decrypt_25byte_651bdfd5 | Decrypts a 25-byte encrypted buffer using xor_decrypt_buffer with keys 0x651bdfd5, 0x29ab0b59. Clears encrypted flag after decryption. |
| 0x00E28DB0 | 40 | xor_decrypt_25byte_d32361a9 | Decrypts a 25-byte encrypted buffer using xor_decrypt_buffer with keys 0xd32361a9, 0x0d7fa94d. Clears encrypted flag after decryption. |
| 0x00E28DE0 | 40 | xor_decrypt_26byte_539785c7 | Decrypts a 26-byte encrypted buffer using xor_decrypt_buffer with keys 0x539785c7, 0xed730315. Clears encrypted flag after decryption. |
| 0x00E28E10 | 40 | xor_decrypt_26byte_63b94747 | Decrypts a 26-byte encrypted buffer using xor_decrypt_buffer with keys 0x63b94747, 0xd51953e7. Clears encrypted flag after decryption. |
| 0x00E28E40 | 40 | xor_decrypt_26byte_555bb16d | Decrypts a 26-byte encrypted buffer using xor_decrypt_buffer with keys 0x555bb16d, 0xa1dfcdad. Clears encrypted flag after decryption. |
| 0x00E28E70 | 40 | xor_decrypt_26byte_67d9fde1 | Decrypts a 26-byte encrypted buffer using xor_decrypt_buffer with keys 0x67d9fde1, 0x8dff0b4b. Clears encrypted flag after decryption. |
| 0x00E28EA0 | 40 | xor_decrypt_26byte_af753fad | Decrypts a 26-byte encrypted buffer using xor_decrypt_buffer with keys 0xaf753fad, 0x194f8339. Clears encrypted flag after decryption. |
| 0x00E28ED0 | 40 | xor_decrypt_27byte_ef4bd9e7 | Decrypts a 27-byte encrypted buffer using xor_decrypt_buffer with keys 0xef4bd9e7, 0xcfb9671d. Clears encrypted flag after decryption. |
| 0x00E28F00 | 40 | xor_decrypt_28byte_d5a1bb17 | Decrypts a 28-byte encrypted buffer using xor_decrypt_buffer with keys 0xd5a1bb17, 0xe9fbab53. Clears encrypted flag after decryption. |
| 0x00E28F30 | 40 | xor_decrypt_29byte_db295d11 | Decrypts a 29-byte encrypted buffer using xor_decrypt_buffer with keys 0xdb295d11, 0xd7bbeb2d. Clears encrypted flag after decryption. |
| 0x00E28F60 | 40 | xor_decrypt_30byte_b9457b53 | Decrypts a 30-byte encrypted buffer using xor_decrypt_buffer with keys 0xb9457b53, 0xa5c5d1a3. Clears encrypted flag after decryption. |
| 0x00E28F90 | 40 | xor_decrypt_30byte_55252f8f | Decrypts a 30-byte encrypted buffer using xor_decrypt_buffer with keys 0x55252f8f, 0x39e7f137. Clears encrypted flag after decryption. |
| 0x00E28FC0 | 40 | xor_decrypt_30byte_3d6f19b9 | Decrypts a 30-byte encrypted buffer using xor_decrypt_buffer with keys 0x3d6f19b9, 0x77d92507. Clears encrypted flag after decryption. |
| 0x00E28FF0 | 40 | xor_decrypt_31byte_cf678ff3 | Decrypts a 31-byte encrypted buffer using xor_decrypt_buffer with keys 0xcf678ff3, 0x2f3d75df. Clears encrypted flag after decryption. |
| 0x00E29020 | 40 | xor_decrypt_31byte_0dfb0d03 | Decrypts a 31-byte encrypted buffer using xor_decrypt_buffer with keys 0x0dfb0d03, 0x7155e5ef. Clears encrypted flag after decryption. |
| 0x00E29050 | 40 | xor_decrypt_32byte_6feb27e5 | Decrypts a 32-byte encrypted buffer using xor_decrypt_buffer with keys 0x6feb27e5, 0x4349ade9. Clears encrypted flag after decryption. |
| 0x00E29080 | 40 | xor_decrypt_33byte_ff3be93f | Decrypts a 33-byte encrypted buffer using xor_decrypt_buffer with keys 0xff3be93f, 0x17fb0f6b. Clears encrypted flag after decryption. |
| 0x00E290B0 | 40 | xor_decrypt_33byte_4ba14b23 | Decrypts a 33-byte encrypted buffer using xor_decrypt_buffer with keys 0x4ba14b23, 0x51372b6f. Clears encrypted flag after decryption. |
| 0x00E290E0 | 40 | xor_decrypt_33byte_6d71c1ff | Decrypts a 33-byte encrypted buffer using xor_decrypt_buffer with keys 0x6d71c1ff, 0x6f9d21b9. Clears encrypted flag after decryption. |
| 0x00E29110 | 40 | xor_decrypt_33byte_f96de3e7 | Decrypts a 33-byte encrypted buffer using xor_decrypt_buffer with keys 0xf96de3e7, 0x7dc10333. Clears encrypted flag after decryption. |
| 0x00E29140 | 40 | xor_decrypt_35byte_d397533f | Decrypts a 35-byte encrypted buffer using xor_decrypt_buffer with keys 0xd397533f, 0xaff9332f. Clears encrypted flag after decryption. |
| 0x00E29170 | 40 | xor_decrypt_37byte_df87f549 | Decrypts a 37-byte encrypted buffer using xor_decrypt_buffer with keys 0xdf87f549, 0xcbd7ddaf. Clears encrypted flag after decryption. |
| 0x00E291A0 | 40 | xor_decrypt_39byte_852d2f6b | Decrypts a 39-byte encrypted buffer using xor_decrypt_buffer with keys 0x852d2f6b, 0x999f5191. Clears encrypted flag after decryption. |
| 0x00E291D0 | 40 | xor_decrypt_42byte_518fd389 | Decrypts a 42-byte encrypted buffer using xor_decrypt_buffer with keys 0x518fd389, 0x1f79132b. Clears encrypted flag after decryption. |
| 0x00E29200 | 40 | xor_decrypt_44byte_a78d39cd | Decrypts a 44-byte encrypted buffer using xor_decrypt_buffer with keys 0xa78d39cd, 0xb70319d3. Clears encrypted flag after decryption. |
| 0x00E29230 | 40 | xor_decrypt_44byte_0f79ddd7 | Decrypts a 44-byte encrypted buffer using xor_decrypt_buffer with keys 0x0f79ddd7, 0x8f61434f. Clears encrypted flag after decryption. |
| 0x00E29260 | 40 | xor_decrypt_46byte_d543c1c3 | Decrypts a 46-byte encrypted buffer using xor_decrypt_buffer with keys 0xd543c1c3, 0x4b670715. Clears encrypted flag after decryption. |
| 0x00E29290 | 40 | xor_decrypt_12byte_bda3bfd5 | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0xbda3bfd5, 0xeb074b7f. Clears encrypted flag after decryption. |
| 0x00E292C0 | 40 | xor_decrypt_12byte_b365617d | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0xb365617d, 0xb59badc5. Clears encrypted flag after decryption. |
| 0x00E292F0 | 40 | xor_decrypt_12byte_fdfd87f5 | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0xfdfd87f5, 0x936f3d2f. Clears encrypted flag after decryption. |
| 0x00E29320 | 40 | xor_decrypt_12byte_137f138d | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0x137f138d, 0xf535e561. Clears encrypted flag after decryption. |
| 0x00E29350 | 40 | xor_decrypt_12byte_256f9b6f | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0x256f9b6f, 0x3d075bd5. Clears encrypted flag after decryption. |
| 0x00E29380 | 40 | xor_decrypt_12byte_b5d1ef57 | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0xb5d1ef57, 0x5ffd7fab. Clears encrypted flag after decryption. |
| 0x00E293B0 | 40 | xor_decrypt_12byte_a3079125 | Decrypts a 12-byte encrypted buffer using xor_decrypt_buffer with keys 0xa3079125, 0x6b3301e1. Clears encrypted flag after decryption. |
| 0x00E293E0 | 40 | xor_decrypt_14byte_8577d34b | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0x8577d34b, 0xc7fb6df1. Clears encrypted flag after decryption. |
| 0x00E29410 | 40 | xor_decrypt_14byte_59b551fd | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0x59b551fd, 0xbd3f4301. Clears encrypted flag after decryption. |
| 0x00E29440 | 40 | xor_decrypt_14byte_9d235ddf | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0x9d235ddf, 0x1e7898d. Clears encrypted flag after decryption. |
| 0x00E29470 | 40 | xor_decrypt_14byte_370ba5c3 | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0x370ba5c3, 0x251761d7. Clears encrypted flag after decryption. |
| 0x00E294A0 | 40 | xor_decrypt_14byte_5b39b301 | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0x5b39b301, 0x2b477f9b. Clears encrypted flag after decryption. |
| 0x00E294D0 | 40 | xor_decrypt_14byte_6999a303 | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0x6999a303, 0x6961ff05. Clears encrypted flag after decryption. |
| 0x00E29500 | 40 | xor_decrypt_14byte_b5993503 | Decrypts a 14-byte encrypted buffer using xor_decrypt_buffer with keys 0xb5993503, 0x6bc977b3. Clears encrypted flag after decryption. |
| 0x00E29530 | 206 | tls_init_encrypted_string_fdd4 | Thread-local encrypted string initializer. On first call per thread, stores 14-byte encrypted data at TLS offset 0xfdd4, sets encrypted flag at +0xe, and registers atexit cleanup. Returns pointer to TLS string buffer. Uses once-flag at TLS+0xfde4. |
| 0x00E29600 | 206 | tls_init_encrypted_string_fde8 | Thread-local encrypted string initializer. On first call per thread, stores 14-byte encrypted data at TLS offset 0xfde8 (65000), sets encrypted flag, and registers atexit cleanup. Returns pointer to TLS string buffer. Uses once-flag at TLS+0xfdf8. |
| 0x00E296D0 | 204 | tls_init_encrypted_string_fdfc | Thread-local encrypted string initializer. On first call per thread, stores 18-byte encrypted data at TLS offset 0xfdfc, sets encrypted flag, and registers atexit cleanup. Returns pointer to TLS string buffer. Uses once-flag at TLS+0xfe10. |
| 0x00E297A0 | 206 | tls_init_encrypted_string_fe14 | Thread-local encrypted string initializer. On first call per thread, stores 14-byte encrypted data at TLS offset 0xfe14, sets encrypted flag, and registers atexit cleanup. Returns pointer to TLS string buffer. Uses once-flag at TLS+0xfe24. |
| 0x00E29870 | 206 | tls_init_encrypted_string_fe28 | Thread-local encrypted string initializer. Stores 14-byte encrypted data at TLS offset 0xfe28 on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfe38. |
| 0x00E29940 | 206 | tls_init_encrypted_string_fe3c | Thread-local encrypted string initializer. Stores 14-byte encrypted data at TLS offset 0xfe3c on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfe4c. |
| 0x00E29A10 | 206 | tls_init_encrypted_string_fe50 | Thread-local encrypted string initializer. Stores 14-byte encrypted data at TLS offset 0xfe50 on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfe60. |
| 0x00E29AE0 | 206 | tls_init_encrypted_string_fe64 | Thread-local encrypted string initializer. Stores 14-byte encrypted data at TLS offset 0xfe64 on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfe74. |
| 0x00E29BB0 | 206 | tls_init_encrypted_string_fe78 | Thread-local encrypted string initializer. Stores 14-byte encrypted data at TLS offset 0xfe78 on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfe88. |
| 0x00E29C80 | 204 | tls_init_encrypted_string_fe8c | Thread-local encrypted string initializer. Stores 10-byte encrypted data at TLS offset 0xfe8c on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfe98. |
| 0x00E29D50 | 204 | tls_init_encrypted_string_fe9c | Thread-local encrypted string initializer. Stores 10-byte encrypted data at TLS offset 0xfe9c on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfea8. |
| 0x00E29E20 | 204 | tls_init_encrypted_string_feac | Thread-local encrypted string initializer. Stores 10-byte encrypted data at TLS offset 0xfeac on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfeb8. |
| 0x00E29EF0 | 204 | tls_init_encrypted_string_febc | Thread-local encrypted string initializer. Stores 18-byte encrypted data at TLS offset 0xfebc on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfed0. |
| 0x00E29FC0 | 204 | tls_init_encrypted_string_fed4 | Thread-local encrypted string initializer. Stores 18-byte encrypted data at TLS offset 0xfed4 on first call per thread. Registers atexit cleanup. Once-flag at TLS+0xfee8. |
| 0x00E2A090 | 204 | tls_init_encrypted_string_feec | Thread-local encrypted string initializer. Stores 18-byte encrypted data at TLS offset 0xfeec. Registers atexit cleanup. Once-flag at TLS+0xff00. |
| 0x00E2A160 | 204 | tls_init_encrypted_string_ff04 | Thread-local encrypted string initializer. Stores 18-byte encrypted data at TLS offset 0xff04. Registers atexit cleanup. Once-flag at TLS+0xff18. |
| 0x00E2A230 | 204 | tls_init_encrypted_string_ff1c | Thread-local encrypted string initializer. Stores 22-byte encrypted data at TLS offset 0xff1c. Registers atexit cleanup. Once-flag at TLS+0xff34. |
| 0x00E2A300 | 204 | tls_init_encrypted_string_ff38 | Thread-local encrypted string initializer. Stores 22-byte encrypted data at TLS offset 0xff38. Registers atexit cleanup. Once-flag at TLS+0xff50. |
| 0x00E2A3D0 | 204 | tls_init_encrypted_string_ff54 | Thread-local encrypted string initializer. Stores 22-byte encrypted data at TLS offset 0xff54. Registers atexit cleanup. Once-flag at TLS+0xff6c. |
| 0x00E2A4A0 | 190 | tls_init_encrypted_string_ff70 | Thread-local encrypted string initializer. Stores 16-byte encrypted data at TLS offset 0xff70. Registers atexit cleanup. Once-flag at TLS+0xff84. |
| 0x00E2A560 | 204 | tls_init_encrypted_string_ff88 | Thread-local encrypted string initializer. Stores 12-byte encrypted data at TLS offset 0xff88. Registers atexit cleanup. Once-flag at TLS+0xff98. |
| 0x00E2A630 | 190 | tls_init_encrypted_string_ff9c | Thread-local encrypted string initializer. Stores 16-byte encrypted data at TLS offset 0xff9c. Registers atexit cleanup. Once-flag at TLS+0xffb0. |
| 0x00E2A6F0 | 204 | tls_init_encrypted_string_ffb4 | Thread-local encrypted string initializer. Stores 12-byte encrypted data at TLS offset 0xffb4. Registers atexit cleanup. Once-flag at TLS+0xffc4. |
| 0x00E2A7C0 | 204 | tls_init_encrypted_string_ffc8 | Thread-local encrypted string initializer. Stores 20-byte encrypted data at TLS offset 0xffc8. Registers atexit cleanup. Once-flag at TLS+0xffe0. |
| 0x00E2A890 | 204 | tls_init_encrypted_string_ffe4 | Thread-local encrypted string initializer. Stores 18-byte encrypted data at TLS offset 0xffe4. Registers atexit cleanup. Once-flag at TLS+0xfff8. |
| 0x00E2A960 | 220 | tls_init_encrypted_string_fffc | Thread-local encrypted string initializer. Stores 23-byte encrypted data at TLS offset 0xfffc. Registers atexit cleanup. Once-flag at TLS+0x10014. |
| 0x00E2AA40 | 204 | tls_init_encrypted_string_10018 | Thread-local encrypted string initializer. Stores 18-byte encrypted data at TLS offset 0x10018. Registers atexit cleanup. Once-flag at TLS+0x1002c. |
| 0x00E2AB10 | 220 | tls_init_encrypted_string_10030 | Thread-local encrypted string initializer. Stores 23-byte encrypted data at TLS offset 0x10030. Registers atexit cleanup. Once-flag at TLS+0x10048. |
| 0x00E2ABF0 | 204 | tls_init_encrypted_string_1004c | Thread-local encrypted string initializer. Stores 10-byte encrypted data at TLS offset 0x1004c. Registers atexit cleanup. Once-flag at TLS+0x10058. |
| 0x00E2ACC0 | 204 | tls_init_encrypted_string_1005c | Thread-local encrypted string initializer. Stores 10-byte encrypted data at TLS offset 0x1005c. Registers atexit cleanup. Once-flag at TLS+0x10068. |
| 0x00E2AD90 | 190 | tls_init_encrypted_string_1006c | Thread-local encrypted string initializer. Stores 16-byte encrypted data at TLS offset 0x1006c. Registers atexit cleanup. Once-flag at TLS+0x10080. |
| 0x00E2AE50 | 204 | tls_init_encrypted_string_10084 | Thread-local encrypted string initializer. Stores 12-byte encrypted data at TLS offset 0x10084. Registers atexit cleanup. Once-flag at TLS+0x10094. |
| 0x00E2AF20 | 190 | tls_init_encrypted_string_10098 | Thread-local encrypted string initializer. Stores 16-byte encrypted data at TLS offset 0x10098. Registers atexit cleanup. Once-flag at TLS+0x100ac. |
| 0x00E2AFE0 | 204 | tls_init_encrypted_string_100b0 | Thread-local encrypted string initializer. Stores 12-byte encrypted data at TLS offset 0x100b0. Registers atexit cleanup. Once-flag at TLS+0x100c0. |
| 0x00E2B0B0 | 204 | tls_init_encrypted_string_100c4 | Thread-local encrypted string initializer at TLS offset 0x100c4. Stores 18 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B180 | 204 | tls_init_encrypted_string_100dc | Thread-local encrypted string initializer at TLS offset 0x100dc. Stores 18 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B250 | 204 | tls_init_encrypted_string_100f4 | Thread-local encrypted string initializer at TLS offset 0x100f4. Stores 10 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B320 | 204 | tls_init_encrypted_string_10104 | Thread-local encrypted string initializer at TLS offset 0x10104. Stores 10 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B3F0 | 204 | tls_init_encrypted_string_10114 | Thread-local encrypted string initializer at TLS offset 0x10114. Stores 10 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B4C0 | 204 | tls_init_encrypted_string_10124 | Thread-local encrypted string initializer at TLS offset 0x10124. Stores 18 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B590 | 204 | tls_init_encrypted_string_1013c | Thread-local encrypted string initializer at TLS offset 0x1013c. Stores 18 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B660 | 204 | tls_init_encrypted_string_10154 | Thread-local encrypted string initializer at TLS offset 0x10154. Stores 10 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B730 | 204 | tls_init_encrypted_string_10164 | Thread-local encrypted string initializer at TLS offset 0x10164. Stores 10 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B800 | 204 | tls_init_encrypted_string_10174 | Thread-local encrypted string initializer at TLS offset 0x10174. Stores 20 bytes of encrypted data. Registers atexit cleanup. |
| 0x00E2B8D0 | 204 | tls_init_encrypted_string_10190 | Thread-local encrypted string initializer at TLS offset 0x10190. Registers atexit cleanup. |
| 0x00E2B9A0 | 204 | tls_init_encrypted_string_101ac | Thread-local encrypted string initializer at TLS offset 0x101ac. Registers atexit cleanup. |
| 0x00E2BA70 | 204 | tls_init_encrypted_string_101bc | Thread-local encrypted string initializer at TLS offset 0x101bc. Registers atexit cleanup. |
| 0x00E2BB40 | 204 | tls_init_encrypted_string_101d4 | Thread-local encrypted string initializer at TLS offset 0x101d4. Registers atexit cleanup. |
| 0x00E2BC10 | 204 | tls_init_encrypted_string_101e4 | Thread-local encrypted string initializer at TLS offset 0x101e4. Registers atexit cleanup. |
| 0x00E2BCE0 | 204 | tls_init_encrypted_string_101fc | Thread-local encrypted string initializer at TLS offset 0x101fc. Registers atexit cleanup. |
| 0x00E2BDB0 | 204 | tls_init_encrypted_string_1020c | Thread-local encrypted string initializer at TLS offset 0x1020c. Registers atexit cleanup. |
| 0x00E2BE80 | 204 | tls_init_encrypted_string_1021c | Thread-local encrypted string initializer at TLS offset 0x1021c. Registers atexit cleanup. |
| 0x00E2BF50 | 204 | tls_init_encrypted_string_1022c | Thread-local encrypted string initializer at TLS offset 0x1022c. Registers atexit cleanup. |
| 0x00E2C020 | 204 | tls_init_encrypted_string_10244 | Thread-local encrypted string initializer at TLS offset 0x10244. Registers atexit cleanup. |
| 0x00E2C0F0 | 204 | tls_init_encrypted_string_10254 | Thread-local encrypted string initializer at TLS offset 0x10254. Registers atexit cleanup. |
| 0x00E2C1C0 | 204 | tls_init_encrypted_string_1026c | Thread-local encrypted string initializer at TLS offset 0x1026c. Registers atexit cleanup. |
| 0x00E2C290 | 220 | tls_init_encrypted_string_10284 | Thread-local encrypted string initializer at TLS offset 0x10284. Registers atexit cleanup. |
| 0x00E2C370 | 220 | tls_init_encrypted_string_102a0 | Thread-local encrypted string initializer at TLS offset 0x102a0. Registers atexit cleanup. |
| 0x00E2C450 | 204 | tls_init_encrypted_string_102c0 | Thread-local encrypted string initializer at TLS offset 0x102c0. Registers atexit cleanup. |
| 0x00E2C520 | 220 | tls_init_encrypted_string_102dc | Thread-local encrypted string initializer at TLS offset 0x102dc. Registers atexit cleanup. |
| 0x00E2C600 | 204 | tls_init_encrypted_string_10300 | Thread-local encrypted string initializer at TLS offset 0x10300. Registers atexit cleanup. |
| 0x00E2C6D0 | 220 | tls_init_encrypted_string_10318 | Thread-local encrypted string initializer at TLS offset 0x10318. Registers atexit cleanup. |
| 0x00E2C7B0 | 204 | tls_init_encrypted_string_10338 | Thread-local encrypted string initializer at TLS offset 0x10338. Registers atexit cleanup. |
| 0x00E2C880 | 220 | tls_init_encrypted_string_10354 | Thread-local encrypted string initializer at TLS offset 0x10354. Registers atexit cleanup. |
| 0x00E2C960 | 204 | tls_init_encrypted_string_10374 | Thread-local encrypted string initializer at TLS offset 0x10374. Registers atexit cleanup. |
| 0x00E2CA30 | 220 | tls_init_encrypted_string_1039c | Thread-local encrypted string initializer at TLS offset 0x1039c. Registers atexit cleanup. |
| 0x00E2CB10 | 204 | tls_init_encrypted_string_103c8 | Thread-local encrypted string initializer at TLS offset 0x103c8. Registers atexit cleanup. |
| 0x00E2CBE0 | 220 | tls_init_encrypted_string_103e0 | Thread-local encrypted string initializer at TLS offset 0x103e0. Registers atexit cleanup. |
| 0x00E2CCC0 | 204 | tls_init_encrypted_string_10400 | Thread-local encrypted string initializer at TLS offset 0x10400. Registers atexit cleanup. |
| 0x00E2CD90 | 220 | tls_init_encrypted_string_1041c | Thread-local encrypted string initializer at TLS offset 0x1041c. Registers atexit cleanup. |
| 0x00E2CE70 | 204 | tls_init_encrypted_string_10440 | Thread-local encrypted string initializer at TLS offset 0x10440. Registers atexit cleanup. |
| 0x00E2CF40 | 220 | tls_init_encrypted_string_10454 | Thread-local encrypted string initializer at TLS offset 0x10454. Registers atexit cleanup. |
| 0x00E2D020 | 190 | tls_init_encrypted_string_10474 | Thread-local encrypted string initializer at TLS offset 0x10474. Registers atexit cleanup. |
| 0x00E2D0E0 | 220 | tls_init_encrypted_string_1048c | Thread-local encrypted string initializer at TLS offset 0x1048c. Registers atexit cleanup. |
| 0x00E2D1C0 | 220 | tls_init_encrypted_string_104b0 | Thread-local encrypted string initializer at TLS offset 0x104b0. Registers atexit cleanup. |
| 0x00E2D2A0 | 220 | tls_init_encrypted_string_104d8 | Thread-local encrypted string initializer at TLS offset 0x104d8. Registers atexit cleanup. |
| 0x00E2D380 | 205 | tls_init_encrypted_string_104f8 | Thread-local encrypted string initializer at TLS offset 0x104f8. Registers atexit cleanup. |
| 0x00E2D450 | 220 | tls_init_encrypted_string_10520 | Thread-local encrypted string initializer at TLS offset 0x10520. Registers atexit cleanup. |
| 0x00E2D530 | 205 | tls_init_encrypted_string_10540 | Thread-local encrypted string initializer at TLS offset 0x10540. Registers atexit cleanup. |
| 0x00E2D600 | 220 | tls_init_encrypted_string_10568 | Thread-local encrypted string initializer at TLS offset 0x10568. Registers atexit cleanup. |
| 0x00E2D6E0 | 221 | tls_init_encrypted_string_1058c | Thread-local encrypted string initializer at TLS offset 0x1058c. Registers atexit cleanup. |
| 0x00E2D7C0 | 222 | tls_init_encrypted_string_105bc | Thread-local encrypted string initializer at TLS offset 0x105bc. Registers atexit cleanup. |
| 0x00E2D8A0 | 220 | tls_init_encrypted_string_105f0 | Thread-local encrypted string initializer at TLS offset 0x105f0. Registers atexit cleanup. |
| 0x00E2D980 | 222 | tls_init_encrypted_string_10614 | Thread-local encrypted string initializer at TLS offset 0x10614. Registers atexit cleanup. |
| 0x00E2DA60 | 236 | tls_init_encrypted_string_10648 | Thread-local encrypted string initializer at TLS offset 0x10648. Registers atexit cleanup. |
| 0x00E2DB50 | 204 | tls_init_encrypted_string_1067c | Thread-local encrypted string initializer at TLS offset 0x1067c. Registers atexit cleanup. |
| 0x00E2DC20 | 204 | tls_init_encrypted_string_1069c | Thread-local encrypted string initializer at TLS offset 0x1069c. Registers atexit cleanup. |
| 0x00E2DCF0 | 221 | tls_init_encrypted_string_106bc | Thread-local encrypted string initializer at TLS offset 0x106bc. Registers atexit cleanup. |
| 0x00E2DDD0 | 220 | tls_init_encrypted_string_106e0 | Thread-local encrypted string initializer at TLS offset 0x106e0. Registers atexit cleanup. |
| 0x00E2DEB0 | 205 | tls_init_encrypted_string_10700 | Thread-local encrypted string initializer at TLS offset 0x10700. Registers atexit cleanup. |
| 0x00E2DF80 | 204 | tls_init_encrypted_string_10728 | Thread-local encrypted string initializer at TLS offset 0x10728. Registers atexit cleanup. |
| 0x00E2E050 | 220 | tls_init_encrypted_string_10740 | Thread-local encrypted string initializer at TLS offset 0x10740. Registers atexit cleanup. |
| 0x00E2E130 | 204 | tls_init_encrypted_string_10760 | Thread-local encrypted string initializer at TLS offset 0x10760. Registers atexit cleanup. |
| 0x00E2E200 | 220 | tls_init_encrypted_string_10778 | Thread-local encrypted string initializer at TLS offset 0x10778. Registers atexit cleanup. |
| 0x00E2E2E0 | 204 | tls_init_encrypted_string_10798 | Thread-local encrypted string initializer at TLS offset 0x10798. Registers atexit cleanup. |
| 0x00E2E3B0 | 221 | tls_init_encrypted_string_107b8 | Thread-local encrypted string initializer at TLS offset 0x107b8. Registers atexit cleanup. |
| 0x00E2E490 | 220 | tls_init_encrypted_string_107dc | Thread-local encrypted string initializer at TLS offset 0x107dc. Registers atexit cleanup. |
| 0x00E2E570 | 205 | tls_init_encrypted_string_107fc | Thread-local encrypted string initializer at TLS offset 0x107fc. Registers atexit cleanup. |
| 0x00E2E640 | 220 | tls_init_encrypted_string_10824 | Thread-local encrypted string initializer at TLS offset 0x10824. Registers atexit cleanup. |
| 0x00E2E720 | 220 | tls_init_encrypted_data_37bytes | TLS-based lazy initializer. Copies 37 bytes of encrypted constant data from globals (DAT_011acc90, DAT_011acc20) into TLS slot at offset 0x10848. Sets initialized flag at +0x1086d, registers atexit cleanup. Returns pointer to TLS data. |
| 0x00E2E800 | 204 | tls_init_encrypted_data_12bytes_a | TLS-based lazy initializer. Copies 12 bytes of encrypted constant data into TLS slot at offset 0x10874. Sets initialized flag at +0x10880, registers atexit cleanup. Returns pointer to TLS data. |
| 0x00E2E8D0 | 204 | tls_init_encrypted_data_12bytes_b | TLS-based lazy initializer. Copies 12 bytes of encrypted constant data into TLS slot at offset 0x10888. Sets initialized flag at +0x10894, registers atexit cleanup. Returns pointer to TLS data. |
| 0x00E2E9A0 | 206 | tls_init_encrypted_data_14bytes_a | TLS-based lazy initializer. Copies 14 bytes of encrypted constant data into TLS slot at offset 0x1089c. Sets initialized flag at +0x108aa, registers atexit cleanup. Returns pointer to TLS data. |
| 0x00E2EA70 | 206 | tls_init_encrypted_data_14bytes_b | TLS-based lazy initializer. Copies 14 bytes of encrypted constant data into TLS slot at offset 0x108b0. Sets initialized flag at +0x108be, registers atexit cleanup. Returns pointer to TLS data. |
| 0x00E2EB40 | 206 | tls_init_encrypted_data_14bytes_c | TLS-based lazy initializer. Copies 14 bytes of encrypted constant data into TLS slot at offset 0x108c4. Sets initialized flag at +0x108d2, registers atexit cleanup. Returns pointer to TLS data. |
| 0x00E55AD0 | 40 | lazy_decrypt_string_00e55ad0 | Lazy XOR string decryptor. If flag at param_1+5 is set, calls xor_decrypt_buffer with key 0x9D235DDF and reference data at DAT_01E7898D, then clears the flag. Returns param_1. One-shot decryption, subsequent calls are no-ops. |
| 0x00E55B00 | 40 | lazy_decrypt_string_00e55b00 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions: checks flag, decrypts on first call, clears flag. One-shot decryption. |
| 0x00E55B30 | 40 | lazy_decrypt_string_00e55b30 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55B60 | 40 | lazy_decrypt_string_00e55b60 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55B90 | 40 | lazy_decrypt_string_00e55b90 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55BC0 | 40 | lazy_decrypt_string_00e55bc0 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55BF0 | 40 | lazy_decrypt_string_00e55bf0 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55C20 | 40 | lazy_decrypt_string_00e55c20 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55C50 | 40 | lazy_decrypt_string_00e55c50 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55C80 | 40 | lazy_decrypt_string_00e55c80 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55CB0 | 40 | lazy_decrypt_string_00e55cb0 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55CE0 | 40 | lazy_decrypt_string_00e55ce0 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55D10 | 40 | lazy_decrypt_string_00e55d10 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55D40 | 40 | lazy_decrypt_string_00e55d40 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55D70 | 40 | lazy_decrypt_string_00e55d70 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55DA0 | 40 | lazy_decrypt_string_00e55da0 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55DD0 | 40 | lazy_decrypt_string_00e55dd0 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55E00 | 40 | lazy_decrypt_string_00e55e00 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55E30 | 40 | lazy_decrypt_string_00e55e30 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55E60 | 40 | lazy_decrypt_string_00e55e60 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55E90 | 40 | lazy_decrypt_string_00e55e90 | Lazy XOR string decryptor. Same pattern as all lazy_decrypt_string functions. |
| 0x00E55EC0 | 206 | tls_init_encrypted_data_00e55ec0 | TLS-based lazy initializer. Copies encrypted constant data into TLS slot, sets initialized flag, registers atexit cleanup. Returns pointer to TLS data. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E55F90 | 204 | tls_init_encrypted_data_00e55f90 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56060 | 204 | tls_init_encrypted_data_00e56060 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56130 | 204 | tls_init_encrypted_data_00e56130 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56200 | 204 | tls_init_encrypted_data_00e56200 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E562D0 | 220 | tls_init_encrypted_data_00e562d0 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E563B0 | 206 | tls_init_encrypted_data_00e563b0 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56480 | 220 | tls_init_encrypted_data_00e56480 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56560 | 220 | tls_init_encrypted_data_00e56560 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56640 | 220 | tls_init_encrypted_data_00e56640 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E56720 | 190 | tls_init_encrypted_data_00e56720 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E567E0 | 220 | tls_init_encrypted_data_00e567e0 | TLS-based lazy initializer. Same pattern as all tls_init_encrypted_data functions. |
| 0x00E568C0 | 204 | tls_init_encrypted_data_10a18 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10a18. Copies 0x13 encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56990 | 206 | tls_init_encrypted_data_10948 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10948. Copies 0x0E encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56A60 | 204 | tls_init_encrypted_data_10a30 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10a30. Copies 0x13 encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56B30 | 204 | tls_init_encrypted_data_10a48 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10a48. Copies 0x0B encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56C00 | 204 | tls_init_encrypted_data_1095c | Thread-safe lazy initialization of TLS encrypted data at offset 0x1095c. Copies 0x0B encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56CD0 | 204 | tls_init_encrypted_data_10a58 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10a58. Copies 0x0B encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56DA0 | 204 | tls_init_encrypted_data_1096c | Thread-safe lazy initialization of TLS encrypted data at offset 0x1096c. Copies 0x0B encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56E70 | 204 | tls_init_encrypted_data_10a68 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10a68. Copies 0x0D encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E56F40 | 204 | tls_init_encrypted_data_1097c | Thread-safe lazy initialization of TLS encrypted data at offset 0x1097c. Copies 0x0D encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E57010 | 220 | tls_init_encrypted_data_10990 | Thread-safe lazy initialization of TLS encrypted data at offset 0x10990. Copies 0x0F encoded bytes into TLS slot, sets init flag, registers destructor. Returns pointer to TLS data. |
| 0x00E570F0 | 220 | tls_init_encrypted_data_109a4 | Thread-safe lazy initialization of TLS encrypted data at offset 0x109a4. Copies 0x0F encoded bytes, registers destructor. Returns pointer to TLS data. |
| 0x00E88BA0 | 569 | anticheat_update_thread | RO client: Anti-cheat update thread. Downloads updates from 5 mirror servers (random order), falls back to secondary download method if direct download fails. Logs results. |
| 0x00E88EB0 | 21 | anticheat_obfuscated_call | RO client: Obfuscated anti-cheat call. Jumps to dynamically calculated address. Used to make reverse engineering harder. |
| 0x00E89C70 | 878 | anticheat_scan_thread | RO client: Anti-cheat scanning thread. Downloads and runs scan data from mirror servers, reports results via pipe connection. Handles scan result codes (0=clean, 0x147=detected). Sends detection reports to server. |
| 0x00E8A160 | 463 | CAntiCheat__shutdown | RO client: CAntiCheat shutdown. Closes pipe connection, handles, stops monitors, cleans up log files. Reports final error code and detection count to server via registry. |
| 0x00E8A330 | 232 | CAntiCheat__stop_monitor_v2 | RO client: Stops anti-cheat monitor v2. Calls shutdown callback, signals event, waits for monitoring thread (2s timeout then terminates), frees DLL. Clears function pointers. |
| 0x00E8A420 | 223 | CAntiCheat__stop_monitor_v1 | RO client: Stops anti-cheat monitor v1. Calls cleanup callback with session data, signals stop event, waits for thread (2s timeout), frees DLL. |
| 0x00E8A500 | 329 | CAntiCheat__initialize | CAntiCheat: initialize |
| 0x00E8AD90 | 406 | CAntiCheat__launch_helper_process | RO client: Launches anti-cheat helper process. Builds command line with executable path and session ID (0xEAD), creates process via CreateProcessA. Only runs if DAT_0173b904 is set. |
| 0x00E8B070 | 401 | CAntiCheat__read_registry_counters | RO client: Reads 4 anti-cheat counter values from HKCU registry. Logs each value. Returns the first counter value. |
| 0x00E8B210 | 184 | CAntiCheat__start_scan_thread | RO client: Starts the anti-cheat scan thread. Creates thread running anticheat_scan_thread, waits 500ms for initial scan. Logs thread handle and ID. |
| 0x00E8B2D0 | 317 | CAntiCheat__write_registry_counters | RO client: Writes 4 anti-cheat counter values plus GetLastError to HKCU registry. Logs each value written. |
| 0x00E8B500 | 9 | thunk_to_CAntiCheat__send_pipe_message_simple_00e8b500 | Simple wrapper that calls FUN_00e916c0 and returns |
| 0x00E8B750 | 52 | CAntiCheat__get_session_info | RO client: Gets anti-cheat session info. Returns two values from the anti-cheat global state (fields at offsets 0x638 and 0x238). Only works if anti-cheat is initialized. |
| 0x00E8B7B0 | 19 | CAntiCheat__get_field_34 | RO client: Gets a field at offset 0x34 from anti-cheat state. Returns 0 if anti-cheat is not initialized. |
| 0x00E8BB20 | 1075 | anticheat_report_to_server | RO client: Reports anti-cheat detection results to server via HTTP. Tries 5 mirror servers, sends error code and detection data. Returns 0x755 for server-side ban responses (0x12F, 0x130). |
| 0x00E8BF60 | 70 | CAntiCheat__get_error_code | RO client: Gets the current anti-cheat error code. Logs whether anti-cheat is running or has an error. |
| 0x00E8BFB0 | 819 | CAntiCheat__start_monitor_v2 | RO client: Starts anti-cheat monitor v2. Verifies DLL signature, loads it, resolves 4 exports by ordinal, creates monitoring thread, initializes with process ID and session data via shared memory. Returns error code or 0 on success. |
| 0x00E8C2F0 | 741 | CAntiCheat__start_monitor_v1 | RO client: Starts anti-cheat monitor v1. Verifies DLL signature, loads it, resolves exports by ordinal (1-4), creates thread, initializes monitor. Returns 1 on success, 0 on failure. |
| 0x00E8C5E0 | 111 | CAntiCheat__create_shared_memory | RO client: Creates a named shared memory mapping (1 byte). Used for inter-process communication between client and anti-cheat helper process. Writes initial marker byte. |
| 0x00E8CB30 | 11 | anticheat_obfuscated_call_2 | RO client: Obfuscated anti-cheat call #2. Jumps to dynamically calculated address. |
| 0x00E8CDB0 | 128 | anticheat_log_printf | RO client: Printf-style logging function for anti-cheat. Formats message into 4096-byte buffer and writes to anti-cheat log. |
| 0x00E8DA00 | 10206 | CAntiCheat__startup_and_verify | Main anticheat startup function (10K bytes). Initializes anticheat subsystem: verifies file signatures, checks PE section integrity, detects API hooks, loads anticheat DLL via CreateProcessA, sets up shared memory/pipes, starts monitoring threads. Handles mutex-based single instance, registry counters, log file rotation. |
| 0x00E905E0 | 66 | CAntiCheat__close_shared_memory | RO client: Closes shared memory mapping. Unmaps view of file and closes file mapping handle. Clears shared memory active flag. |
| 0x00E90950 | 942 | anticheat_report_error_with_code | Reports an anticheat error with an error code, formatting the message and sending it via the anticheat communication channel. |
| 0x00E90D00 | 119 | CAntiCheat__send_heartbeat_00e90d00 | RO client: Sends anti-cheat heartbeat data via pipe connection. Writes shared memory marker and sends 4-DWORD heartbeat packet with message ID 0x8B1/0x619. |
| 0x00E90D80 | 180 | CAntiCheat__send_extended_heartbeat | RO client: Sends extended heartbeat with 5 DWORDs via pipe. Updates shared memory marker. Message ID 0x8B1/0x61A. |
| 0x00E90E40 | 66 | anticheat_obfuscated_init | RO client: Obfuscated anti-cheat initialization. Calls dynamically calculated address. |
| 0x00E910B0 | 76 | CAntiCheat__send_status_report | RO client: Sends anti-cheat status report via pipe. Message ID 0x8B1/0x616 with single DWORD payload. |
| 0x00E91220 | 188 | CAntiCheat__set_session_key_and_scan | RO client: Sets session key and triggers anti-cheat scan. Copies session key to internal buffer, starts scan thread if both scan configs are set. Sends key via pipe 0x8B1/0x613. |
| 0x00E912E0 | 85 | CAntiCheat__call_monitor_export3 | RO client: Calls export ordinal 3 from loaded anti-cheat DLL with two parameters. Returns 2 if function pointer not set. Logs the return value. |
| 0x00E91530 | 188 | CAntiCheat__on_detection_event | RO client: Handles anti-cheat detection event. Dumps running processes and loaded modules, stores detection code, sends pipe report 0x8B1/0x612, calls hash file system callback to handle detection. |
| 0x00E915F0 | 207 | CAntiCheat__monitor_thread_proc | CAntiCheat: monitor thread proc |
| 0x00E916C0 | 42 | CAntiCheat__send_pipe_message_simple | RO client: Sends a simple single-DWORD pipe message (0x8B1/0x61C) if anti-cheat is initialized. Returns nonzero on success. |
| 0x00E91870 | 100 | CAntiCheat__check_api_hooks | CAntiCheat check_api_hooks: verifies that critical API functions have not been hooked by checking their first bytes. |
| 0x00E918E0 | 317 | CAntiCheat__write_shared_memory | Writes data to a shared memory mapped file. Opens a named file mapping, acquires a named mutex, appends data to the end of a linked list structure in shared memory. Used for inter-process communication with anticheat monitor. |
| 0x00E92110 | 96 | CAntiCheat__circular_buffer_enqueue | Enqueues a pair of values (param_2, param_3) into a circular buffer of 20 entries. Protected by critical section if initialized. Returns true if space was available, false if buffer was full. |
| 0x00E92170 | 648 | CAntiCheat__validate_module_imports | Validates that module import table function pointers are within the module's code bounds. Loads the module, parses PE header to find code section, then checks each pointer in the import table against the valid range. Detects API hooking/detours. |
| 0x00E92420 | 92 | CAntiCheat__destroy_instance | Destroys the CAntiCheat singleton instance. Calls shutdown, cleans up crypto verifier, thread handles, and log file. Frees the 0x45b8-byte allocation and clears the global pointer. |
| 0x00E92480 | 24 | CAntiCheat__get_field_4574 | Returns the byte field at offset 0x4574 from the CAntiCheat object. |
| 0x00E924A0 | 26 | CAntiCheat__set_field_0x4574 | Sets the byte field at offset 0x4574 in the CAntiCheat object. |
| 0x00E924C0 | 24 | CAntiCheat__get_field_4575 | Returns the byte field at offset 0x4575 from the CAntiCheat object. |
| 0x00E924E0 | 26 | CAntiCheat__set_field_4575 | Sets the byte field at offset 0x4575 in the CAntiCheat object. |
| 0x00E92500 | 118 | CAntiCheat__clear_pe_dynamic_base_flags | Clears the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag from the PE header of the current process. Modifies the Optional Header's DllCharacteristics field to disable ASLR. Uses VirtualProtect to temporarily make the PE header writable. |
| 0x00E92590 | 47 | CAntiCheat__get_log_file_info | Returns log file info from the CAntiCheat singleton. Outputs two values from offsets 0x30e4 and 0x30e8, returns pointer to offset 0x30ec. Returns 0 if instance not initialized. |
| 0x00E925C0 | 201 | CAntiCheat__dequeue_detection_event | Dequeues a detection event from the circular buffer. If param_3 is set, marks the system as compromised. Otherwise reads next entry from the 20-slot circular buffer, protected by critical section. Returns 1 if an event was dequeued, 0 otherwise. |
| 0x00E92690 | 162 | CAntiCheat__collect_hardware_fingerprint | Initializes ConnectionManager, sets log callback, collects hardware fingerprint for the given param, logs result, then cleans up ConnectionManager. Returns the fingerprint collection result. |
| 0x00E92760 | 27 | CAntiCheat__get_pipe_handle | Returns the pipe handle from the CAntiCheat object for communication with the anticheat driver. |
| 0x00E92780 | 18 | CAntiCheat__is_initialized | Returns whether the CAntiCheat system has been initialized. |
| 0x00E92820 | 18 | CAntiCheat__is_active | Returns whether the CAntiCheat system is currently active and monitoring. |
| 0x00E92840 | 188 | CAntiCheat__set_debug_protection | Enables anti-debug protection by calling NtSetInformationProcess with ProcessDebugFlags (0x14) to set the NoDebugInherit flag. Only runs on Windows NT. Resolves NtSetInformationProcess dynamically from ntdll. |
| 0x00E92910 | 65 | CAntiCheat__protect_memory_readonly | Sets memory region to PAGE_READONLY (0x02) via VirtualProtect. Logs the operation. Used to protect anticheat code from modification. |
| 0x00E92960 | 65 | CAntiCheat__protect_memory_readwrite | Sets memory region to PAGE_READWRITE (0x04) via VirtualProtect. Logs the operation. Used to temporarily make anticheat memory writable for updates. |
| 0x00E929B0 | 557 | CAntiCheat__create_instance | Creates and initializes the CAntiCheat singleton instance. Allocates 0x45b8 bytes, initializes critical section, pipe connection, crypto verifier. Sets exception handler. Calls startup_and_verify, reads registry counters. Stores result in global DAT_0173ccb4. |
| 0x00E92BE0 | 97 | CAntiCheat__create_instance_wide | Wide-string wrapper for CAntiCheat__create_instance. Converts LPCWSTR to ANSI (max 32 chars) then calls create_instance with the ANSI string. |
| 0x00E92C60 | 68 | CAntiCheat__init_and_register | Initializes anticheat fields at offsets 0x18a0, 0x16a0, 0x1aa0 if not already done, then delegates to a registration thunk. Returns 0 if instance not initialized or param is null. |
| 0x00E92CB0 | 30 | CAntiCheat__set_account_id | Sets the account ID in the CAntiCheat object for player identification in anticheat reports. |
| 0x00E92CD0 | 109 | CAntiCheat__set_account_id_wide | Wide-string wrapper for CAntiCheat__set_account_id. Converts LPCWSTR to ANSI (max 260 chars) then calls set_account_id with the ANSI string and second parameter. |
| 0x00E92D40 | 30 | CAntiCheat__send_heartbeat_wrapper | Null-check wrapper for CAntiCheat__send_heartbeat. Returns 0 if singleton not initialized, otherwise delegates to send_heartbeat. |
| 0x00E92D60 | 33 | CAntiCheat__send_extended_heartbeat_wrapper | Null-check wrapper for CAntiCheat__send_extended_heartbeat. Returns 0 if singleton not initialized, otherwise delegates to send_extended_heartbeat with two params. |
| 0x00E92D90 | 36 | CAntiCheat__obfuscated_init_wrapper | Null-check wrapper for anticheat_obfuscated_init. Returns 0 if singleton not initialized, otherwise delegates with three params. |
| 0x00E92DC0 | 30 | CAntiCheat__send_status_report_wrapper | Null-check wrapper for CAntiCheat__send_status_report. Returns 0 if singleton not initialized, otherwise delegates with one param. |
| 0x00E92DE0 | 52 | CAntiCheat__configure_and_start_scan | Configures and starts an anticheat scan. Calls init_and_register first, then set_session_key_and_scan. Returns 0 if singleton not initialized or param is null. |
| 0x00E92E20 | 98 | CAntiCheat__set_server_address_wide | Wide-string wrapper for CAntiCheat__configure_and_start_scan. Converts LPCWSTR to ANSI (max 512 chars) then delegates. |
| 0x00E92E90 | 13 | CAntiCheat__set_callback | Sets a global callback function pointer (PTR_CHashFileSystem__HandleCallback_01361d08). Used for anticheat event notification. |
| 0x00E92EA0 | 98 | CAntiCheat__set_service_name | Sets the service name in global buffer at DAT_0173b918. Compares with existing empty string, if different copies the name and logs the change via encrypted string format. |
| 0x00E92F30 | 23 | CAntiCheat__dispatch_detection_event | Dispatches a detection event to CAntiCheat__on_detection_event if the anticheat singleton is initialized. No-op if DAT_0173ccb4 is null. |
| 0x00E94700 | 178 | PipeConnection__init | Initializes a PipeConnection structure. Clears buffer at offset 0x1640 (0x1008 bytes), sets pipe handles to -1 (invalid), generates date-based XOR key at offset 0x10, zeroes thread/event fields. |
| 0x00E947C0 | 5 | PipeConnection__close_thunk | 5-byte thunk/jump to PipeConnection__close. Same cleanup logic: signals stop event, waits for read thread, closes pipe handles. Used as an alternate entry point. |
| 0x00E947D0 | 124 | PipeConnection__close | Closes a PipeConnection. Signals the stop event, waits 100ms for read thread to exit (terminates if timeout), closes thread handle and both pipe handles. Returns 0 if already closed. |
| 0x00E94850 | 1674 | PipeConnection__read_thread | Named pipe read thread. Loops reading messages from pipe via PeekNamedPipe/ReadFile. Dispatches messages by command ID (0x8b0=heartbeat, 0x8b1=request, 0x8b2=response). Reads additional data for commands 0x613-0x63d into connection buffers. Calls FUN_00e8a500 for message handling and FUN_00e95170 for sending responses. |
| 0x00E94F00 | 46 | PipeConnection__set_handles_and_start | Sets the read and write pipe handles on the connection object, then starts the read thread. Returns 0 if either handle is invalid. |
| 0x00E94F70 | 67 | PipeConnection__start_read_thread | Creates a stop event and spawns the pipe read thread (PipeConnection__read_thread). Returns the thread ID on success, 0 on failure. Sets running flag at offset 0x18. |
| 0x00E94FC0 | 4 | PipeConnection__get_small_data_buffer_1c | Returns pointer to small data buffer at offset 0x1c in PipeConnection. Used for commands 0x619/0x61a (20 bytes max). |
| 0x00E94FD0 | 7 | PipeConnection__get_stdin_pipe_read_handle | Returns the stdin pipe read handle at offset 0x2a50. Set by PipeConnection__redirect_stdio via CreatePipe for stdin redirection. |
| 0x00E94FE0 | 7 | PipeConnection__get_stdout_pipe_write_handle | Returns the stdout pipe write handle at offset 0x2a5c. Set by PipeConnection__redirect_stdio via CreatePipe for stdout capture. |
| 0x00E94FF0 | 7 | PipeConnection__get_data_buffer_238 | Returns pointer to data buffer at offset 0x238 in PipeConnection. Used for command 0x63c data storage (1024 bytes max). |
| 0x00E95000 | 7 | PipeConnection__get_data_length_638 | Returns data length field at offset 0x638 in PipeConnection. Stores the size of data in the 0x238 buffer (command 0x63c). |
| 0x00E95010 | 7 | PipeConnection__get_data_buffer_63c | Returns pointer to data buffer at offset 0x63c in PipeConnection. Used for command 0x63d data storage (4096 bytes max). |
| 0x00E95020 | 7 | PipeConnection__get_data_length_163c | Returns data length field at offset 0x163c in PipeConnection. Stores the size of data in the 0x63c buffer (command 0x63d). |
| 0x00E95030 | 4 | PipeConnection__get_string_buffer_34 | Returns pointer to string buffer at offset 0x34 in PipeConnection. Used for command 0x613 string data (512 bytes max). |
| 0x00E95050 | 288 | PipeConnection__redirect_stdio | Redirects stdout and stdin through pipes. Creates two pipe pairs: one for stdout (captures output), one for stdin (sends input). Saves original handles and duplicates pipe ends with non-inheritable flags. |
| 0x00E95170 | 1010 | PipeConnection__write_message | Writes a message to the pipe. Message format: 16-byte header (command, sequence, subcmd, size) + payload. Handles various command types (0x613=string, 0x619/0x61a=fixed data, 0x61b=large block, 0x61c/0x61d=512-byte blocks, 0x630/0x632/0x63c/0x63d=variable). Returns 0 on broken pipe. |
| 0x00E95590 | 103 | PipeConnection__start_read_thread_with_stdio | Starts pipe read thread after restoring original stdio handles. Restores saved stdin/stdout handles, creates stop event, and spawns the read thread. |
| 0x00E95600 | 140 | PipeConnection__write_message_with_dedup | Writes a message to the pipe with deduplication. Tracks last message params and if same message sent >2 times consecutively, returns early to avoid flooding. Skips dedup for commands 0x619-0x61d. Delegates to PipeConnection__write_message. |
| 0x00E95690 | 30 | PipeConnection__init_buffer | Initializes a 0x208-byte buffer structure. Sets size field to 0x208 and zeroes the data area (0x204 bytes). |
| 0x00E956B0 | 199 | CryptoVerifier__init | Initializes CryptoVerifier. Zeroes all fields, acquires Microsoft Base Cryptographic Provider (PROV_RSA_FULL) context. Uses critical section DAT_0173e5e8 when DAT_0173e600 is set. |
| 0x00E95780 | 162 | CryptoVerifier__cleanup | Cleans up CryptoVerifier. Frees allocated buffers, destroys hash and key handles, releases crypto context, unmaps file view. Uses critical section when DAT_0173e600 is set. |
| 0x00E95850 | 128 | CryptoVerifier__ensure_buffer | Ensures the internal buffer (offset 0x4) is at least param_2 bytes. Frees and reallocates if current capacity (offset 0xC) is insufficient. Returns 1 on success, 0 on allocation failure. |
| 0x00E958D0 | 1485 | CryptoVerifier__verify_file_signature | Verifies a file's digital signature using Microsoft CryptoAPI. Reads file, parses PE headers to find signature data (magic 0x32812622/0x32812621), imports RSA public key from DAT_01361d88, creates MD5 hash (0x8003), and verifies signature. Optionally checks filename match. Handles PE overlay data and checksum recalculation. |
| 0x00E95EA0 | 1363 | CryptoVerifier__verify_file_signature_alt | Alternative file signature verification. Same flow as verify_file_signature but uses different RSA key blob (DAT_01361d30/DAT_01361d84) and different signature block magic (0x32812624/0x32812623 as secondary). Does not check PE checksum field. |
| 0x00E96440 | 947 | CryptoVerifier__decrypt_file_to_buffer | Decrypts a file using password-derived RC4 key. Reads file (or uses memory-mapped data), parses signature block, hashes password with MD5, derives RC4 key via CryptDeriveKey(0x6801), decrypts data, copies to output buffer. Supports both primary (0x32812622) and secondary (0x32812624) signature formats. |
| 0x00E96800 | 896 | CryptoVerifier__decrypt_file_direct | Directly decrypts a file using password-derived RC4 key. Opens file, reads contents, parses signature block, hashes password, derives key, decrypts with CryptDecrypt. Falls back to hash-verify on NTE_BAD_DATA error. Returns decrypted data in param_3 buffer. |
| 0x00E96B80 | 155 | CryptoVerifier__verify_hash_and_decrypt | Gets the MD5 hash value from the crypto context, then uses it to initialize RC4 key schedule and RC4-decrypt the data buffer. Despite the key derivation using CryptoAPI MD5, the actual decryption is RC4 (via rc4_key_schedule and rc4_crypt). |
| 0x00E96C20 | 333 | CryptoVerifier__map_file_and_crc | Memory-maps a file and optionally computes CRC. Opens file, creates file mapping, maps view of file. If param_3 != 0, initializes CRC32 table, computes CRC of the mapped data, then unmaps. |
| 0x00E96E10 | 60 | CryptoVerifier__set_flag | Sets a byte flag at offset 0x10 in the object. Uses critical section when DAT_0173e600 is set. |
| 0x00E97C60 | 1166 | rc4_crypt_00e97c60 | RC4 stream cipher encrypt/decrypt. Uses 258-element state array (i, j, S[256]). Processes data in 8-byte blocks for speed, with byte-by-byte handling for remainder. XORs keystream with input to produce output. |
| 0x00E980F0 | 350 | rc4_key_schedule_00e980f0 | RC4 Key Scheduling Algorithm (KSA). Initializes the 256-byte S-box permutation from a key of param_2 bytes at param_3. State array: [i, j, S[0]..S[255]]. Processes 4 entries per iteration in 64 rounds. |
| 0x00E9B160 | 137 | anticheat_linked_list_dtor | Frees a dynamic vector buffer (offsets 0x10-0x18) and walks a linked list of 0x60-byte nodes (from offset 0x8), freeing each. Used by anticheat to clean up a data structure. |
| 0x00E9DA90 | 1391 | anticheat_collect_file_signature | Collects file signature for anticheat verification. Searches Windows system directories for the file if not found locally (using hash-based directory detection). Opens file, reads version info, formats as hex fingerprint strings (0x30 and 0x20 bytes). Returns true on success. |
| 0x00E9E000 | 586 | anticheat_match_file_hash_flags | Matches a file against the anticheat hash table. Computes ANSI file hash, iterates through entries (0x38 bytes each), compares hash strings. Sets bitflags in param_2 and param_3 based on matched entry flags (file trust levels, permissions). |
| 0x00E9E250 | 186 | anticheat_connection_check | Anticheat connection check with mutex locking. Returns 100 if param==0, 107 if DAT_0173eb11==1 (disabled), otherwise acquires ConnectionManager lock and calls inner check function. Uses SEH for exception safety. |
| 0x00E9E360 | 215 | anticheat_connection_inner_check | Inner anticheat connection check. Initializes local buffers (1024 + 100 + 100 + 30 bytes) and calls an obfuscated function for the actual connection verification. Called under ConnectionManager lock. |
| 0x00E9EC70 | 216 | anticheat_verify_file_and_log | Verifies a file for anticheat. Hashes the filename, appends a decrypted suffix to the path, calls verification function (FUN_00ea0250), decrypts and logs the result. Sets error code 0x4D2 initially, clears on success. Member function of anticheat connection manager. |
| 0x00E9F160 | 989 | anticheat_registry_cache_check | Registry-based anticheat verification cache. Creates/opens HKCU registry key, compares stored hash+path with current. If match found and timestamp within 20 minutes, returns 1 (cached valid). Otherwise stores current hash, path, and timestamp. Returns 1 if DAT_0173ec98==100 (bypass mode). |
| 0x00E9F540 | 936 | anticheat_registry_cache_check_with_int | Registry-based anticheat cache with integer key. Similar to anticheat_registry_cache_check but also stores/compares an integer value (param_2) in addition to the hash string. Uses same 20-minute timeout window. |
| 0x00E9F8F0 | 1871 | anticheat_http_verify_request | Sends HTTP verification request to anticheat server. Builds URL with encrypted format strings based on connection parameters. Sends via ConnectionManager, receives JSON response, parses verification hash. Validates response by XOR-checking hash with local key (0x73171913). Returns true if verification succeeds. |
| 0x00EA0250 | 619 | anticheat_load_hash_table_file | Loads anticheat hash table from a file. Resolves path (handles relative and absolute), memory-maps the file, decrypts payload via ConnectionManager__receive_data, computes CRC32 checksum for integrity. Returns error codes: 0x14B (start), 0x14D (file not found), 0x14E (open failed), 0 (success). |
| 0x00EA04C0 | 141 | anticheat_write_data_file | Writes a data buffer to a file for anticheat. Deletes existing file first, creates new file, writes buffer. Returns 0x151 if path is null, 0x152 if buffer/size invalid, 0 on success. |
| 0x00EA0BB0 | 320 | anticheat_validate_connection | Anticheat connection validation entry point. Validates preconditions: returns 0 if param3==2 (bypass), 0x6B if disabled, 0x6C if no connection info, 0x144/100/0x6E for missing fields. Acquires ConnectionManager lock and calls inner validation. |
| 0x00EA0D50 | 1358 | anticheat_validate_connection_inner | Main anticheat validation inner function. Copies connection info, registers connection, checks registry cache, performs HTTP verification, collects system info (username/computer name), backs up files. Uses encrypted format strings throughout. Returns error code or calls obfuscated finalizer. |
| 0x00EA2750 | 231 | anticheat_check_with_params | Anticheat check with additional parameters (param_3, param_4). Similar to anticheat_validate_connection but passes extra flags. Returns 0 if param5==2, 0x6B if disabled, 0x6C if no connection. Calls FUN_00ea2890 under ConnectionManager lock. |
| 0x00EA2890 | 1043 | anticheat_check_with_params_inner | Inner implementation of anticheat parameter-based check: validates game state and memory against expected values. |
| 0x00EA3E50 | 226 | anticheat_check_module | Anticheat module check: validates a loaded module's integrity by comparing its hash against expected values. |
| 0x00EA3F90 | 1025 | anticheat_check_module_inner | Inner implementation of anticheat module check: reads module memory, computes hash, and compares against stored baseline. |
| 0x00EA55C0 | 236 | anticheat_verify_module_hash | Anticheat module hash verification: computes and verifies the hash of a loaded module's code section. |
| 0x00EA5710 | 291 | anticheat_verify_module_hash_inner | Inner implementation of module hash verification: reads module bytes and computes MD5 hash for integrity checking. |
| 0x00EA62B0 | 363 | anticheat_hashtable_rehash | Rehashes a hash table. Resizes bucket array to next power-of-2, reinserts all elements using hash_xor_deadbeef hash function with linear congruential mixing. Part of anticheat's unordered_map implementation. |
| 0x00EA65B0 | 229 | anticheat_decode_hex_xor_string | Decodes an XOR-encrypted hex string. Converts hex pairs to bytes, then if first byte is 0x02, XOR-decodes the data using a rolling key derived from byte[1] (key = (seed*7+1)*7, then (key+1)*7 for each subsequent byte). Returns null-terminated plaintext. |
| 0x00EA66A0 | 332 | anticheat_encode_xor_to_hex_string | Encodes a string using XOR encryption and outputs as hex pairs. Prepends header byte 0x02 and seed byte, XOR-encodes each character with a rolling key derived from seed (key = seed*0x31+8, then key = (key*7+1)*7+0x46). Used for anticheat string obfuscation. |
| 0x00EA67F0 | 360 | anticheat_collect_hwid_data | Collects hardware identification data (MAC address, disk serial, CPU info) for anticheat fingerprinting. |
| 0x00EA6960 | 378 | anticheat_hashtable_erase_range | Erases a range of entries from the anticheat hash table, deallocating each node. |
| 0x00EA6AF0 | 131 | anticheat_hashtable_clear | Clears the entire anticheat hash table by erasing all buckets and resetting the element count. |
| 0x00EA6BE0 | 103 | anticheat_collect_system_info_seh | Collects system information for anticheat with SEH protection to handle access violations gracefully. |
| 0x00EA92E0 | 12 | md5_init_wrapper | MD5 init wrapper: initializes an MD5 context structure to begin a new hash computation. |
| 0x00EA9310 | 225 | md5_update_00ea9310 | MD5 update: processes input data in 64-byte blocks, updating the running hash state. |
| 0x00EA9420 | 174 | md5_finalize_00ea9420 | MD5 finalize: pads the message, appends the bit count, processes the final block, and outputs the 16-byte digest. |
| 0x00EA94D0 | 287 | md5_compute_file_hash | Computes MD5 hash of a file. Opens file, reads in 4KB chunks (max 100MB), feeds each chunk through md5_update, then finalizes. Returns 1 on success, 0 on failure. Used by anticheat for file integrity verification. |
| 0x00EA95F0 | 607 | md5_compute_pe_section_hash | Computes MD5 hash of PE file sections only (not the entire file). Reads PE header, iterates sections, hashes code/data sections (those with execute flag 0x20000000 or containing the entry point). Reads each section in 4KB chunks. Used for integrity verification that ignores non-code data. |
| 0x00EA9970 | 42 | md5_init_state | MD5 init state: sets the four initial hash values (A, B, C, D) to the standard MD5 constants. |
| 0x00EA9A00 | 1991 | md5_transform | MD5 transform: processes a single 64-byte block through the 64 rounds of the MD5 compression function. |
No function here matches that. Search all 47,061 functions instead.