@Stud The Original Entrypoint must be 0x00ed114a. Please see the screenshot. This is an example of packed calc.exe and original calc.exe. framapic.org/puYO0dYjWhiO/dZJfxKYwl0TF.png

@xorist Yes, and you may observed that the main function must be located before the cexit() or ExitProcess(v1) is called. This is the pseudo code produced by IDA Pro. sub_403B20(dword_407004, dword_407000, *v0); cexit(); ExitProcess(v1);