The agree.dat is loaded inside of TS2Online.exe via this function:
Code:
int __usercall sub_4D5114@<eax>(int a1@<eax>, int a2@<edx>)
{
int v2; // ebx
int v3; // ecx
int v4; // ecx
int v5; // ecx
int v6; // ecx
unsigned int v8; // [esp-18h] [ebp-188h]
void *v9; // [esp-14h] [ebp-184h]
int *v10; // [esp-10h] [ebp-180h]
unsigned int v11; // [esp-Ch] [ebp-17Ch]
int v12; // [esp-4h] [ebp-174h]
int v13; // [esp+Ch] [ebp-164h]
int v14; // [esp+15Ch] [ebp-14h]
char v15; // [esp+162h] [ebp-Eh]
char v16; // [esp+163h] [ebp-Dh]
int v17; // [esp+164h] [ebp-Ch]
int v18; // [esp+168h] [ebp-8h]
int v19; // [esp+16Ch] [ebp-4h]
int savedregs; // [esp+170h] [ebp+0h]
v13 = 0;
v14 = 0;
v18 = a2;
v19 = a1;
sub_404D78();
v11 = __readfsdword(0);
__writefsdword(0, (unsigned int)&v11);
v2 = 0;
v15 = 0x33;
if ( (unsigned __int8)sub_4095D8(v11, &loc_4D5250, &savedregs) )
{
v10 = &savedregs;
v9 = &loc_4D51F3;
v8 = __readfsdword(0);
__writefsdword(0, (unsigned int)&v8);
sub_402F0C(v3, v18);
sub_403434(v4, 1);
sub_402924();
((void (*)(void))sub_4048D8)();
do
{
sub_403070(&v17);
sub_402924();
LOBYTE(v2) = v15 ^ v16;
sub_404AB8(v5, v2);
sub_404B98(v6, v13);
}
while ( v17 );
sub_4030B0();
sub_402924();
__writefsdword(0, v8);
(*(void (**)(void))(**(_DWORD **)(v19 + 756) + 220))();
(*(void (__fastcall **)(_DWORD, int))(**(_DWORD **)(*(_DWORD *)(v19 + 756) + 544) + 56))(
**(_DWORD **)(*(_DWORD *)(v19 + 756) + 544),
v14);
LOBYTE(v2) = 1;
}
__writefsdword(0, v11);
sub_4048D8(&loc_4D5257);
sub_4048D8(v12);
sub_4048D8(v12);
return v2;
}
The xor key is set in v15 (0x33) and applied byte-per-byte in the loop here:
Code:
do
{
sub_403070(&v17);
sub_402924();
LOBYTE(v2) = v15 ^ v16;
sub_404AB8(v5, v2);
sub_404B98(v6, v13);
}
while ( v17 );