Armadillo Import Elimination
 

Im trying to unpack an arma protected program (one process). It uses import elimination... so first i used a script (so that it does not detect the change) to patch the iat so that there are no invalid pointers left, but after the patch the first iat call goes to RegQuerryValueEx... so the functions are not in the correct place. How can i solve this? (I have only patched this jump and then i let the protected program run with the patched iat...)
Target:

....
 

if its only one api call, wrong placed you can fix it simple,
look your last iat area find the "ReqQuerryValueEx" where placed (on rva)
then patch islike this (opcode)
FF25xxxxxxxx (the xx is rva + imagebase then inverted e.g FF25B3A14000)

no... its not only one function...