var counter

var ImageBase

var OEP

var iat_start

var imsize

var lbs

GMEMI eip,MEMORYBASE

mov lbs,$RESULT

mov counter,0

gmi eip,MODULEBASE

mov ImageBase,$RESULT

gpa  "LoadLibraryA","kernel32.dll"

find $RESULT,#C20400#

bp $RESULT

erun

bc eip

sti

find lbs,#B9????????01E983790C000F84#

cmp $RESULT,0

je abort

bphws $RESULT+5

erun

bphwc eip

mov iat_start,ecx

mov OEP,[eip+AF]



add OEP,ImageBase



mov eip,OEP

cmt eip, "Oep"

sub OEP,ImageBase

mov counter,ImageBase

add counter,3C

mov counter,[counter]

add counter,ImageBase

dec [counter+6]

mov [counter+28],OEP

mov [counter+80],iat_start

dpe  "Unpacked.exe", eip

msg " File Unpacked"

ret

abort:

ret