├── README.md ├── AP-MetadataDecryptor.sln ├── src ├── AP-MetadataDecryptor.filters ├── AP-MetadataDecryptor.vcxproj ├── main.cpp └── decrypt_chunk.hpp └── .gitignore /README.md: -------------------------------------------------------------------------------- 1 | # AP-MetadataDecryptor 2 | A tool to decrypt global-metadata.dat from Azure Promilia 3 | 4 | ## 📝 Usage 5 | - `AP-MetadataDecryptor.exe ` -------------------------------------------------------------------------------- /AP-MetadataDecryptor.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.14.36212.18 d17.14 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AP-MetadataDecryptor", "src\AP-MetadataDecryptor.vcxproj", "{3DCF92F5-3AD2-429F-AF5F-C8BDD0B86E4F}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Release|x64 = Release|x64 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {3DCF92F5-3AD2-429F-AF5F-C8BDD0B86E4F}.Debug|x64.ActiveCfg = Debug|x64 15 | {3DCF92F5-3AD2-429F-AF5F-C8BDD0B86E4F}.Debug|x64.Build.0 = Debug|x64 16 | {3DCF92F5-3AD2-429F-AF5F-C8BDD0B86E4F}.Release|x64.ActiveCfg = Release|x64 17 | {3DCF92F5-3AD2-429F-AF5F-C8BDD0B86E4F}.Release|x64.Build.0 = Release|x64 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {AF385F4D-D871-4C4A-9520-67FD39183F63} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /src/AP-MetadataDecryptor.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /src/AP-MetadataDecryptor.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | x64 7 | 8 | 9 | Release 10 | x64 11 | 12 | 13 | 14 | 17.0 15 | Win32Proj 16 | {3dcf92f5-3ad2-429f-af5f-c8bdd0b86e4f} 17 | APMetadataDecryptor 18 | 10.0 19 | 20 | 21 | 22 | Application 23 | true 24 | v143 25 | Unicode 26 | 27 | 28 | Application 29 | false 30 | v143 31 | true 32 | Unicode 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | $(SolutionDir)bin\$(Configuration)-$(Platform)\ 48 | $(SolutionDir)bin\$(Configuration)-$(Platform)\obj\ 49 | 50 | 51 | $(SolutionDir)bin\$(Configuration)-$(Platform)\ 52 | $(SolutionDir)bin\$(Configuration)-$(Platform)\obj\ 53 | 54 | 55 | 56 | Level3 57 | true 58 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 59 | true 60 | 61 | 62 | Console 63 | true 64 | 65 | 66 | 67 | 68 | Level3 69 | true 70 | true 71 | true 72 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 73 | true 74 | 75 | 76 | Console 77 | true 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /src/main.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "decrypt_chunk.hpp" 8 | 9 | bool DecryptMetadata(const std::vector& encryptedData, 10 | std::vector& decryptedData) 11 | { 12 | if (encryptedData.size() < 8) 13 | { 14 | std::cout << "File too small to be valid metadata" << std::endl; 15 | return false; 16 | } 17 | 18 | // DA FE 57 13 F4 19 | uint32_t magic = *reinterpret_cast(encryptedData.data()); 20 | if (magic != 0x1357FEDA) 21 | { 22 | std::cout << "Invalid magic number: " << std::hex << magic << std::endl; 23 | return false; 24 | } 25 | 26 | // Get data size 27 | uint32_t encryptedSize = *reinterpret_cast(encryptedData.data() + 4); 28 | std::cout << "Encrypted data size: " << encryptedSize << " bytes" << std::endl; 29 | std::cout << "Total file size: " << encryptedData.size() << " bytes" << std::endl; 30 | 31 | // Calculate actual header size from file structure 32 | size_t actualHeaderSize = encryptedData.size() - encryptedSize; 33 | std::cout << "Header size: " << actualHeaderSize << " bytes (0x" << std::hex << actualHeaderSize << std::dec << ")" << std::endl; 34 | 35 | if (encryptedSize == 0 || encryptedSize > encryptedData.size()) 36 | { 37 | std::cout << "Invalid encrypted size: " << encryptedSize << " (file size: " << encryptedData.size() << ")" << std::endl; 38 | return false; 39 | } 40 | 41 | if (actualHeaderSize < 0x108 + 64) 42 | { 43 | std::cout << "Header too small for bytecode extraction" << std::endl; 44 | return false; 45 | } 46 | 47 | // sub_18091BD50((_DWORD)MetaDataFile + 0x108, 64, (_DWORD)MetaDataFile + 8, v2 + (_DWORD)MetaDataFile + 0x148, v8); 48 | // Extract bytecode from offset 0x108 size 64 49 | const unsigned char* bytecode = encryptedData.data() + 0x108; 50 | // Extract key from offset 8 size 256 51 | const unsigned char* key = encryptedData.data() + 8; 52 | 53 | // Calculate the actual data start offset 54 | size_t dataStartOffset = actualHeaderSize; 55 | std::cout << "Data starts at offset: 0x" << std::hex << dataStartOffset << std::dec << std::endl; 56 | 57 | // Copy encrypted data to working buffer 58 | std::vector workingData(encryptedData.data() + dataStartOffset, 59 | encryptedData.data() + dataStartOffset + encryptedSize); 60 | 61 | // Decrypt in 64 byte chunks 62 | for (size_t offset = 0; offset < encryptedSize; offset += 64) 63 | { 64 | size_t chunkSize = std::min(64ULL, encryptedSize - offset); 65 | DecryptChunk(bytecode, 64, key, workingData.data() + offset, chunkSize); 66 | } 67 | 68 | // if ( (unsigned int)sub_180A52AC0((_QWORD *)MetaDataFile + 0x29, (__int64)"CODEPHIL", 8uLL) ) 69 | // Verify "CODEPHIL" signature at the beginning of decrypted data 70 | if (workingData.size() >= 8 && memcmp(workingData.data(), "CODEPHIL", 8) != 0) 71 | { 72 | std::cout << "Warning: 'CODEPHIL' signature not found at start of decrypted data" << std::endl; 73 | // Print what we found instead 74 | std::cout << "Found: "; 75 | for (int i = 0; i < 8 && i < workingData.size(); i++) 76 | { 77 | if (isprint(workingData[i])) 78 | { 79 | std::cout << workingData[i]; 80 | } 81 | else 82 | { 83 | std::cout << "\\x" << std::hex << std::setw(2) << std::setfill('0') << static_cast(workingData[i]); 84 | } 85 | } 86 | std::cout << std::endl; 87 | } 88 | 89 | // skip the "CODEPHIL" signature and return the decrypted data 90 | if (workingData.size() >= 8) 91 | { 92 | decryptedData.assign(workingData.begin() + 8, workingData.end()); 93 | } 94 | else 95 | { 96 | decryptedData = workingData; 97 | } 98 | 99 | return true; 100 | } 101 | 102 | int main(int argc, char* argv[]) 103 | { 104 | if (argc != 3) 105 | { 106 | std::cout << "Usage: " << argv[0] << " " << std::endl; 107 | return 1; 108 | } 109 | 110 | // Read encrypted file 111 | std::ifstream inFile(argv[1], std::ios::binary); 112 | if (!inFile) 113 | { 114 | std::cout << "Could not open input file: " << argv[1] << std::endl; 115 | return 1; 116 | } 117 | 118 | std::vector encryptedData((std::istreambuf_iterator(inFile)), 119 | std::istreambuf_iterator()); 120 | inFile.close(); 121 | 122 | std::cout << "Loaded " << encryptedData.size() << " bytes from " << argv[1] << std::endl; 123 | 124 | // Decrypt the data 125 | std::vector decryptedData; 126 | if (!DecryptMetadata(encryptedData, decryptedData)) 127 | { 128 | std::cout << "Decryption failed" << std::endl; 129 | return 1; 130 | } 131 | 132 | std::cout << "Decrypted " << decryptedData.size() << " bytes" << std::endl; 133 | 134 | // Write decrypted file 135 | std::ofstream outFile(argv[2], std::ios::binary); 136 | if (!outFile) 137 | { 138 | std::cout << "Could not create output file: " << argv[2] << std::endl; 139 | return 1; 140 | } 141 | 142 | outFile.write(reinterpret_cast(decryptedData.data()), decryptedData.size()); 143 | outFile.close(); 144 | 145 | std::cout << "Decrypted metadata saved to " << argv[2] << std::endl; 146 | 147 | // Check if its a valid IL2CPP metadata file 148 | if (decryptedData.size() >= 4) 149 | { 150 | uint32_t currentMagic = *reinterpret_cast(decryptedData.data()); 151 | std::cout << "First 4 bytes of decrypted data: 0x" << std::hex << currentMagic << std::endl; 152 | 153 | if (currentMagic == 0xFAB11BAF) 154 | { 155 | std::cout << "AF 1B B1 FA found!" << std::endl; 156 | } 157 | } 158 | 159 | return 0; 160 | } 161 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ##### Windows 2 | # Windows thumbnail cache files 3 | Thumbs.db 4 | Thumbs.db:encryptable 5 | ehthumbs.db 6 | ehthumbs_vista.db 7 | 8 | # Dump file 9 | *.stackdump 10 | 11 | # Folder config file 12 | [Dd]esktop.ini 13 | 14 | # Recycle Bin used on file shares 15 | $RECYCLE.BIN/ 16 | 17 | # Windows Installer files 18 | *.cab 19 | *.msi 20 | *.msix 21 | *.msm 22 | *.msp 23 | 24 | # Windows shortcuts 25 | *.lnk 26 | 27 | ##### Linux 28 | *~ 29 | 30 | # temporary files which can be created if a process still has a handle open of a deleted file 31 | .fuse_hidden* 32 | 33 | # KDE directory preferences 34 | .directory 35 | 36 | # Linux trash folder which might appear on any partition or disk 37 | .Trash-* 38 | 39 | # .nfs files are created when an open file is removed but is still being accessed 40 | .nfs* 41 | 42 | ##### MacOS 43 | # General 44 | .DS_Store 45 | .AppleDouble 46 | .LSOverride 47 | 48 | # Thumbnails 49 | ._* 50 | 51 | # Files that might appear in the root of a volume 52 | .DocumentRevisions-V100 53 | .fseventsd 54 | .Spotlight-V100 55 | .TemporaryItems 56 | .Trashes 57 | .VolumeIcon.icns 58 | .com.apple.timemachine.donotpresent 59 | 60 | # Directories potentially created on remote AFP share 61 | .AppleDB 62 | .AppleDesktop 63 | Network Trash Folder 64 | Temporary Items 65 | .apdisk 66 | 67 | ##### Android 68 | # Built application files 69 | *.apk 70 | *.ap_ 71 | *.aab 72 | 73 | # Files for the ART/Dalvik VM 74 | *.dex 75 | 76 | # Java class files 77 | *.class 78 | 79 | # Generated files 80 | bin/ 81 | gen/ 82 | out/ 83 | # Uncomment the following line in case you need and you don't have the release build type files in your app 84 | # release/ 85 | 86 | # Gradle files 87 | .gradle/ 88 | build/ 89 | 90 | # Local configuration file (sdk path, etc) 91 | local.properties 92 | 93 | # Proguard folder generated by Eclipse 94 | proguard/ 95 | 96 | # Log Files 97 | *.log 98 | 99 | # Android Studio Navigation editor temp files 100 | .navigation/ 101 | 102 | # Android Studio captures folder 103 | captures/ 104 | 105 | # IntelliJ 106 | *.iml 107 | .idea/workspace.xml 108 | .idea/tasks.xml 109 | .idea/gradle.xml 110 | .idea/assetWizardSettings.xml 111 | .idea/dictionaries 112 | .idea/libraries 113 | # Android Studio 3 in .gitignore file. 114 | .idea/caches 115 | .idea/modules.xml 116 | # Comment next line if keeping position of elements in Navigation Editor is relevant for you 117 | .idea/navEditor.xml 118 | 119 | # Keystore files 120 | # Uncomment the following lines if you do not want to check your keystore files in. 121 | #*.jks 122 | #*.keystore 123 | 124 | # External native build folder generated in Android Studio 2.2 and later 125 | .externalNativeBuild 126 | 127 | # Google Services (e.g. APIs or Firebase) 128 | # google-services.json 129 | 130 | # Freeline 131 | freeline.py 132 | freeline/ 133 | freeline_project_description.json 134 | 135 | # fastlane 136 | fastlane/report.xml 137 | fastlane/Preview.html 138 | fastlane/screenshots 139 | fastlane/test_output 140 | fastlane/readme.md 141 | 142 | # Version control 143 | vcs.xml 144 | 145 | # lint 146 | lint/intermediates/ 147 | lint/generated/ 148 | lint/outputs/ 149 | lint/tmp/ 150 | # lint/reports/ 151 | 152 | ##### Backup 153 | *.bak 154 | *.gho 155 | *.ori 156 | *.orig 157 | *.tmp 158 | 159 | ##### GPG 160 | secring.* 161 | 162 | ##### Dropbox 163 | # Dropbox settings and caches 164 | .dropbox 165 | .dropbox.attr 166 | .dropbox.cache 167 | 168 | ##### SynopsysVCS 169 | # Waveform formats 170 | *.vcd 171 | *.vpd 172 | *.evcd 173 | *.fsdb 174 | 175 | # Default name of the simulation executable. A different name can be 176 | # specified with this switch (the associated daidir database name is 177 | # also taken from here): -o / 178 | simv 179 | 180 | # Generated for Verilog and VHDL top configs 181 | simv.daidir/ 182 | simv.db.dir/ 183 | 184 | # Infrastructure necessary to co-simulate SystemC models with 185 | # Verilog/VHDL models. An alternate directory may be specified with this 186 | # switch: -Mdir= 187 | csrc/ 188 | 189 | # Log file - the following switch allows to specify the file that will be 190 | # used to write all messages from simulation: -l 191 | *.log 192 | 193 | # Coverage results (generated with urg) and database location. The 194 | # following switch can also be used: urg -dir .vdb 195 | simv.vdb/ 196 | urgReport/ 197 | 198 | # DVE and UCLI related files. 199 | DVEfiles/ 200 | ucli.key 201 | 202 | # When the design is elaborated for DirectC, the following file is created 203 | # with declarations for C/C++ functions. 204 | vc_hdrs.h 205 | 206 | ##### SVN 207 | .svn/ 208 | 209 | ##### Mercurial 210 | .hg/ 211 | .hgignore 212 | .hgsigs 213 | .hgsub 214 | .hgsubstate 215 | .hgtags 216 | 217 | ##### Bazaar 218 | .bzr/ 219 | .bzrignore 220 | 221 | ##### CVS 222 | /CVS/* 223 | **/CVS/* 224 | .cvsignore 225 | */.cvsignore 226 | 227 | ##### TortoiseGit 228 | # Project-level settings 229 | /.tgitconfig 230 | 231 | ##### PuTTY 232 | # Private key 233 | *.ppk 234 | 235 | ##### Vim 236 | # Swap 237 | [._]*.s[a-v][a-z] 238 | !*.svg # comment out if you don't need vector files 239 | [._]*.sw[a-p] 240 | [._]s[a-rt-v][a-z] 241 | [._]ss[a-gi-z] 242 | [._]sw[a-p] 243 | 244 | # Session 245 | Session.vim 246 | Sessionx.vim 247 | 248 | # Temporary 249 | .netrwhist 250 | *~ 251 | # Auto-generated tag files 252 | tags 253 | # Persistent undo 254 | [._]*.un~ 255 | 256 | ##### Emacs 257 | # -*- mode: gitignore; -*- 258 | *~ 259 | \#*\# 260 | /.emacs.desktop 261 | /.emacs.desktop.lock 262 | *.elc 263 | auto-save-list 264 | tramp 265 | .\#* 266 | 267 | # Org-mode 268 | .org-id-locations 269 | *_archive 270 | 271 | # flymake-mode 272 | *_flymake.* 273 | 274 | # eshell files 275 | /eshell/history 276 | /eshell/lastdir 277 | 278 | # elpa packages 279 | /elpa/ 280 | 281 | # reftex files 282 | *.rel 283 | 284 | # AUCTeX auto folder 285 | /auto/ 286 | 287 | # cask packages 288 | .cask/ 289 | dist/ 290 | 291 | # Flycheck 292 | flycheck_*.el 293 | 294 | # server auth directory 295 | /server/ 296 | 297 | # projectiles files 298 | .projectile 299 | 300 | # directory configuration 301 | .dir-locals.el 302 | 303 | # network security 304 | /network-security.data 305 | 306 | ##### SublimeText 307 | # Cache files for Sublime Text 308 | *.tmlanguage.cache 309 | *.tmPreferences.cache 310 | *.stTheme.cache 311 | 312 | # Workspace files are user-specific 313 | *.sublime-workspace 314 | 315 | # Project files should be checked into the repository, unless a significant 316 | # proportion of contributors will probably not be using Sublime Text 317 | # *.sublime-project 318 | 319 | # SFTP configuration file 320 | sftp-config.json 321 | sftp-config-alt*.json 322 | 323 | # Package control specific files 324 | Package Control.last-run 325 | Package Control.ca-list 326 | Package Control.ca-bundle 327 | Package Control.system-ca-bundle 328 | Package Control.cache/ 329 | Package Control.ca-certs/ 330 | Package Control.merged-ca-bundle 331 | Package Control.user-ca-bundle 332 | oscrypto-ca-bundle.crt 333 | bh_unicode_properties.cache 334 | 335 | # Sublime-github package stores a github token in this file 336 | # https://packagecontrol.io/packages/sublime-github 337 | GitHub.sublime-settings 338 | 339 | ##### Notepad++ 340 | # Notepad++ backups # 341 | *.bak 342 | 343 | ##### TextMate 344 | *.tmproj 345 | *.tmproject 346 | tmtags 347 | 348 | ##### VisualStudioCode 349 | .vscode/* 350 | !.vscode/settings.json 351 | !.vscode/tasks.json 352 | !.vscode/launch.json 353 | !.vscode/extensions.json 354 | *.code-workspace 355 | 356 | # Local History for Visual Studio Code 357 | .history/ 358 | 359 | ##### NetBeans 360 | **/nbproject/private/ 361 | **/nbproject/Makefile-*.mk 362 | **/nbproject/Package-*.bash 363 | build/ 364 | nbbuild/ 365 | dist/ 366 | nbdist/ 367 | .nb-gradle/ 368 | 369 | ##### JetBrains 370 | # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider 371 | # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 372 | 373 | # User-specific stuff 374 | .idea/**/workspace.xml 375 | .idea/**/tasks.xml 376 | .idea/**/usage.statistics.xml 377 | .idea/**/dictionaries 378 | .idea/**/shelf 379 | 380 | # Generated files 381 | .idea/**/contentModel.xml 382 | 383 | # Sensitive or high-churn files 384 | .idea/**/dataSources/ 385 | .idea/**/dataSources.ids 386 | .idea/**/dataSources.local.xml 387 | .idea/**/sqlDataSources.xml 388 | .idea/**/dynamic.xml 389 | .idea/**/uiDesigner.xml 390 | .idea/**/dbnavigator.xml 391 | 392 | # Gradle 393 | .idea/**/gradle.xml 394 | .idea/**/libraries 395 | 396 | # Gradle and Maven with auto-import 397 | # When using Gradle or Maven with auto-import, you should exclude module files, 398 | # since they will be recreated, and may cause churn. Uncomment if using 399 | # auto-import. 400 | # .idea/artifacts 401 | # .idea/compiler.xml 402 | # .idea/jarRepositories.xml 403 | # .idea/modules.xml 404 | # .idea/*.iml 405 | # .idea/modules 406 | # *.iml 407 | # *.ipr 408 | 409 | # CMake 410 | cmake-build-*/ 411 | 412 | # Mongo Explorer plugin 413 | .idea/**/mongoSettings.xml 414 | 415 | # File-based project format 416 | *.iws 417 | 418 | # IntelliJ 419 | out/ 420 | 421 | # mpeltonen/sbt-idea plugin 422 | .idea_modules/ 423 | 424 | # JIRA plugin 425 | atlassian-ide-plugin.xml 426 | 427 | # Cursive Clojure plugin 428 | .idea/replstate.xml 429 | 430 | # Crashlytics plugin (for Android Studio and IntelliJ) 431 | com_crashlytics_export_strings.xml 432 | crashlytics.properties 433 | crashlytics-build.properties 434 | fabric.properties 435 | 436 | # Editor-based Rest Client 437 | .idea/httpRequests 438 | 439 | # Android studio 3.1+ serialized cache file 440 | .idea/caches/build_file_checksums.ser 441 | 442 | ##### Eclipse 443 | .metadata 444 | bin/ 445 | tmp/ 446 | *.tmp 447 | *.bak 448 | *.swp 449 | *~.nib 450 | local.properties 451 | .settings/ 452 | .loadpath 453 | .recommenders 454 | 455 | # External tool builders 456 | .externalToolBuilders/ 457 | 458 | # Locally stored "Eclipse launch configurations" 459 | *.launch 460 | 461 | # PyDev specific (Python IDE for Eclipse) 462 | *.pydevproject 463 | 464 | # CDT-specific (C/C++ Development Tooling) 465 | .cproject 466 | 467 | # CDT- autotools 468 | .autotools 469 | 470 | # Java annotation processor (APT) 471 | .factorypath 472 | 473 | # PDT-specific (PHP Development Tools) 474 | .buildpath 475 | 476 | # sbteclipse plugin 477 | .target 478 | 479 | # Tern plugin 480 | .tern-project 481 | 482 | # TeXlipse plugin 483 | .texlipse 484 | 485 | # STS (Spring Tool Suite) 486 | .springBeans 487 | 488 | # Code Recommenders 489 | .recommenders/ 490 | 491 | # Annotation Processing 492 | .apt_generated/ 493 | .apt_generated_test/ 494 | 495 | # Scala IDE specific (Scala & Java development for Eclipse) 496 | .cache-main 497 | .scala_dependencies 498 | .worksheet 499 | 500 | # Uncomment this line if you wish to ignore the project description file. 501 | # Typically, this file would be tracked if it contains build/dependency configurations: 502 | #.project 503 | 504 | ##### Qt 505 | # C++ objects and libs 506 | *.slo 507 | *.lo 508 | *.o 509 | *.a 510 | *.la 511 | *.lai 512 | *.so 513 | *.so.* 514 | *.dll 515 | *.dylib 516 | 517 | # Qt-es 518 | object_script.*.Release 519 | object_script.*.Debug 520 | *_plugin_import.cpp 521 | /.qmake.cache 522 | /.qmake.stash 523 | *.pro.user 524 | *.pro.user.* 525 | *.qbs.user 526 | *.qbs.user.* 527 | *.moc 528 | moc_*.cpp 529 | moc_*.h 530 | qrc_*.cpp 531 | ui_*.h 532 | *.qmlc 533 | *.jsc 534 | Makefile* 535 | *build-* 536 | *.qm 537 | *.prl 538 | 539 | # Qt unit tests 540 | target_wrapper.* 541 | 542 | # QtCreator 543 | *.autosave 544 | 545 | # QtCreator Qml 546 | *.qmlproject.user 547 | *.qmlproject.user.* 548 | 549 | # QtCreator CMake 550 | CMakeLists.txt.user* 551 | 552 | # QtCreator 4.8< compilation database 553 | compile_commands.json 554 | 555 | # QtCreator local machine specific files for imported projects 556 | *creator.user* 557 | 558 | ##### VisualStudio 559 | ##### VisualStudio 560 | ## Ignore Visual Studio temporary files, build results, and 561 | ## files generated by popular Visual Studio add-ons. 562 | ## 563 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 564 | 565 | # User-specific files 566 | *.rsuser 567 | *.suo 568 | *.user 569 | *.userosscache 570 | *.sln.docstates 571 | 572 | # User-specific files (MonoDevelop/Xamarin Studio) 573 | *.userprefs 574 | 575 | # Mono auto generated files 576 | mono_crash.* 577 | 578 | # Build results 579 | [Dd]ebug/ 580 | [Dd]ebugPublic/ 581 | [Rr]elease/ 582 | [Rr]eleases/ 583 | x64/ 584 | x86/ 585 | [Ww][Ii][Nn]32/ 586 | [Aa][Rr][Mm]/ 587 | [Aa][Rr][Mm]64/ 588 | bld/ 589 | [Bb]in/ 590 | [Oo]bj/ 591 | [Ll]og/ 592 | [Ll]ogs/ 593 | 594 | # Visual Studio 2015/2017 cache/options directory 595 | .vs/ 596 | # Uncomment if you have tasks that create the project's static files in wwwroot 597 | #wwwroot/ 598 | 599 | # Visual Studio 2017 auto generated files 600 | Generated\ Files/ 601 | 602 | # MSTest test Results 603 | [Tt]est[Rr]esult*/ 604 | [Bb]uild[Ll]og.* 605 | 606 | # NUnit 607 | *.VisualState.xml 608 | TestResult.xml 609 | nunit-*.xml 610 | 611 | # Build Results of an ATL Project 612 | [Dd]ebugPS/ 613 | [Rr]eleasePS/ 614 | dlldata.c 615 | 616 | # Benchmark Results 617 | BenchmarkDotNet.Artifacts/ 618 | 619 | # .NET Core 620 | project.lock.json 621 | project.fragment.lock.json 622 | artifacts/ 623 | 624 | # ASP.NET Scaffolding 625 | ScaffoldingReadMe.txt 626 | 627 | # StyleCop 628 | StyleCopReport.xml 629 | 630 | # Files built by Visual Studio 631 | *_i.c 632 | *_p.c 633 | *_h.h 634 | *.ilk 635 | *.meta 636 | *.obj 637 | *.iobj 638 | *.pch 639 | *.pdb 640 | *.ipdb 641 | *.pgc 642 | *.pgd 643 | *.rsp 644 | *.sbr 645 | *.tlb 646 | *.tli 647 | *.tlh 648 | *.tmp 649 | *.tmp_proj 650 | *_wpftmp.csproj 651 | *.log 652 | *.vspscc 653 | *.vssscc 654 | .builds 655 | *.pidb 656 | *.svclog 657 | *.scc 658 | 659 | # Chutzpah Test files 660 | _Chutzpah* 661 | 662 | # Visual C++ cache files 663 | ipch/ 664 | *.aps 665 | *.ncb 666 | *.opendb 667 | *.opensdf 668 | *.sdf 669 | *.cachefile 670 | *.VC.db 671 | *.VC.VC.opendb 672 | 673 | # Visual Studio profiler 674 | *.psess 675 | *.vsp 676 | *.vspx 677 | *.sap 678 | 679 | # Visual Studio Trace Files 680 | *.e2e 681 | 682 | # TFS 2012 Local Workspace 683 | $tf/ 684 | 685 | # Guidance Automation Toolkit 686 | *.gpState 687 | 688 | # ReSharper is a .NET coding add-in 689 | _ReSharper*/ 690 | *.[Rr]e[Ss]harper 691 | *.DotSettings.user 692 | 693 | # TeamCity is a build add-in 694 | _TeamCity* 695 | 696 | # DotCover is a Code Coverage Tool 697 | *.dotCover 698 | 699 | # AxoCover is a Code Coverage Tool 700 | .axoCover/* 701 | !.axoCover/settings.json 702 | 703 | # Coverlet is a free, cross platform Code Coverage Tool 704 | coverage*[.json, .xml, .info] 705 | 706 | # Visual Studio code coverage results 707 | *.coverage 708 | *.coveragexml 709 | 710 | # NCrunch 711 | _NCrunch_* 712 | .*crunch*.local.xml 713 | nCrunchTemp_* 714 | 715 | # MightyMoose 716 | *.mm.* 717 | AutoTest.Net/ 718 | 719 | # Web workbench (sass) 720 | .sass-cache/ 721 | 722 | # Installshield output folder 723 | [Ee]xpress/ 724 | 725 | # DocProject is a documentation generator add-in 726 | DocProject/buildhelp/ 727 | DocProject/Help/*.HxT 728 | DocProject/Help/*.HxC 729 | DocProject/Help/*.hhc 730 | DocProject/Help/*.hhk 731 | DocProject/Help/*.hhp 732 | DocProject/Help/Html2 733 | DocProject/Help/html 734 | 735 | # Click-Once directory 736 | publish/ 737 | 738 | # Publish Web Output 739 | *.[Pp]ublish.xml 740 | *.azurePubxml 741 | # Note: Comment the next line if you want to checkin your web deploy settings, 742 | # but database connection strings (with potential passwords) will be unencrypted 743 | *.pubxml 744 | *.publishproj 745 | 746 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 747 | # checkin your Azure Web App publish settings, but sensitive information contained 748 | # in these scripts will be unencrypted 749 | PublishScripts/ 750 | 751 | # NuGet Packages 752 | *.nupkg 753 | # NuGet Symbol Packages 754 | *.snupkg 755 | # The packages folder can be ignored because of Package Restore 756 | **/[Pp]ackages/* 757 | # except build/, which is used as an MSBuild target. 758 | !**/[Pp]ackages/build/ 759 | # Uncomment if necessary however generally it will be regenerated when needed 760 | #!**/[Pp]ackages/repositories.config 761 | # NuGet v3's project.json files produces more ignorable files 762 | *.nuget.props 763 | *.nuget.targets 764 | 765 | # Microsoft Azure Build Output 766 | csx/ 767 | *.build.csdef 768 | 769 | # Microsoft Azure Emulator 770 | ecf/ 771 | rcf/ 772 | 773 | # Windows Store app package directories and files 774 | AppPackages/ 775 | BundleArtifacts/ 776 | Package.StoreAssociation.xml 777 | _pkginfo.txt 778 | *.appx 779 | *.appxbundle 780 | *.appxupload 781 | 782 | # Visual Studio cache files 783 | # files ending in .cache can be ignored 784 | *.[Cc]ache 785 | # but keep track of directories ending in .cache 786 | !?*.[Cc]ache/ 787 | 788 | # Others 789 | ClientBin/ 790 | ~$* 791 | *~ 792 | *.dbmdl 793 | *.dbproj.schemaview 794 | *.jfm 795 | *.pfx 796 | *.publishsettings 797 | orleans.codegen.cs 798 | 799 | # Including strong name files can present a security risk 800 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 801 | #*.snk 802 | 803 | # Since there are multiple workflows, uncomment next line to ignore bower_components 804 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 805 | #bower_components/ 806 | 807 | # RIA/Silverlight projects 808 | Generated_Code/ 809 | 810 | # Backup & report files from converting an old project file 811 | # to a newer Visual Studio version. Backup files are not needed, 812 | # because we have git ;-) 813 | _UpgradeReport_Files/ 814 | Backup*/ 815 | UpgradeLog*.XML 816 | UpgradeLog*.htm 817 | ServiceFabricBackup/ 818 | *.rptproj.bak 819 | 820 | # SQL Server files 821 | *.mdf 822 | *.ldf 823 | *.ndf 824 | 825 | # Business Intelligence projects 826 | *.rdl.data 827 | *.bim.layout 828 | *.bim_*.settings 829 | *.rptproj.rsuser 830 | *- [Bb]ackup.rdl 831 | *- [Bb]ackup ([0-9]).rdl 832 | *- [Bb]ackup ([0-9][0-9]).rdl 833 | 834 | # Microsoft Fakes 835 | FakesAssemblies/ 836 | 837 | # GhostDoc plugin setting file 838 | *.GhostDoc.xml 839 | 840 | # Node.js Tools for Visual Studio 841 | .ntvs_analysis.dat 842 | node_modules/ 843 | 844 | # Visual Studio 6 build log 845 | *.plg 846 | 847 | # Visual Studio 6 workspace options file 848 | *.opt 849 | 850 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 851 | *.vbw 852 | 853 | # Visual Studio LightSwitch build output 854 | **/*.HTMLClient/GeneratedArtifacts 855 | **/*.DesktopClient/GeneratedArtifacts 856 | **/*.DesktopClient/ModelManifest.xml 857 | **/*.Server/GeneratedArtifacts 858 | **/*.Server/ModelManifest.xml 859 | _Pvt_Extensions 860 | 861 | # Paket dependency manager 862 | .paket/paket.exe 863 | paket-files/ 864 | 865 | # FAKE - F# Make 866 | .fake/ 867 | 868 | # CodeRush personal settings 869 | .cr/personal 870 | 871 | # Python Tools for Visual Studio (PTVS) 872 | __pycache__/ 873 | *.pyc 874 | 875 | # Cake - Uncomment if you are using it 876 | # tools/** 877 | # !tools/packages.config 878 | 879 | # Tabs Studio 880 | *.tss 881 | 882 | # Telerik's JustMock configuration file 883 | *.jmconfig 884 | 885 | # BizTalk build output 886 | *.btp.cs 887 | *.btm.cs 888 | *.odx.cs 889 | *.xsd.cs 890 | 891 | # OpenCover UI analysis results 892 | OpenCover/ 893 | 894 | # Azure Stream Analytics local run output 895 | ASALocalRun/ 896 | 897 | # MSBuild Binary and Structured Log 898 | *.binlog 899 | 900 | # NVidia Nsight GPU debugger configuration file 901 | *.nvuser 902 | 903 | # MFractors (Xamarin productivity tool) working folder 904 | .mfractor/ 905 | 906 | # Local History for Visual Studio 907 | .localhistory/ 908 | 909 | # BeatPulse healthcheck temp database 910 | healthchecksdb 911 | 912 | # Backup folder for Package Reference Convert tool in Visual Studio 2017 913 | MigrationBackup/ 914 | 915 | # Ionide (cross platform F# VS Code tools) working folder 916 | .ionide/ 917 | 918 | # Fody - auto-generated XML schema 919 | FodyWeavers.xsd 920 | 921 | ##### Gradle 922 | .gradle 923 | **/build/ 924 | !src/**/build/ 925 | 926 | # Ignore Gradle GUI config 927 | gradle-app.setting 928 | 929 | # Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored) 930 | !gradle-wrapper.jar 931 | 932 | # Cache of project 933 | .gradletasknamecache 934 | 935 | # # Work around https://youtrack.jetbrains.com/issue/IDEA-116898 936 | # gradle/wrapper/gradle-wrapper.properties 937 | 938 | ##### CMake 939 | CMakeLists.txt.user 940 | CMakeCache.txt 941 | CMakeFiles 942 | CMakeScripts 943 | Testing 944 | Makefile 945 | cmake_install.cmake 946 | install_manifest.txt 947 | compile_commands.json 948 | CTestTestfile.cmake 949 | _deps 950 | 951 | ##### C++ 952 | # Prerequisites 953 | *.d 954 | 955 | # Compiled Object files 956 | *.slo 957 | *.lo 958 | *.o 959 | *.obj 960 | 961 | # Precompiled Headers 962 | *.gch 963 | *.pch 964 | 965 | # Compiled Dynamic libraries 966 | *.so 967 | *.dylib 968 | *.dll 969 | 970 | # Fortran module files 971 | *.mod 972 | *.smod 973 | 974 | # Compiled Static libraries 975 | *.lai 976 | *.la 977 | *.a 978 | *.lib 979 | 980 | # Executables 981 | *.exe 982 | *.out 983 | *.app 984 | 985 | # C/C++ binary extension file 986 | *.bin 987 | 988 | ##### C 989 | # Prerequisites 990 | *.d 991 | 992 | # Object files 993 | *.o 994 | *.ko 995 | *.obj 996 | *.elf 997 | 998 | # Linker output 999 | *.ilk 1000 | *.map 1001 | *.exp 1002 | 1003 | # Precompiled Headers 1004 | *.gch 1005 | *.pch 1006 | 1007 | # Libraries 1008 | *.lib 1009 | *.a 1010 | *.la 1011 | *.lo 1012 | 1013 | # Shared objects (inc. Windows DLLs) 1014 | *.dll 1015 | *.so 1016 | *.so.* 1017 | *.dylib 1018 | 1019 | # Executables 1020 | *.exe 1021 | *.out 1022 | *.app 1023 | *.i*86 1024 | *.x86_64 1025 | *.hex 1026 | 1027 | # Debug files 1028 | *.dSYM/ 1029 | *.su 1030 | *.idb 1031 | *.pdb 1032 | 1033 | # Kernel Module Compile Results 1034 | *.mod* 1035 | *.cmd 1036 | .tmp_versions/ 1037 | modules.order 1038 | Module.symvers 1039 | Mkfile.old 1040 | dkms.conf 1041 | 1042 | # Raspberry Pi Pico Object file 1043 | *.uf2 1044 | # Raspberry Pi Pico disassembler file 1045 | *.dis 1046 | 1047 | # JetBrains IDE 1048 | .idea/ 1049 | 1050 | # Build directories 1051 | bin/ 1052 | -------------------------------------------------------------------------------- /src/decrypt_chunk.hpp: -------------------------------------------------------------------------------- 1 | using _BYTE = unsigned char; 2 | 3 | inline unsigned char __ROR1__(unsigned char value, int shift) 4 | { 5 | shift &= 7; 6 | return (value >> shift) | (value << (8 - shift)); 7 | } 8 | 9 | // In IDA start finding from il2cpp::vm::GlobalMetadata::Initialize 10 | // 11 | // char __fastcall il2cpp::vm::GlobalMetadata::Initialize(_DWORD *imagesCount, _DWORD *assembliesCount) 12 | // { 13 | // ... 14 | // ... 15 | // 16 | // MetadataFile = vm::MetadataLoader::LoadMetadataFile("global-metadata.dat"); 17 | // s_GlobalMetadata = MetadataFile; 18 | // if ( !MetadataFile ) 19 | // return 0; 20 | // v5 = 0; 21 | // v16 = 0LL; 22 | // if ( !(unsigned __int8)sub_1806CF800(MetadataFile, &v16) )// <----- decryption step 23 | void __fastcall DecryptChunk(const unsigned char* a1, size_t a2, const unsigned char* a3, unsigned char* a4, size_t a5) 24 | { 25 | __int64 v9; // rsi 26 | unsigned int v10; // edx 27 | unsigned int v11; // eax 28 | unsigned int v12; // edx 29 | unsigned int v13; // eax 30 | __int64 v14; // r9 31 | __int64 v15; // rdx 32 | char v16; // r8 33 | __int64 v17; // rcx 34 | 35 | if (a5) 36 | { 37 | v9 = 0LL; 38 | if (a2) 39 | { 40 | while (2) 41 | { 42 | switch (*(_BYTE*)(v9 + a1)) 43 | { 44 | case 0: 45 | *(_BYTE*)(0xB330B7AF % a5 + a4) = __ROR1__(*(_BYTE*)(0xB330B7AF % a5 + a4), (a3[182] + 1) & 7); 46 | goto LABEL_263; 47 | case 1: 48 | *(_BYTE*)(0xFE6BF3B6 % a5 + a4) = *(_BYTE*)(0xFE6BF3B6 % a5 + a4) - a3[161] + 32; 49 | goto LABEL_263; 50 | case 2: 51 | *(_BYTE*)(0x8CC11BA1 % a5 + a4) ^= a3[224] ^ 0x23; 52 | goto LABEL_263; 53 | case 3: 54 | *(_BYTE*)(0xF81D0FE0 % a5 + a4) = *(_BYTE*)(0xF81D0FE0 % a5 + a4) - a3[35] - 90; 55 | goto LABEL_263; 56 | case 4: 57 | *(_BYTE*)(0xFFA6EF23 % a5 + a4) = *(_BYTE*)(0xFFA6EF23 % a5 + a4) - a3[90] + 75; 58 | goto LABEL_263; 59 | case 5: 60 | *(_BYTE*)(0x26201D5A % a5 + a4) = *(_BYTE*)(0x26201D5A % a5 + a4) - a3[181] + 92; 61 | goto LABEL_263; 62 | case 6: 63 | *(_BYTE*)(0x6DA02EB5 % a5 + a4) ^= a3[164] ^ 0xD7; 64 | goto LABEL_263; 65 | case 7: 66 | *(_BYTE*)(0xCFCD26A4 % a5 + a4) = __ROR1__(*(_BYTE*)(0xCFCD26A4 % a5 + a4), (a3[215] - 2) & 7); 67 | goto LABEL_263; 68 | case 8: 69 | *(_BYTE*)(0x82EEBAD7 % a5 + a4) = *(_BYTE*)(0x82EEBAD7 % a5 + a4) - a3[62] - 9; 70 | goto LABEL_263; 71 | case 9: 72 | *(_BYTE*)(0x11808A3E % a5 + a4) = __ROR1__(*(_BYTE*)(0x11808A3E % a5 + a4), a3[9] & 7); 73 | goto LABEL_263; 74 | case 0xA: 75 | *(_BYTE*)(0x8F177809 % a5 + a4) = __ROR1__(*(_BYTE*)(0x8F177809 % a5 + a4), (a3[168] + 3) & 7); 76 | goto LABEL_263; 77 | case 0xB: 78 | *(_BYTE*)(0xF6DD9AA8 % a5 + a4) ^= a3[203] ^ 0x62; 79 | goto LABEL_263; 80 | case 0xC: 81 | *(_BYTE*)(0xC89A6ECB % a5 + a4) ^= a3[98] ^ 0x9D; 82 | goto LABEL_263; 83 | case 0xD: 84 | *(_BYTE*)(0xF8263E62 % a5 + a4) = __ROR1__(*(_BYTE*)(0xF8263E62 % a5 + a4), (a3[157] - 4) & 7); 85 | goto LABEL_263; 86 | case 0xE: 87 | v10 = 0xFB6BEB9D % a5; 88 | v11 = (unsigned __int8)a3[236] + 1614192383; 89 | goto LABEL_261; 90 | case 0xF: 91 | *(_BYTE*)(0x7B4F8FEC % a5 + a4) = *(_BYTE*)(0x7B4F8FEC % a5 + a4) - a3[255] + 58; 92 | goto LABEL_263; 93 | case 0x10: 94 | *(_BYTE*)(0x60369EFF % a5 + a4) ^= a3[198] ^ 0x71; 95 | goto LABEL_263; 96 | case 0x11: 97 | *(_BYTE*)(0x3EBB7DC6 % a5 + a4) = *(_BYTE*)(0x3EBB7DC6 % a5 + a4) - a3[113] - 112; 98 | goto LABEL_263; 99 | case 0x12: 100 | v12 = 0x8AAEBD71 % a5; 101 | v13 = (unsigned __int8)a3[112] + 259923827; 102 | goto LABEL_23; 103 | case 0x13: 104 | v10 = 0x2BF6A70 % a5; 105 | v11 = (unsigned __int8)a3[115] - 1335899030; 106 | goto LABEL_261; 107 | case 0x14: 108 | *(_BYTE*)(0xF7E1F73 % a5 + a4) = __ROR1__(*(_BYTE*)(0xF7E1F73 % a5 + a4), (a3[106] - 3) & 7); 109 | goto LABEL_263; 110 | case 0x15: 111 | *(_BYTE*)(0xB05FCC6A % a5 + a4) = *(_BYTE*)(0xB05FCC6A % a5 + a4) - a3[133] - 52; 112 | goto LABEL_263; 113 | case 0x16: 114 | v10 = 0xC6916185 % a5; 115 | v11 = (unsigned __int8)a3[52] - 187825113; 116 | goto LABEL_261; 117 | case 0x17: 118 | *(_BYTE*)(0x6EE8CE34 % a5 + a4) = *(_BYTE*)(0x6EE8CE34 % a5 + a4) - a3[39] - 78; 119 | goto LABEL_263; 120 | case 0x18: 121 | v12 = 0xF4CE0427 % a5; 122 | v13 = (unsigned __int8)a3[78] + 1081707481; 123 | goto LABEL_23; 124 | case 0x19: 125 | *(_BYTE*)(0xE74BEE4E % a5 + a4) ^= a3[217] ^ 0x38; 126 | goto LABEL_263; 127 | case 0x1A: 128 | v12 = 0x40798BD9 % a5; 129 | v13 = (unsigned __int8)a3[56] - 1378246373; 130 | goto LABEL_23; 131 | case 0x1B: 132 | v10 = 0x2B6A9F38 % a5; 133 | v11 = (unsigned __int8)a3[27] - 1464473742; 134 | goto LABEL_261; 135 | case 0x1C: 136 | *(_BYTE*)(0xADD9A11B % a5 + a4) = *(_BYTE*)(0xADD9A11B % a5 + a4) - a3[114] - 109; 137 | goto LABEL_263; 138 | case 0x1D: 139 | *(_BYTE*)(0xA8B5E772 % a5 + a4) = __ROR1__(*(_BYTE*)(0xA8B5E772 % a5 + a4), (a3[109] - 4) & 7); 140 | goto LABEL_263; 141 | case 0x1E: 142 | v12 = 0xDD5306D % a5; 143 | v13 = (unsigned __int8)a3[124] - 694252977; 144 | goto LABEL_23; 145 | case 0x1F: 146 | *(_BYTE*)(0x8CB017C % a5 + a4) = __ROR1__(*(_BYTE*)(0x8CB017C % a5 + a4), (a3[79] - 2) & 7); 147 | goto LABEL_263; 148 | case 0x20: 149 | v12 = 0xD69E8A4F % a5; 150 | v13 = (unsigned __int8)a3[214] + 1588495169; 151 | goto LABEL_23; 152 | case 0x21: 153 | *(_BYTE*)(0x37F4FBD6 % a5 + a4) -= a3[65]; 154 | goto LABEL_263; 155 | case 0x22: 156 | *(_BYTE*)(0x5EAE8341 % a5 + a4) = __ROR1__(*(_BYTE*)(0x5EAE8341 % a5 + a4), (*a3 + 3) & 7); 157 | goto LABEL_263; 158 | case 0x23: 159 | *(_BYTE*)(0xC8BB5900 % a5 + a4) = __ROR1__(*(_BYTE*)(0xC8BB5900 % a5 + a4), (a3[195] + 2) & 7); 160 | goto LABEL_263; 161 | case 0x24: 162 | *(_BYTE*)(0x749893C3 % a5 + a4) = __ROR1__(*(_BYTE*)(0x749893C3 % a5 + a4), (a3[122] - 3) & 7); 163 | goto LABEL_263; 164 | case 0x25: 165 | *(_BYTE*)(0xE4E5AF7A % a5 + a4) = *(_BYTE*)(0xE4E5AF7A % a5 + a4) - a3[85] + 60; 166 | goto LABEL_263; 167 | case 0x26: 168 | *(_BYTE*)(0x627FF855 % a5 + a4) ^= a3[196] ^ 0x77; 169 | goto LABEL_263; 170 | case 0x27: 171 | *(_BYTE*)(0xBF9C49C4 % a5 + a4) = __ROR1__(*(_BYTE*)(0xBF9C49C4 % a5 + a4), (a3[119] - 2) & 7); 172 | goto LABEL_263; 173 | case 0x28: 174 | v12 = 0x2235D177 % a5; 175 | v13 = (unsigned __int8)a3[94] - 280476759; 176 | goto LABEL_23; 177 | case 0x29: 178 | *(_BYTE*)(0x598DC65E % a5 + a4) = *(_BYTE*)(0x598DC65E % a5 + a4) - a3[169] + 56; 179 | goto LABEL_263; 180 | case 0x2A: 181 | *(_BYTE*)(0xEF4843A9 % a5 + a4) ^= a3[200] ^ 0x6B; 182 | goto LABEL_263; 183 | case 0x2B: 184 | v10 = 0x2F41B7C8 % a5; 185 | v11 = (unsigned __int8)a3[107] + 1795179650; 186 | goto LABEL_261; 187 | case 0x2C: 188 | v10 = 0xE8A976B % a5; 189 | v11 = (unsigned __int8)a3[130] - 1629595331; 190 | goto LABEL_261; 191 | case 0x2D: 192 | *(_BYTE*)(0x6B004482 % a5 + a4) ^= a3[61] ^ 0xC; 193 | goto LABEL_263; 194 | case 0x2E: 195 | *(_BYTE*)(0x9EDE593D % a5 + a4) ^= a3[12] ^ 0x9F; 196 | goto LABEL_263; 197 | case 0x2F: 198 | *(_BYTE*)(0x3EF6C70C % a5 + a4) ^= a3[159] ^ 0xE6; 199 | goto LABEL_263; 200 | case 0x30: 201 | *(_BYTE*)(0x2545799F % a5 + a4) ^= a3[230] ^ 0x11; 202 | goto LABEL_263; 203 | case 0x31: 204 | *(_BYTE*)(0x71816DE6 % a5 + a4) = __ROR1__(*(_BYTE*)(0x71816DE6 % a5 + a4), a3[17] & 7); 205 | goto LABEL_263; 206 | case 0x32: 207 | *(_BYTE*)(0x56856D11 % a5 + a4) = *(_BYTE*)(0x56856D11 % a5 + a4) - a3[144] - 19; 208 | goto LABEL_263; 209 | case 0x33: 210 | *(_BYTE*)(0xB4C1DB90 % a5 + a4) = *(_BYTE*)(0xB4C1DB90 % a5 + a4) - a3[19] + 118; 211 | goto LABEL_263; 212 | case 0x34: 213 | *(_BYTE*)(0xF2E34C13 % a5 + a4) ^= a3[138] ^ 0x25; 214 | goto LABEL_263; 215 | case 0x35: 216 | *(_BYTE*)(0x6BEAC68A % a5 + a4) = *(_BYTE*)(0x6BEAC68A % a5 + a4) - a3[37] - 84; 217 | goto LABEL_263; 218 | case 0x36: 219 | *(_BYTE*)(0x6CC0F325 % a5 + a4) = __ROR1__(*(_BYTE*)(0x6CC0F325 % a5 + a4), (a3[84] - 1) & 7); 220 | goto LABEL_263; 221 | case 0x37: 222 | v10 = 0xD3E89954 % a5; 223 | v11 = (unsigned __int8)a3[199] + 1917784686; 224 | goto LABEL_261; 225 | case 0x38: 226 | *(_BYTE*)(0x192322C7 % a5 + a4) ^= a3[110] ^ 0x79; 227 | goto LABEL_263; 228 | case 0x39: 229 | *(_BYTE*)(0x724F126E % a5 + a4) ^= a3[121] ^ 0x58; 230 | goto LABEL_263; 231 | case 0x3A: 232 | v12 = 0xE1689F79 % a5; 233 | v13 = (unsigned __int8)a3[88] + 1740263867; 234 | goto LABEL_23; 235 | case 0x3B: 236 | *(_BYTE*)(0x4B3E458 % a5 + a4) = *(_BYTE*)(0x4B3E458 % a5 + a4) - a3[187] + 110; 237 | goto LABEL_263; 238 | case 0x3C: 239 | *(_BYTE*)(0x67BA51BB % a5 + a4) = __ROR1__(*(_BYTE*)(0x67BA51BB % a5 + a4), (a3[146] - 3) & 7); 240 | goto LABEL_263; 241 | case 0x3D: 242 | *(_BYTE*)(0x3BDE5592 % a5 + a4) = __ROR1__(*(_BYTE*)(0x3BDE5592 % a5 + a4), (a3[13] - 4) & 7); 243 | goto LABEL_263; 244 | case 0x3E: 245 | v10 = 0x5BFC660D % a5; 246 | v11 = (unsigned __int8)a3[156] - 314020625; 247 | goto LABEL_261; 248 | case 0x3F: 249 | v10 = 0x2973E09C % a5; 250 | v11 = (unsigned __int8)a3[239] - 1140206602; 251 | goto LABEL_261; 252 | case 0x40: 253 | v12 = 0xED486CEF % a5; 254 | v13 = (unsigned __int8)a3[246] - 466060575; 255 | goto LABEL_23; 256 | case 0x41: 257 | *(_BYTE*)(0xBC09D3F6 % a5 + a4) = *(_BYTE*)(0xBC09D3F6 % a5 + a4) - a3[225] - 32; 258 | goto LABEL_263; 259 | case 0x42: 260 | *(_BYTE*)(0xE4387AE1 % a5 + a4) = *(_BYTE*)(0xE4387AE1 % a5 + a4) - a3[32] - 99; 261 | goto LABEL_263; 262 | case 0x43: 263 | *(_BYTE*)(0xC4C3F220 % a5 + a4) = __ROR1__(*(_BYTE*)(0xC4C3F220 % a5 + a4), (a3[99] + 2) & 7); 264 | goto LABEL_263; 265 | case 0x44: 266 | *(_BYTE*)(0x948B4863 % a5 + a4) = *(_BYTE*)(0x948B4863 % a5 + a4) - a3[154] + 11; 267 | goto LABEL_263; 268 | case 0x45: 269 | *(_BYTE*)(0x1AE8119A % a5 + a4) ^= a3[245] ^ 0xE4; 270 | goto LABEL_263; 271 | case 0x46: 272 | v12 = 0x88E951F5 % a5; 273 | v13 = (unsigned __int8)a3[228] + 567474199; 274 | goto LABEL_23; 275 | case 0x47: 276 | *(_BYTE*)(0x550EBCE4 % a5 + a4) = __ROR1__(*(_BYTE*)(0x550EBCE4 % a5 + a4), (a3[23] - 2) & 7); 277 | goto LABEL_263; 278 | case 0x48: 279 | *(_BYTE*)(0x21D2F817 % a5 + a4) ^= a3[126] ^ 0x49; 280 | goto LABEL_263; 281 | case 0x49: 282 | *(_BYTE*)(0x8CD8D27E % a5 + a4) ^= a3[73] ^ 0xE8; 283 | goto LABEL_263; 284 | case 0x4A: 285 | *(_BYTE*)(0x68FF9F49 % a5 + a4) = __ROR1__(*(_BYTE*)(0x68FF9F49 % a5 + a4), (a3[232] + 3) & 7); 286 | goto LABEL_263; 287 | case 0x4B: 288 | v10 = 0x895224E8 % a5; 289 | v11 = (unsigned __int8)a3[11] - 848749918; 290 | goto LABEL_261; 291 | case 0x4C: 292 | *(_BYTE*)(0xA4B5D00B % a5 + a4) = *(_BYTE*)(0xA4B5D00B % a5 + a4) - a3[162] + 35; 293 | goto LABEL_263; 294 | case 0x4D: 295 | v10 = 0xCD691AA2 % a5; 296 | v11 = (unsigned __int8)a3[221] + 857951788; 297 | goto LABEL_261; 298 | case 0x4E: 299 | *(_BYTE*)(0xD2E456DD % a5 + a4) = __ROR1__(*(_BYTE*)(0xD2E456DD % a5 + a4), (a3[44] - 1) & 7); 300 | goto LABEL_263; 301 | case 0x4F: 302 | v12 = 0x33234E2C % a5; 303 | v13 = (unsigned __int8)a3[63] + 1098329606; 304 | goto LABEL_23; 305 | case 0x50: 306 | *(_BYTE*)(0xB204643F % a5 + a4) ^= a3[6] ^ 0xB1; 307 | goto LABEL_263; 308 | case 0x51: 309 | v12 = 0x41772E06 % a5; 310 | v13 = (unsigned __int8)a3[177] + 435330224; 311 | goto LABEL_23; 312 | case 0x52: 313 | *(_BYTE*)(0x6E0CACB1 % a5 + a4) ^= a3[176] ^ 0xB3; 314 | goto LABEL_263; 315 | case 0x53: 316 | *(_BYTE*)(0x19F29CB0 % a5 + a4) = *(_BYTE*)(0x19F29CB0 % a5 + a4) - a3[179] + 86; 317 | goto LABEL_263; 318 | case 0x54: 319 | *(_BYTE*)(0xF9FD88B3 % a5 + a4) = *(_BYTE*)(0xF9FD88B3 % a5 + a4) - a3[170] + 59; 320 | goto LABEL_263; 321 | case 0x55: 322 | *(_BYTE*)(0x49690AA % a5 + a4) = __ROR1__(*(_BYTE*)(0x49690AA % a5 + a4), (a3[197] - 4) & 7); 323 | goto LABEL_263; 324 | case 0x56: 325 | v10 = 0xA2CE14C5 % a5; 326 | v11 = (unsigned __int8)a3[116] + 247615847; 327 | goto LABEL_261; 328 | case 0x57: 329 | v12 = 0x138FB474 % a5; 330 | v13 = (unsigned __int8)a3[103] + 1706296974; 331 | goto LABEL_23; 332 | case 0x58: 333 | *(_BYTE*)(0xEC25167 % a5 + a4) ^= a3[142] ^ 0x19; 334 | goto LABEL_263; 335 | case 0x59: 336 | v12 = 0x65B4068E % a5; 337 | v13 = (unsigned __int8)a3[25] + 99449208; 338 | goto LABEL_23; 339 | case 0x5A: 340 | v10 = 0xB4724319 % a5; 341 | v11 = (unsigned __int8)a3[120] + 1862931035; 342 | goto LABEL_261; 343 | case 0x5B: 344 | *(_BYTE*)(0x5ED7978 % a5 + a4) = __ROR1__(*(_BYTE*)(0x5ED7978 % a5 + a4), (a3[91] + 2) & 7); 345 | goto LABEL_263; 346 | case 0x5C: 347 | *(_BYTE*)(0x6F0A125B % a5 + a4) = *(_BYTE*)(0x6F0A125B % a5 + a4) - a3[178] + 83; 348 | goto LABEL_263; 349 | case 0x5D: 350 | v12 = 0x96F993B2 % a5; 351 | v13 = (unsigned __int8)a3[173] - 1239019588; 352 | goto LABEL_23; 353 | case 0x5E: 354 | *(_BYTE*)(0x418B2BAD % a5 + a4) ^= a3[188] ^ 0x8F; 355 | goto LABEL_263; 356 | case 0x5F: 357 | *(_BYTE*)(0xB6260FBC % a5 + a4) = __ROR1__(*(_BYTE*)(0xB6260FBC % a5 + a4), (a3[143] - 2) & 7); 358 | goto LABEL_263; 359 | case 0x60: 360 | *(_BYTE*)(0x29165F8F % a5 + a4) ^= a3[22] ^ 0x81; 361 | goto LABEL_263; 362 | case 0x61: 363 | v12 = 0x94F27C16 % a5; 364 | v13 = (unsigned __int8)a3[129] - 2000757952; 365 | goto LABEL_23; 366 | case 0x62: 367 | *(_BYTE*)(0x1E870281 % a5 + a4) = *(_BYTE*)(0x1E870281 % a5 + a4) - a3[64] - 3; 368 | goto LABEL_263; 369 | case 0x63: 370 | *(_BYTE*)(0x88BEDB40 % a5 + a4) = *(_BYTE*)(0x88BEDB40 % a5 + a4) - a3[3] + 70; 371 | goto LABEL_263; 372 | case 0x64: 373 | *(_BYTE*)(0xA9E70D03 % a5 + a4) = *(_BYTE*)(0xA9E70D03 % a5 + a4) - a3[186] + 107; 374 | goto LABEL_263; 375 | case 0x65: 376 | *(_BYTE*)(0x88EF43BA % a5 + a4) = __ROR1__(*(_BYTE*)(0x88EF43BA % a5 + a4), (a3[149] - 4) & 7); 377 | goto LABEL_263; 378 | case 0x66: 379 | *(_BYTE*)(0xBE843B95 % a5 + a4) = *(_BYTE*)(0xBE843B95 % a5 + a4) - a3[4] + 73; 380 | goto LABEL_263; 381 | case 0x67: 382 | v12 = 0x972C8004 % a5; 383 | v13 = (unsigned __int8)a3[183] + 715763358; 384 | goto LABEL_23; 385 | case 0x68: 386 | *(_BYTE*)(0x8CAE2EB7 % a5 + a4) ^= a3[158] ^ 0xE9; 387 | goto LABEL_263; 388 | case 0x69: 389 | v10 = 0x2AA9AE9E % a5; 390 | v11 = (unsigned __int8)a3[233] - 1097407992; 391 | goto LABEL_261; 392 | case 0x6A: 393 | v12 = 0x9E658AE9 % a5; 394 | v13 = (unsigned __int8)a3[8] + 2122586283; 395 | goto LABEL_23; 396 | case 0x6B: 397 | v12 = 0xBE96E208 % a5; 398 | v13 = (unsigned __int8)a3[171] - 450314046; 399 | goto LABEL_23; 400 | case 0x6C: 401 | *(_BYTE*)(0x7E8418AB % a5 + a4) ^= a3[194] ^ 0x7D; 402 | goto LABEL_263; 403 | case 0x6D: 404 | *(_BYTE*)(0xE528C0C2 % a5 + a4) = __ROR1__(*(_BYTE*)(0xE528C0C2 % a5 + a4), (a3[125] - 4) & 7); 405 | goto LABEL_263; 406 | case 0x6E: 407 | v12 = 0x6625E47D % a5; 408 | v13 = (unsigned __int8)a3[76] - 1973723425; 409 | goto LABEL_23; 410 | case 0x6F: 411 | *(_BYTE*)(0x8BDD254C % a5 + a4) ^= a3[223] ^ 0x26; 412 | goto LABEL_263; 413 | case 0x70: 414 | v10 = 0x8A5B5EDF % a5; 415 | v11 = (unsigned __int8)a3[38] - 1267958703; 416 | goto LABEL_261; 417 | case 0x71: 418 | v12 = 0xC2E4BE26 % a5; 419 | v13 = (unsigned __int8)a3[81] + 685354448; 420 | goto LABEL_23; 421 | case 0x72: 422 | *(_BYTE*)(0xB46C7C51 % a5 + a4) = *(_BYTE*)(0xB46C7C51 % a5 + a4) - a3[208] - 83; 423 | goto LABEL_263; 424 | case 0x73: 425 | *(_BYTE*)(0x28D9ADD0 % a5 + a4) ^= a3[83] ^ 0xCA; 426 | goto LABEL_263; 427 | case 0x74: 428 | v12 = 0x6134D553 % a5; 429 | v13 = (unsigned __int8)a3[202] - 933181851; 430 | goto LABEL_23; 431 | case 0x75: 432 | v12 = 0x652B2ACA % a5; 433 | v13 = (unsigned __int8)a3[101] - 1360650348; 434 | goto LABEL_23; 435 | case 0x76: 436 | *(_BYTE*)(0xC860C665 % a5 + a4) ^= a3[148] ^ 7; 437 | goto LABEL_263; 438 | case 0x77: 439 | v12 = 0xAEE61F94 % a5; 440 | v13 = (unsigned __int8)a3[7] - 1966945618; 441 | goto LABEL_23; 442 | case 0x78: 443 | *(_BYTE*)(0x72939007 % a5 + a4) ^= a3[174] ^ 0xB9; 444 | goto LABEL_263; 445 | case 0x79: 446 | v12 = 0x8AC2CAAE % a5; 447 | v13 = (unsigned __int8)a3[185] - 2103484776; 448 | goto LABEL_23; 449 | case 0x7A: 450 | v10 = 0x7DBE76B9 % a5; 451 | v11 = (unsigned __int8)a3[152] - 382672133; 452 | goto LABEL_261; 453 | case 0x7B: 454 | v12 = 0x829F5E98 % a5; 455 | v13 = (unsigned __int8)a3[251] - 372268590; 456 | goto LABEL_23; 457 | case 0x7C: 458 | v12 = 0xE930E2FB % a5; 459 | v13 = (unsigned __int8)a3[210] + 1328120141; 460 | goto LABEL_23; 461 | case 0x7D: 462 | *(_BYTE*)(0xE9CFA1D2 % a5 + a4) ^= a3[77] ^ 0xDC; 463 | goto LABEL_263; 464 | case 0x7E: 465 | v12 = 0x4F29814D % a5; 466 | v13 = (unsigned __int8)a3[220] - 537894353; 467 | goto LABEL_23; 468 | case 0x7F: 469 | *(_BYTE*)(0x9CE98EDC % a5 + a4) = *(_BYTE*)(0x9CE98EDC % a5 + a4) - a3[47] - 54; 470 | goto LABEL_263; 471 | case 0x80: 472 | *(_BYTE*)(0xDFF0622F % a5 + a4) = *(_BYTE*)(0xDFF0622F % a5 + a4) - a3[54] - 33; 473 | goto LABEL_263; 474 | case 0x81: 475 | *(_BYTE*)(0x60F6F436 % a5 + a4) = *(_BYTE*)(0x60F6F436 % a5 + a4) - a3[33] - 96; 476 | goto LABEL_263; 477 | case 0x82: 478 | v12 = 0x52C21A21 % a5; 479 | v13 = (unsigned __int8)a3[96] + 1662247331; 480 | goto LABEL_23; 481 | case 0x83: 482 | *(_BYTE*)(0xE5341460 % a5 + a4) ^= a3[163] ^ 0xDA; 483 | goto LABEL_263; 484 | case 0x84: 485 | *(_BYTE*)(0x6313E1A3 % a5 + a4) ^= a3[218] ^ 0x35; 486 | goto LABEL_263; 487 | case 0x85: 488 | v10 = 0xC3C345DA % a5; 489 | v11 = (unsigned __int8)a3[53] + 16618276; 490 | goto LABEL_261; 491 | case 0x86: 492 | *(_BYTE*)(0x64F8B535 % a5 + a4) = *(_BYTE*)(0x64F8B535 % a5 + a4) - a3[36] - 87; 493 | goto LABEL_263; 494 | case 0x87: 495 | v10 = 0xFD9324 % a5; 496 | v11 = (unsigned __int8)a3[87] - 968336706; 497 | goto LABEL_261; 498 | case 0x88: 499 | v10 = 0x11AF7557 % a5; 500 | v11 = (unsigned __int8)a3[190] - 173930871; 501 | goto LABEL_261; 502 | case 0x89: 503 | *(_BYTE*)(0xC6485ABE % a5 + a4) = *(_BYTE*)(0xC6485ABE % a5 + a4) - a3[137] - 40; 504 | goto LABEL_263; 505 | case 0x8A: 506 | *(_BYTE*)(0xF5A20689 % a5 + a4) = *(_BYTE*)(0xF5A20689 % a5 + a4) - a3[40] - 75; 507 | goto LABEL_263; 508 | case 0x8B: 509 | *(_BYTE*)(0x3C97EF28 % a5 + a4) ^= a3[75] ^ 0xE2; 510 | goto LABEL_263; 511 | case 0x8C: 512 | *(_BYTE*)(0x735D714B % a5 + a4) ^= a3[226] ^ 0x1D; 513 | goto LABEL_263; 514 | case 0x8D: 515 | *(_BYTE*)(0xCC0736E2 % a5 + a4) ^= a3[29] ^ 0x6C; 516 | goto LABEL_263; 517 | case 0x8E: 518 | *(_BYTE*)(0x2B4B021D % a5 + a4) = *(_BYTE*)(0x2B4B021D % a5 + a4) - a3[108] - 127; 519 | goto LABEL_263; 520 | case 0x8F: 521 | *(_BYTE*)(0x712C4C6C % a5 + a4) = *(_BYTE*)(0x712C4C6C % a5 + a4) - a3[127] - 70; 522 | goto LABEL_263; 523 | case 0x90: 524 | *(_BYTE*)(0x5632697F % a5 + a4) = __ROR1__(*(_BYTE*)(0x5632697F % a5 + a4), (a3[70] + 1) & 7); 525 | goto LABEL_263; 526 | case 0x91: 527 | *(_BYTE*)(0x9E121E46 % a5 + a4) = *(_BYTE*)(0x9E121E46 % a5 + a4) - a3[241] + 16; 528 | goto LABEL_263; 529 | case 0x92: 530 | v12 = 0x50CCDBF1 % a5; 531 | v13 = (unsigned __int8)a3[240] - 923717133; 532 | goto LABEL_23; 533 | case 0x93: 534 | *(_BYTE*)(0xBFF0EF0 % a5 + a4) = *(_BYTE*)(0xBFF0EF0 % a5 + a4) - a3[243] + 22; 535 | goto LABEL_263; 536 | case 0x94: 537 | *(_BYTE*)(0xC8F131F3 % a5 + a4) = __ROR1__(*(_BYTE*)(0xC8F131F3 % a5 + a4), (a3[234] - 3) & 7); 538 | goto LABEL_263; 539 | case 0x95: 540 | *(_BYTE*)(0x4C7094EA % a5 + a4) ^= a3[5] ^ 0xB4; 541 | goto LABEL_263; 542 | case 0x96: 543 | v12 = 0xC1210805 % a5; 544 | v13 = (unsigned __int8)a3[180] - 2055283033; 545 | goto LABEL_23; 546 | case 0x97: 547 | *(_BYTE*)(0x9AF3DAB4 % a5 + a4) ^= a3[167] ^ 0xCE; 548 | goto LABEL_263; 549 | case 0x98: 550 | *(_BYTE*)(0x857EDEA7 % a5 + a4) = __ROR1__(*(_BYTE*)(0x857EDEA7 % a5 + a4), (a3[206] + 1) & 7); 551 | goto LABEL_263; 552 | case 0x99: 553 | *(_BYTE*)(0xBEC35ECE % a5 + a4) ^= a3[89] ^ 0xB8; 554 | goto LABEL_263; 555 | case 0x9A: 556 | v12 = 0xC5753A59 % a5; 557 | v13 = (unsigned __int8)a3[184] - 543767653; 558 | goto LABEL_23; 559 | case 0x9B: 560 | *(_BYTE*)(0x825193B8 % a5 + a4) ^= a3[155] ^ 0xF2; 561 | goto LABEL_263; 562 | case 0x9C: 563 | *(_BYTE*)(0xDF96C39B % a5 + a4) = *(_BYTE*)(0xDF96C39B % a5 + a4) - a3[242] + 19; 564 | goto LABEL_263; 565 | case 0x9D: 566 | v10 = 0xB8287FF2 % a5; 567 | v11 = (unsigned __int8)a3[237] - 1077518852; 568 | goto LABEL_261; 569 | case 0x9E: 570 | v12 = 0x197F66ED % a5; 571 | v13 = (unsigned __int8)a3[252] - 1950452529; 572 | goto LABEL_23; 573 | case 0x9F: 574 | v12 = 0xBFC65DFC % a5; 575 | v13 = (unsigned __int8)a3[207] + 1381973078; 576 | goto LABEL_23; 577 | case 0xA0: 578 | *(_BYTE*)(0x8BBE74CF % a5 + a4) = *(_BYTE*)(0x8BBE74CF % a5 + a4) - a3[86] + 63; 579 | goto LABEL_263; 580 | case 0xA1: 581 | *(_BYTE*)(0x525F3C56 % a5 + a4) = __ROR1__(*(_BYTE*)(0x525F3C56 % a5 + a4), a3[193] & 7); 582 | goto LABEL_263; 583 | case 0xA2: 584 | v10 = 0xA11C1C1 % a5; 585 | v11 = (unsigned __int8)a3[128] - 763771325; 586 | goto LABEL_261; 587 | case 0xA3: 588 | v12 = 0xDEAB9D80 % a5; 589 | v13 = (unsigned __int8)a3[67] + 875304954; 590 | goto LABEL_23; 591 | case 0xA4: 592 | v12 = 0xD279C643 % a5; 593 | v13 = (unsigned __int8)a3[250] + 1643036373; 594 | goto LABEL_23; 595 | case 0xA5: 596 | v12 = 0x342C17FA % a5; 597 | v13 = (unsigned __int8)a3[213] - 2121664956; 598 | goto LABEL_23; 599 | case 0xA6: 600 | *(_BYTE*)(0x61EEBED5 % a5 + a4) = *(_BYTE*)(0x61EEBED5 % a5 + a4) - a3[68] + 9; 601 | goto LABEL_263; 602 | case 0xA7: 603 | *(_BYTE*)(0x8189F644 % a5 + a4) = __ROR1__(*(_BYTE*)(0x8189F644 % a5 + a4), (a3[247] - 2) & 7); 604 | goto LABEL_263; 605 | case 0xA8: 606 | v12 = 0x3BECBF7 % a5; 607 | v13 = (unsigned __int8)a3[222] - 1730342359; 608 | goto LABEL_23; 609 | case 0xA9: 610 | *(_BYTE*)(0x6FCD6DE % a5 + a4) ^= a3[41] ^ 0x48; 611 | goto LABEL_263; 612 | case 0xAA: 613 | v12 = 0x98DD1229 % a5; 614 | v13 = (unsigned __int8)a3[72] + 1051318763; 615 | goto LABEL_23; 616 | case 0xAB: 617 | *(_BYTE*)(0x24DD4C48 % a5 + a4) = __ROR1__(*(_BYTE*)(0x24DD4C48 % a5 + a4), (a3[235] + 2) & 7); 618 | goto LABEL_263; 619 | case 0xAC: 620 | v10 = 0x3EA9D9EB % a5; 621 | v11 = (unsigned __int8)a3[2] - 117723203; 622 | goto LABEL_261; 623 | case 0xAD: 624 | *(_BYTE*)(0xEFCC7D02 % a5 + a4) ^= a3[189] ^ 0x8C; 625 | goto LABEL_263; 626 | case 0xAE: 627 | v12 = 0xF8FBAFBD % a5; 628 | v13 = (unsigned __int8)a3[140] - 512654305; 629 | goto LABEL_23; 630 | case 0xAF: 631 | *(_BYTE*)(0xFF18C38C % a5 + a4) ^= a3[31] ^ 0x66; 632 | goto LABEL_263; 633 | case 0xB0: 634 | v12 = 0xE171841F % a5; 635 | v13 = (unsigned __int8)a3[102] - 1370109039; 636 | goto LABEL_23; 637 | case 0xB1: 638 | *(_BYTE*)(0xF474E66 % a5 + a4) = __ROR1__(*(_BYTE*)(0xF474E66 % a5 + a4), a3[145] & 7); 639 | goto LABEL_263; 640 | case 0xB2: 641 | *(_BYTE*)(0xAE55CB91 % a5 + a4) = *(_BYTE*)(0xAE55CB91 % a5 + a4) - a3[16] + 109; 642 | goto LABEL_263; 643 | case 0xB3: 644 | *(_BYTE*)(0x21EAC010 % a5 + a4) = *(_BYTE*)(0x21EAC010 % a5 + a4) - a3[147] - 10; 645 | goto LABEL_263; 646 | case 0xB4: 647 | v10 = 0x359A9E93 % a5; 648 | v11 = (unsigned __int8)a3[10] - 189343323; 649 | goto LABEL_261; 650 | case 0xB5: 651 | *(_BYTE*)(0x4D2ECF0A % a5 + a4) ^= a3[165] ^ 0xD4; 652 | goto LABEL_263; 653 | case 0xB6: 654 | v10 = 0xF4B6D9A5 % a5; 655 | v11 = (unsigned __int8)a3[212] + 745291079; 656 | goto LABEL_261; 657 | case 0xB7: 658 | *(_BYTE*)(0x40C0E5D4 % a5 + a4) ^= a3[71] ^ 0xEE; 659 | goto LABEL_263; 660 | case 0xB8: 661 | v12 = 0x2C6C3D47 % a5; 662 | v13 = (unsigned __int8)a3[238] - 675377671; 663 | goto LABEL_23; 664 | case 0xB9: 665 | v10 = 0xF2FDC2EE % a5; 666 | v11 = (unsigned __int8)a3[249] - 1064560424; 667 | goto LABEL_261; 668 | case 0xBA: 669 | *(_BYTE*)(0xD7BE8DF9 % a5 + a4) = __ROR1__(*(_BYTE*)(0xD7BE8DF9 % a5 + a4), (a3[216] + 3) & 7); 670 | goto LABEL_263; 671 | case 0xBB: 672 | v10 = 0xC08C18D8 % a5; 673 | v11 = (unsigned __int8)a3[59] - 640930286; 674 | goto LABEL_261; 675 | case 0xBC: 676 | *(_BYTE*)(0x3FA3B43B % a5 + a4) ^= a3[18] ^ 0x8D; 677 | goto LABEL_263; 678 | case 0xBD: 679 | v10 = 0xD9CC2E12 % a5; 680 | v11 = (unsigned __int8)a3[141] - 188449508; 681 | goto LABEL_261; 682 | case 0xBE: 683 | *(_BYTE*)(0x3934DC8D % a5 + a4) ^= a3[28] ^ 0x6F; 684 | goto LABEL_263; 685 | case 0xBF: 686 | *(_BYTE*)(0xF4C47D1C % a5 + a4) ^= a3[111] ^ 0x76; 687 | goto LABEL_263; 688 | case 0xC0: 689 | *(_BYTE*)(0xCA68976F % a5 + a4) ^= a3[118] ^ 0x61; 690 | goto LABEL_263; 691 | case 0xC1: 692 | v12 = 0x2F735476 % a5; 693 | v13 = (unsigned __int8)a3[97] - 1381140832; 694 | goto LABEL_23; 695 | case 0xC2: 696 | v12 = 0x119DF961 % a5; 697 | v13 = (unsigned __int8)a3[160] + 1853930211; 698 | goto LABEL_23; 699 | case 0xC3: 700 | *(_BYTE*)(0xADAD76A0 % a5 + a4) = __ROR1__(*(_BYTE*)(0xADAD76A0 % a5 + a4), (a3[227] + 2) & 7); 701 | goto LABEL_263; 702 | case 0xC4: 703 | *(_BYTE*)(0x6E80BAE3 % a5 + a4) ^= a3[26] ^ 0x75; 704 | goto LABEL_263; 705 | case 0xC5: 706 | *(_BYTE*)(0x16F1BA1A % a5 + a4) = __ROR1__(*(_BYTE*)(0x16F1BA1A % a5 + a4), (a3[117] - 4) & 7); 707 | goto LABEL_263; 708 | case 0xC6: 709 | *(_BYTE*)(0x1F0E5875 % a5 + a4) = *(_BYTE*)(0x1F0E5875 % a5 + a4) - a3[100] + 105; 710 | goto LABEL_263; 711 | case 0xC7: 712 | *(_BYTE*)(0x7BD9A964 % a5 + a4) ^= a3[151] ^ 0xFE; 713 | goto LABEL_263; 714 | case 0xC8: 715 | *(_BYTE*)(0x59C43297 % a5 + a4) ^= a3[254] ^ 0xC9; 716 | goto LABEL_263; 717 | case 0xC9: 718 | *(_BYTE*)(0xA80F22FE % a5 + a4) = __ROR1__(*(_BYTE*)(0xA80F22FE % a5 + a4), a3[201] & 7); 719 | goto LABEL_263; 720 | case 0xCA: 721 | *(_BYTE*)(0x763EADC9 % a5 + a4) = *(_BYTE*)(0x763EADC9 % a5 + a4) - a3[104] + 117; 722 | goto LABEL_263; 723 | case 0xCB: 724 | *(_BYTE*)(0x4CEEF968 % a5 + a4) = *(_BYTE*)(0x4CEEF968 % a5 + a4) - a3[139] - 34; 725 | goto LABEL_263; 726 | case 0xCC: 727 | *(_BYTE*)(0x7FD1528B % a5 + a4) = __ROR1__(*(_BYTE*)(0x7FD1528B % a5 + a4), (a3[34] - 3) & 7); 728 | goto LABEL_263; 729 | case 0xCD: 730 | v10 = 0x12409322 % a5; 731 | v11 = (unsigned __int8)a3[93] + 1168804524; 732 | goto LABEL_261; 733 | case 0xCE: 734 | v10 = 0xA9DFED5D % a5; 735 | v11 = (unsigned __int8)a3[172] + 469806783; 736 | goto LABEL_261; 737 | case 0xCF: 738 | v12 = 0x45AA8AAC % a5; 739 | v13 = (unsigned __int8)a3[191] - 422818170; 740 | goto LABEL_23; 741 | case 0xD0: 742 | v10 = 0x1C00AEBF % a5; 743 | v11 = (unsigned __int8)a3[134] + 2083474225; 744 | goto LABEL_261; 745 | case 0xD1: 746 | *(_BYTE*)(0xE6CC4E86 % a5 + a4) = __ROR1__(*(_BYTE*)(0xE6CC4E86 % a5 + a4), a3[49] & 7); 747 | goto LABEL_263; 748 | case 0xD2: 749 | v12 = 0x7C2F4B31 % a5; 750 | v13 = (unsigned __int8)a3[48] + 261692211; 751 | goto LABEL_23; 752 | case 0xD3: 753 | *(_BYTE*)(0xFD24C130 % a5 + a4) = *(_BYTE*)(0xFD24C130 % a5 + a4) - a3[51] - 42; 754 | goto LABEL_263; 755 | case 0xD4: 756 | *(_BYTE*)(0xF991B33 % a5 + a4) ^= a3[42] ^ 0x45; 757 | goto LABEL_263; 758 | case 0xD5: 759 | *(_BYTE*)(0xCE2DD92A % a5 + a4) ^= a3[69] ^ 0xF4; 760 | goto LABEL_263; 761 | case 0xD6: 762 | *(_BYTE*)(0x4ECA3B45 % a5 + a4) = *(_BYTE*)(0x4ECA3B45 % a5 + a4) - a3[244] + 25; 763 | goto LABEL_263; 764 | case 0xD7: 765 | *(_BYTE*)(0x7D5540F4 % a5 + a4) ^= a3[231] ^ 0xE; 766 | goto LABEL_263; 767 | case 0xD8: 768 | v12 = 0xF043ABE7 % a5; 769 | v13 = (unsigned __int8)a3[14] - 993889895; 770 | goto LABEL_23; 771 | case 0xD9: 772 | v12 = 0x2CB9F70E % a5; 773 | v13 = (unsigned __int8)a3[153] - 1395200520; 774 | goto LABEL_23; 775 | case 0xDA: 776 | *(_BYTE*)(0xC4C27199 % a5 + a4) = __ROR1__(*(_BYTE*)(0xC4C27199 % a5 + a4), (a3[248] + 3) & 7); 777 | goto LABEL_263; 778 | case 0xDB: 779 | *(_BYTE*)(0xACD6EDF8 % a5 + a4) ^= a3[219] ^ 0x32; 780 | goto LABEL_263; 781 | case 0xDC: 782 | *(_BYTE*)(0xDABFB4DB % a5 + a4) = *(_BYTE*)(0xDABFB4DB % a5 + a4) - a3[50] - 45; 783 | goto LABEL_263; 784 | case 0xDD: 785 | *(_BYTE*)(0x7A82AC32 % a5 + a4) = *(_BYTE*)(0x7A82AC32 % a5 + a4) - a3[45] - 60; 786 | goto LABEL_263; 787 | case 0xDE: 788 | v12 = 0x4AF1E22D % a5; 789 | v13 = (unsigned __int8)a3[60] + 1574357519; 790 | goto LABEL_23; 791 | case 0xDF: 792 | *(_BYTE*)(0x5EBEC3C % a5 + a4) = __ROR1__(*(_BYTE*)(0x5EBEC3C % a5 + a4), (a3[15] - 2) & 7); 793 | goto LABEL_263; 794 | case 0xE0: 795 | *(_BYTE*)(0x5DD6CA0F % a5 + a4) = *(_BYTE*)(0x5DD6CA0F % a5 + a4) - a3[150] - 1; 796 | goto LABEL_263; 797 | case 0xE1: 798 | *(_BYTE*)(0x527B3C96 % a5 + a4) = *(_BYTE*)(0x527B3C96 % a5 + a4) - a3[1] + 64; 799 | goto LABEL_263; 800 | case 0xE2: 801 | *(_BYTE*)(0x7A8EC101 % a5 + a4) = __ROR1__(*(_BYTE*)(0x7A8EC101 % a5 + a4), (a3[192] + 3) & 7); 802 | goto LABEL_263; 803 | case 0xE3: 804 | *(_BYTE*)(0xBEC19FC0 % a5 + a4) ^= a3[131] ^ 0x3A; 805 | goto LABEL_263; 806 | case 0xE4: 807 | v12 = 0x1190BF83 % a5; 808 | v13 = (unsigned __int8)a3[58] - 1979743723; 809 | goto LABEL_23; 810 | case 0xE5: 811 | *(_BYTE*)(0x7CDC2C3A % a5 + a4) = __ROR1__(*(_BYTE*)(0x7CDC2C3A % a5 + a4), (a3[21] - 4) & 7); 812 | goto LABEL_263; 813 | case 0xE6: 814 | v12 = 0x89FF8215 % a5; 815 | v13 = (unsigned __int8)a3[132] - 1364743881; 816 | goto LABEL_23; 817 | case 0xE7: 818 | *(_BYTE*)(0xC6F4AC84 % a5 + a4) = *(_BYTE*)(0xC6F4AC84 % a5 + a4) - a3[55] - 30; 819 | goto LABEL_263; 820 | case 0xE8: 821 | v12 = 0xAEA7A937 % a5; 822 | v13 = (unsigned __int8)a3[30] + 1072617833; 823 | goto LABEL_23; 824 | case 0xE9: 825 | *(_BYTE*)(0x78C73F1E % a5 + a4) = *(_BYTE*)(0x78C73F1E % a5 + a4) - a3[105] + 120; 826 | goto LABEL_263; 827 | case 0xEA: 828 | *(_BYTE*)(0x3FEED969 % a5 + a4) ^= a3[136] ^ 0x2B; 829 | goto LABEL_263; 830 | case 0xEB: 831 | v10 = 0x3E54F688 % a5; 832 | v11 = (unsigned __int8)a3[43] + 1227585858; 833 | goto LABEL_261; 834 | case 0xEC: 835 | v12 = 0xBA3BDB2B % a5; 836 | v13 = (unsigned __int8)a3[66] + 480230141; 837 | goto LABEL_23; 838 | case 0xED: 839 | v12 = 0x492B7942 % a5; 840 | v13 = (unsigned __int8)a3[253] + 1223270860; 841 | goto LABEL_23; 842 | case 0xEE: 843 | v10 = 0x1C9FBAFD % a5; 844 | v11 = (unsigned __int8)a3[204] + 432531807; 845 | goto LABEL_261; 846 | case 0xEF: 847 | v12 = 0x48E9A1CC % a5; 848 | v13 = (unsigned __int8)a3[95] - 1997988186; 849 | goto LABEL_23; 850 | case 0xF0: 851 | *(_BYTE*)(0x19C7E95F % a5 + a4) = *(_BYTE*)(0x19C7E95F % a5 + a4) - a3[166] + 47; 852 | goto LABEL_263; 853 | case 0xF1: 854 | *(_BYTE*)(0x88E91EA6 % a5 + a4) ^= a3[209] ^ 0x50; 855 | goto LABEL_263; 856 | case 0xF2: 857 | v10 = 0xAD815AD1 % a5; 858 | v11 = (unsigned __int8)a3[80] + 592750547; 859 | goto LABEL_261; 860 | case 0xF3: 861 | *(_BYTE*)(0x64351250 % a5 + a4) ^= a3[211] ^ 0x4A; 862 | goto LABEL_263; 863 | case 0xF4: 864 | *(_BYTE*)(0x2354A7D3 % a5 + a4) = *(_BYTE*)(0x2354A7D3 % a5 + a4) - a3[74] + 27; 865 | goto LABEL_263; 866 | case 0xF5: 867 | *(_BYTE*)(0xA35B34A % a5 + a4) = *(_BYTE*)(0xA35B34A % a5 + a4) - a3[229] - 20; 868 | goto LABEL_263; 869 | case 0xF6: 870 | v10 = 0x3F032CE5 % a5; 871 | v11 = (unsigned __int8)a3[20] - 34788729; 872 | goto LABEL_261; 873 | case 0xF7: 874 | *(_BYTE*)(0xA1B8EC14 % a5 + a4) = *(_BYTE*)(0xA1B8EC14 % a5 + a4) - a3[135] - 46; 875 | goto LABEL_263; 876 | case 0xF8: 877 | *(_BYTE*)(0xFDED2A87 % a5 + a4) = __ROR1__(*(_BYTE*)(0xFDED2A87 % a5 + a4), (a3[46] + 1) & 7); 878 | goto LABEL_263; 879 | case 0xF9: 880 | *(_BYTE*)(0x853FFB2E % a5 + a4) = *(_BYTE*)(0x853FFB2E % a5 + a4) - a3[57] - 24; 881 | goto LABEL_263; 882 | case 0xFA: 883 | v10 = 0x60A8E539 % a5; 884 | v11 = (unsigned __int8)a3[24] + 1716700539; 885 | goto LABEL_261; 886 | case 0xFB: 887 | v12 = 0x6ABA1318 % a5; 888 | v13 = (unsigned __int8)a3[123] + 437516882; 889 | LABEL_23: 890 | v14 = v12; 891 | v15 = v13 % a5; 892 | v16 = *(_BYTE*)(v15 + a4) - 1; 893 | *(_BYTE*)(v14 + a4) -= v16; 894 | goto LABEL_262; 895 | case 0xFC: 896 | *(_BYTE*)(0x6652C57B % a5 + a4) ^= a3[82] ^ 0xCD; 897 | goto LABEL_263; 898 | case 0xFD: 899 | *(_BYTE*)(0x1A13FA52 % a5 + a4) ^= a3[205] ^ 0x5C; 900 | goto LABEL_263; 901 | case 0xFE: 902 | *(_BYTE*)(0xEF5E77CD % a5 + a4) = __ROR1__(*(_BYTE*)(0xEF5E77CD % a5 + a4), (a3[92] - 1) & 7); 903 | goto LABEL_263; 904 | case 0xFF: 905 | v10 = 0xB144AB5C % a5; 906 | v11 = (unsigned __int8)a3[175] - 1447103306; 907 | LABEL_261: 908 | v17 = v10; 909 | v15 = v11 % a5; 910 | v16 = *(_BYTE*)(v17 + a4); 911 | *(_BYTE*)(v17 + a4) = *(_BYTE*)(v15 + a4); 912 | LABEL_262: 913 | *(_BYTE*)(v15 + a4) = v16; 914 | LABEL_263: 915 | if (++v9 >= a2) 916 | return; 917 | continue; 918 | } 919 | } 920 | } 921 | } 922 | } --------------------------------------------------------------------------------