I think that 3x GetprocAddress is right, because in IMPREC sad that it's valid. Only if IMPREC is wrong, but that's beyond my capabilities to explore why is it wrong. Anyway, i red that in some thread postet in woodmann's forum.
What i found out (with PEID KANAL PLUGin) is that the file has crc32 protection, Blowfish, SHA1/RipEMD, and some PI fraction. Maybe this is some kind of integrity check?
Thanx for help lownoise