Oreans UnVirtualizer 1.4
Video Sample Log (C) Deathway 2009-2012

/////////////////////////
// Code Virtualizer Sample
1.- Load the sample Application
2.- Right click on CPU window and click OreansUnVirtualizer
    ->Find References
    On the Window, fill the data with module info
    (In this case only one reference was found)
3.- Double click on the reference, and on the CPU window
    right click->OreansUnVirtualizer -> UnVirtualize
    (In Case some parameters are wrong, just check them on the
     VirtualMachine by following the jump)
    Press OK (all parameter are fine)
4.- No errors on DeOfuscating, (if there are some, just fix them
    on the Cisc_Iat_XXXXXXX.txt where XXXXX is the addres of the 
    handler
5.- Go back to References window and click again UnVirtualize
6.- A Window will popup with the opcodes dissassembled, on 
    CodeVirtualizer, select the address from the .txt file
    with the instruction that you may think is the first
    (On CV 99.9% is the first instruction)
7.- Press OK
8.- UnVirtualize DONE! (always check at the end of the Unvirtualized
    function the Jump (EB 10)

/////////////////////////
// WinLicense Sample
1.- Load the sample Application (Sample App doesn't have antidebugs)
2.- Let WinLicense Unpack the app (before put an HWWP on Execute
    at 4014B1 and press F9 
3.- Find References like on CV (Ignore Fake ones, the second is
    a Jump to WLStringDecrypt
4.- Double click on the reference, and on the CPU window
    right click->OreansUnVirtualizer -> UnVirtualize
    (In Case some parameters are wrong, just check them on the
     VirtualMachine by following the jump)
    (on Lates VM, VM entry is ofuscated)
    Press OK (all parameter are fine)
5.- An error ocurred while dissasembling, press yes if you
    want to follow the jump, otherwise no (is trial an error)
6.- No errors on DeOfuscating, (if there are some, just fix them
    on the Cisc_Iat_XXXXXXX.txt where XXXXX is the addres of the 
    handler
7.- Go back to References window and click again UnVirtualize
8.- A Window will popup with the opcodes dissassembled, on 
    TMD/WL, select the address from the .txt file
    with the instruction that you may think is the first
    (On WL 99.9% goes after :
     *    POP ESP
     *    MOV ESP, DWORD PTR SS:[ESP]
     *    ADD ESP,4)
    The other are just antidumps check and other stuff
9.- Press OK
10.-UnVirtualize DONE! (always check at the end of the Unvirtualized
    function the Jump (EB 10), and in this case, check WLStringDecrypt 
    API