Well, it looks like the first encrypted part in the header might be decrypted from this piece of asm in core_vr.dll
Code: Select all
.text:10065990 ; class stlp_std::basic_string<char, class stlp_std::char_traits<char>, class stlp_std::allocator<char>> __cdecl mcPack_namespace::SHA1toStr(unsigned char * const)
.text:10065990 ?SHA1toStr@mcPack_namespace@@YA?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@Z_0 proc near
.text:10065990 ; CODE XREF: mcPack_namespace::SHA1toStr(uchar * const)j
.text:10065990
.text:10065990 var_55 = byte ptr -55h
.text:10065990 var_54 = dword ptr -54h
.text:10065990 var_44 = dword ptr -44h
.text:10065990 var_3C = byte ptr -3Ch
.text:10065990 var_14 = dword ptr -14h
.text:10065990 var_10 = dword ptr -10h
.text:10065990 var_C = dword ptr -0Ch
.text:10065990 var_4 = dword ptr -4
.text:10065990 arg_0 = dword ptr 4
.text:10065990 arg_4 = dword ptr 8
.text:10065990
.text:10065990 push 0FFFFFFFFh
.text:10065992 push offset loc_100DD5C9
.text:10065997 mov eax, large fs:0
.text:1006599D push eax
.text:1006599E sub esp, 4Ch
.text:100659A1 mov eax, dword_101271F8
.text:100659A6 xor eax, esp
.text:100659A8 mov [esp+58h+var_10], eax
.text:100659AC push ebx
.text:100659AD push ebp
.text:100659AE push esi
.text:100659AF push edi
.text:100659B0 mov eax, dword_101271F8
.text:100659B5 xor eax, esp
.text:100659B7 push eax
.text:100659B8 lea eax, [esp+6Ch+var_C]
.text:100659BC mov large fs:0, eax
.text:100659C2 mov eax, [esp+6Ch+arg_4]
.text:100659C6 movzx edx, byte ptr [eax+2]
.text:100659CA xor ecx, ecx
.text:100659CC mov ch, [eax]
.text:100659CE movzx edi, byte ptr [eax+6]
.text:100659D2 movzx ebx, byte ptr [eax+0Ah]
.text:100659D6 mov cl, [eax+1]
.text:100659D9 mov esi, [esp+6Ch+arg_0]
.text:100659DD mov [esp+6Ch+var_54], 0
.text:100659E5 shl ecx, 8
.text:100659E8 or ecx, edx
.text:100659EA movzx edx, byte ptr [eax+3]
.text:100659EE shl ecx, 8
.text:100659F1 or ecx, edx
.text:100659F3 xor edx, edx
.text:100659F5 mov dh, [eax+4]
.text:100659F8 mov dl, [eax+5]
.text:100659FB shl edx, 8
.text:100659FE or edx, edi
.text:10065A00 movzx edi, byte ptr [eax+7]
.text:10065A04 shl edx, 8
.text:10065A07 or edi, edx
.text:10065A09 xor edx, edx
.text:10065A0B mov dh, [eax+8]
.text:10065A0E mov dl, [eax+9]
.text:10065A11 shl edx, 8
.text:10065A14 or edx, ebx
.text:10065A16 movzx ebx, byte ptr [eax+0Bh]
.text:10065A1A shl edx, 8
.text:10065A1D or edx, ebx
.text:10065A1F movzx ebx, byte ptr [eax+0Eh]
.text:10065A23 mov ebp, edx
.text:10065A25 xor edx, edx
.text:10065A27 mov dh, [eax+0Ch]
.text:10065A2A mov dl, [eax+0Dh]
.text:10065A2D shl edx, 8
.text:10065A30 or edx, ebx
.text:10065A32 movzx ebx, byte ptr [eax+0Fh]
.text:10065A36 shl edx, 8
.text:10065A39 or edx, ebx
.text:10065A3B movzx ebx, byte ptr [eax+12h]
.text:10065A3F mov [esp+6Ch+var_44], edx
.text:10065A43 xor edx, edx
.text:10065A45 mov dh, [eax+10h]
.text:10065A48 mov dl, [eax+11h]
.text:10065A4B movzx eax, byte ptr [eax+13h]
.text:10065A4F shl edx, 8
.text:10065A52 or edx, ebx
.text:10065A54 shl edx, 8
.text:10065A57 or eax, edx
.text:10065A59 mov edx, [esp+6Ch+var_44]
.text:10065A5D push eax
.text:10065A5E push edx
.text:10065A5F push ebp
.text:10065A60 push edi
.text:10065A61 push ecx
.text:10065A62 lea eax, [esp+80h+var_3C]
.text:10065A66 push offset a08x08x08x08x08 ; "%08X%08X%08X%08X%08X"
.text:10065A6B push eax ; char *
.text:10065A6C call ds:sprintf
.text:10065A72 xor ebx, ebx
.text:10065A74 add esp, 1Ch
.text:10065A77 lea ecx, [esp+6Ch+var_55]
.text:10065A7B mov byte ptr [esp+6Ch+var_14], bl
.text:10065A7F call ds:??0?$allocator@D@stlp_std@@QAE@XZ ; stlp_std::allocator<char>::allocator<char>(void)
.text:10065A85 push eax
.text:10065A86 lea ecx, [esp+70h+var_3C]
.text:10065A8A push ecx
.text:10065A8B mov ecx, esi
.text:10065A8D mov [esp+74h+var_4], ebx
.text:10065A91 call ds:??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@PBDABV?$allocator@D@1@@Z ; stlp_std::basic_string<char,stlp_std::char_traits<char>,stlp_std::allocator<char>>::basic_string<char,stlp_std::char_traits<char>,stlp_std::allocator<char>>(char const *,basic_string<char,stlp_std::char_traits<char>,stlp_std::allocator<char>>::allocator<char> const &)
.text:10065A97 lea ecx, [esp+6Ch+var_55]
.text:10065A9B call ds:??1?$allocator@D@stlp_std@@QAE@XZ ; stlp_std::allocator<char>::~allocator<char>(void)
.text:10065AA1 mov eax, esi
.text:10065AA3 mov ecx, [esp+6Ch+var_C]
.text:10065AA7 mov large fs:0, ecx
.text:10065AAE pop ecx
.text:10065AAF pop edi
.text:10065AB0 pop esi
.text:10065AB1 pop ebp
.text:10065AB2 pop ebx
.text:10065AB3 mov ecx, [esp+58h+var_10]
.text:10065AB7 xor ecx, esp
.text:10065AB9 call sub_100D36BC
.text:10065ABE add esp, 58h
.text:10065AC1 retn
.text:10065AC1 ?SHA1toStr@mcPack_namespace@@YA?AV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@Z_0 endp
.text:10065AC1
.text:10065AC1 ; ---------------------------------------------------------------------------