nice info...thanks...
but why don't you rebuild the complete code section?
write a small prog which scans the code section for these special calls/jumps
and then copy the spliced opcodes back to their original position.

imho it's the best way to remove anything related to the protector.