004C2700:
                call    @Controls@TControl@GetText$qqrv ; Controls::TControl::GetText(void)
EIP->           mov     edx, [ebp+var_8]
                mov     eax, [ebp+var_4]
                call    sub_4C23A8
                test    al, al
                jnz     short loc_4C277C
                
                ...
                mov     edx, offset _str_WKeyError.Text
                call    sub_4AF2F8
                ...
                jmp     short loc_4C27D2

loc_4C277C:
                ...
                mov     edx, offset _str_WRegistrationTh.Text
                call    sub_4AF2F8

check_key_4C23A8 proc near

                ...
                mov     [ebp+key_8], edx
                mov     [ebp+this_4], eax
                ...
                mov     [ebp+is_right_key_9], 0
                cmp     [ebp+key_8], 0
                jz      loc_4C257B
                
                lea     edx, [ebp+key_copy_28]
                mov     eax, [ebp+key_8]
                call    copy_digits_492734
                
                mov     edx, [ebp+key_copy_28]
                mov     eax, ds:pp_key_4F305C
                call    @System@@LStrAsg$qqrv ; System::__linkproc__ LStrAsg(void)
                ...
                
                mov     eax, ds:pp_dirname_4F2F54
                push    dword ptr [eax]
                push    offset _str_slash.Text
                push    offset _str_CharmSolitaire.Text
                push    offset _str__udf.Text
                lea     eax, [ebp+udf_filename_2C]
                mov     edx, 4
                call    str_cat_40522C
                
                mov     edx, [ebp+udf_filename_2C]          ; %GAME_DIR%\CharmSolitaire.udf
                mov     eax, [ebp+mem_stream_encrypted_10]
                call    @Classes@TMemoryStream@LoadFromFile$qqrx17System@AnsiString_0 ; Classes::TMemoryStream::LoadFromFile(System::AnsiString)
                
                mov     eax, ds:pp_key_4F305C
                cmp     dword ptr [eax], 0
                jz      short loc_4C2496
                
                mov     eax, ds:pp_key_4F305C
                mov     eax, [eax]
                call    strlen_40516C
                
004C2473:       cmp     eax, 18h
                jnz     short loc_4C2496
                
004C2478:       ...


loc_4C25A5:
                mov     al, [ebp+is_right_key_9]
                ...
                retn
check_key_4C23A8 endp

004C2478:       lea     edx, [ebp+var_30]
                mov     eax, ds:pp_key_4F305C
                mov     eax, [eax]
                call    sub_4924D0
                
                mov     edx, [ebp+var_30]
                mov     eax, ds:off_4F2C24
                call    @System@@LStrAsg$qqrv ; System::__linkproc__ LStrAsg(void)
                jmp     short loc_4C24A5

key_to_hex_4924D0 proc near
                ...
                mov     [ebp+p_res_10], edx
                mov     [ebp+key_C], eax
                ...
                lea     edx, [ebp+key_copy_24]
                mov     eax, [ebp+key_C]
                call    copy_digits_492734
                
                mov     eax, [ebp+key_copy_24]
                lea     edx, [ebp+mixed_str_14]
                call    mix_symbols_492688
                
                lea     eax, [ebp+mixed_str_14]
                mov     ecx, 3
                mov     edx, 1
                call    delete_symbols_40540C
                jmp     short loc_492539

loc_492527:
                lea     eax, [ebp+mixed_str_14]
                mov     ecx, 1
                mov     edx, 1
                call    delete_symbols_40540C
loc_492539:
                mov     eax, [ebp+mixed_str_14]
                cmp     byte ptr [eax], 30h ; '0'
                jz      short loc_492527            ; delete leading zeros
                
                push    0       ; default value
                push    0       ; default value
                mov     eax, [ebp+mixed_str_14]
                call    @Sysutils@StrToInt64Def$qqrx17System@AnsiStringj ; Sysutils::StrToInt64Def(System::AnsiString,__int64)
                mov     [ebp+v64lo_8], eax
                mov     [ebp+v64hi_4], edx
                
                mov     eax, [ebp+p_res_10]
                call    @System@@LStrClr$qqrr17System@AnsiString ; System::__linkproc__ LStrClr(System::AnsiString &)
                mov     [ebp+i_18], 1

loc_492562:
                mov     eax, [ebp+i_18]
                test    byte ptr [ebp+eax-1+v64lo_8], 7Fh
                jbe     short loc_49258C
                
                lea     eax, [ebp+char_str_28]
                mov     edx, [ebp+i_18]
                mov     dl, byte ptr [ebp+edx-1+v64lo_8]
                and     dl, 7Fh
                call    str_from_pchar_405084 ; Borland Visual Component Library & Packages
                
                mov     edx, [ebp+char_str_28]
                mov     eax, [ebp+p_res_10]
                call    @System@@LStrCat$qqrv ; System::__linkproc__ LStrCat(void)
                mov     eax, [ebp+p_res_10]

loc_49258C:
                inc     [ebp+i_18]
                cmp     [ebp+i_18], 9
                jnz     short loc_492562

loc_4925A2:
                ...
                retn
key_to_hex_4924D0 endp

004C2478:       lea     edx, [ebp+p_key64_30]
                mov     eax, ds:pp_key_4F305C
                mov     eax, [eax]
                call    key_to_hex_4924D0
                
                mov     edx, [ebp+p_key64_30]
                mov     eax, ds:p_key_bytes_4F2C24
                call    @System@@LStrAsg$qqrv ; System::__linkproc__ LStrAsg(void)
                jmp     short loc_4C24A5
                ...
loc_4C24A5:
                mov     ecx, ds:p_key_bytes_4F2C24
                mov     ecx, [ecx]
                mov     edx, [ebp+mem_stream_decrypted_14]
                mov     eax, [ebp+mem_stream_encrypted_10]
                call    sub_492B48
                
                mov     eax, [ebp+mem_stream_decrypted_14]
                call    sub_492C94
                
                test    al, al
                jz      loc_4C255F
                ...
loc_4C255F:
                mov     [ebp+is_right_key_9], 0
                ...
loc_4C25A5:
                mov     al, [ebp+is_right_key_9]
                ...
                ret
check_key_4C23A8 endp

decrypt_492B48  proc near
                ...
                mov     [ebp+key_bytes_28], ecx
                mov     [ebp+mem_stream_decrypted_24], edx
                mov     [ebp+mem_stream_encrypted_20], eax
                ...
                mov     eax, [ebp+key_bytes_28]
                call    strlen_40516C
                test    eax, eax
                jnz     short loc_492B87
                ...
loc_492B87:
                ...     ; key_bytes_28 может быть меньше 8 символов
                ...     ; key_bytes8_34 заполняется до 8 символов повторением key_bytes_28
                ...     ; в принципе можно считать, что они равны

loc_492BD4:
                lea     edx, [ebp+buf_14]
                mov     ecx, 8
                mov     eax, [ebp+mem_stream_encrypted_20]
                mov     ebx, [eax]
                call    dword ptr [ebx+0Ch]         ; read bytes
                mov     [ebp+bytes_read_C], eax
                
                xor     eax, eax
                mov     [ebp+i_2C], eax

loc_492BEC:
                mov     eax, [ebp+i_2C]
                mov     al, [ebp+eax+key_bytes8_34]
                mov     edx, [ebp+i_2C]
                xor     byte ptr [ebp+edx+buf_14], al
                inc     [ebp+i_2C]
                cmp     [ebp+i_2C], 8
                jnz     short loc_492BEC
                
                cmp     [ebp+bytes_read_C], 8
                jnz     short loc_492C3C
                
                push    ebp
                call    sub_492A6C
                pop     ecx
                xor     eax, eax
                mov     [ebp+i_2C], eax
loc_492C15:
                mov     eax, [ebp+i_2C]
                mov     al, [ebp+eax+key_bytes8_34]
                mov     edx, [ebp+i_2C]
                xor     byte ptr [ebp+edx+decrypted_buf_1C], al
                inc     [ebp+i_2C]
                cmp     [ebp+i_2C], 8
                jnz     short loc_492C15
                
                lea     edx, [ebp+decrypted_buf_1C]
                mov     ecx, [ebp+bytes_read_C]
                mov     eax, [ebp+mem_stream_decrypted_24]
                mov     ebx, [eax]
                call    dword ptr [ebx+10h]     ; write bytes
                jmp     short loc_492C4A

loc_492C3C:
                lea     edx, [ebp+buf_14]
                mov     ecx, [ebp+bytes_read_C]
                mov     eax, [ebp+mem_stream_decrypted_24]
                mov     ebx, [eax]
                call    dword ptr [ebx+10h]     ; write bytes

loc_492C4A:
                cmp     [ebp+bytes_read_C], 8
                jz      short loc_492BD4
                
                ...
                retn
decrypt_492B48  endp

</Level>0x0D,0x0A

#include <vcl.h>
#pragma hdrstop

#include "MainUnit.h"
#include <vector>
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
TMainForm *MainForm;
//---------------------------------------------------------------------------
__fastcall TMainForm::TMainForm(TComponent* Owner)
	: TForm(Owner)
{
}
//---------------------------------------------------------------------------

inline unsigned int getBit(unsigned char byte, unsigned int bitNumber)
{
	return (byte & ((unsigned char)1 << bitNumber) ? 1 : 0);
}

inline void setBit(unsigned char &byte, unsigned int bitNumber, unsigned int bitValue)
{
	if (bitValue)
		byte |= ((unsigned char)1 << bitNumber);
	else
		byte &= ~((unsigned char)1 << bitNumber);
}

int isText(unsigned char *pData, int streamSize)
{
	int isText = 1;
	if (streamSize < 1) return isText;

	char prevChar = 0;
	do
	{
		if (*pData < 0x20 && *pData != 9)
		{
			if ((*pData == 0x0D || *pData == 0x0A))
			{
				// для ускорения поиска можно проверять каждый расшифрованный блок
				// так как он может начинаться с 0x0A, то эта часть кода не нужна
				  
				//if (*pData == 0x0A && prevChar != 0x0D)
				//{
				//	isText = 0;
				//	break;
				//}
			}
			else
			{
				isText = 0;
				break;
			}
		}
		
		prevChar = *pData;
		pData++;
	}
	while (--streamSize);

	return isText;
}




#define FIXED_0 0
#define FIXED_1 1
#define UNKNOWN 2

const unsigned char bitTypes[8][8] = {
	// младший бит слева
	{0, 0, 0, 0, 0, 0, 0, 0},
	{2, 0, 0, 0, 0, 0, 0, 0},
	{2, 2, 0, 0, 0, 0, 0, 0},
	{2, 2, 2, 0, 0, 0, 0, 0},
	{2, 2, 2, 2, 0, 0, 0, 0},
	{2, 2, 2, 2, 2, 0, 0, 0},
	{2, 2, 2, 2, 2, 2, 0, 0},
	{1, 1, 0, 0, 1, 1, 0, 0}
};

void getKeyMatrix(unsigned int keyBits, unsigned char matrix[8])
{
	int x, y;
	unsigned int bitValue = 0, bitNumber = 0;

	memset(matrix, 8, 0);
	for(y = 0; y < 8; y++)
	{
		for(x = 0; x < 8; x++)
		{
			// для массива координаты идут в обратном порядке
			if (bitTypes[y][x] == UNKNOWN)
			{
				bitValue = getBit(((unsigned char*)&keyBits)[bitNumber / 8], bitNumber % 8);
				bitNumber++;
			}
			else if (bitTypes[y][x] == FIXED_1)
				bitValue = 1;
			else
				bitValue = 0;

			setBit(matrix[y], x, bitValue);
		}
	}
}

void reverseMatrix(unsigned char block[8])
{
	unsigned int x, y, bitValue;
	unsigned char tmpBlock[8];
	for (y = 0; y < 8; y++)
	{
		for (x = 0; x < 8; x++)
		{
			bitValue = getBit(block[x], y);
			setBit(tmpBlock[y], x, bitValue);
		}
	}

	memcpy(block, tmpBlock, 8);
}

void decryptBlock(unsigned int keyBits, unsigned char *encryptedBlock, unsigned char *decryptedBlock, unsigned int blockSize)
{
	unsigned char key[8];
	unsigned int i;
	getKeyMatrix(keyBits, key);

	for(i = 0; i < blockSize; i++)
		decryptedBlock[i] = encryptedBlock[i] ^ key[i];

	if (blockSize == 8)
	{
		reverseMatrix(decryptedBlock);

		for(i = 0; i < 8; i++)
			decryptedBlock[i] = decryptedBlock[i] ^ key[i];
	}
}

void decryptText(unsigned char *encryptedText, unsigned char *decryptedText, unsigned int textSize, unsigned int keyBits)
{
	unsigned int position = 0, blockSize = 8, bytesToRead = 0;
	unsigned int i, j;

	while(position < textSize)
	{
		if (position + blockSize <= textSize)
			bytesToRead = blockSize;
		else
			bytesToRead = textSize - position;

		decryptBlock(keyBits, encryptedText + position, decryptedText + position, bytesToRead);
		// для ускорения поиска проверяем каждый блок
		if (bytesToRead == 8 && !isText(decryptedText + position, 8))
			break;

		position += bytesToRead;
	}
}

void getKeyVariants(unsigned char *encryptedText, unsigned int textSize, std::vector<unsigned int> &keyList)
{
	unsigned int variantsCount = 0;
	unsigned int possibleBits = 0;

	unsigned char *decryptedText = new unsigned char[textSize];
	//for (possibleBits = 0; possibleBits < (1 << 20); possibleBits++)
	for (possibleBits = 0; possibleBits < (1 << 6); possibleBits++)
	{
		decryptText(encryptedText, decryptedText, textSize, possibleBits);

		if (isText(decryptedText, textSize - textSize % 8))
		{
			keyList.push_back(possibleBits);
			variantsCount++;
		}
	}
	variantsCount = variantsCount;	// для брейкпойнта
	

	delete []decryptedText;
}

AnsiString getKeyText(unsigned char keyMatrix[8])
{
	AnsiString str = "000000000000000000000000" + IntToStr(*(__int64*)keyMatrix);
	str = str.SubString(str.Length() - 24 + 1, 24);  // нумерация с 1 

	AnsiString keyText = "";
	for(int i = 0; i < 24; i += 2)
		keyText.cat_printf("%c", str.c_str()[i + 1]);
	for(int i = 0; i < 24; i += 2)
		keyText.cat_printf("%c", str.c_str()[i]);
	
	return keyText;
}

//---------------------------------------------------------------------------

std::vector<unsigned int> keyList;
void __fastcall TMainForm::btnStartClick(TObject *Sender)
{
	AnsiString filename = "F:\\Games\\Charm Solitaire\\CharmSolitaire.udf";
	TMemoryStream *encryptedStream = new TMemoryStream();
	encryptedStream->LoadFromFile(filename);

	getKeyVariants((unsigned char *)encryptedStream->Memory, encryptedStream->Size, keyList);

	unsigned char keyMatrix[8];
	getKeyMatrix(keyList[0], keyMatrix);
	getKeyText(keyMatrix);
}


void __fastcall TMainForm::btnDecryptClick(TObject *Sender)
{
	AnsiString filename = "F:\\Games\\Charm Solitaire\\CharmSolitaire.udf";
	TMemoryStream *encryptedStream = new TMemoryStream();
	encryptedStream->LoadFromFile(filename);

	unsigned int keyBits = keyList[0];
	unsigned int textSize = encryptedStream->Size;
	unsigned char *decryptedText = new unsigned char[textSize + 1];
	decryptedText[textSize] = 0;

	decryptText((unsigned char *)encryptedStream->Memory, decryptedText, textSize, keyBits);
	mDecryptedText->Text = AnsiString((char*)decryptedText);
}
//---------------------------------------------------------------------------