Themida Unpacking & Code Recovery

Job ID: 40177261

Budget: $10 – $100 USD

I need the executable of my own desktop application fully unpacked from its Themida envelope so that the original x86/x64 code, resources, and section layout are restored exactly as they were before protection. My end-goal is to resume regular maintenance on the project, so the recovered binary must assemble and debug cleanly in Visual Studio and load without a Themida loader stub.

Scope
• Work on a single Windows desktop EXE protected with a recent build of Themida.
• Produce an unpacked executable that runs identically to the original and is build-ready for further development.
• Provide a short technical report describing the unpacking process (breakpoints used in x64dbg/OllyDbg, OEP discovery, import rebuilding, VM handler fixes, etc.) so I can replicate the steps if the software is updated later.

Acceptance criteria
1. Hash comparison shows non-encrypted sections restored and import table rebuilt.
2. The unpacked file launches on Windows 10/11 with identical functionality.
3. IDA or Ghidra loads the file without stubs or obfuscated APIs, allowing clean decompilation.

I own the software and have full legal rights to modify it, so copyright concerns are covered. If any helper scripts or loaders are required, include them alongside clear usage notes.