have you tried using Re-Pair or have you considered the possibility
that it may be using the %S%S trick on OutPutDebugString() vulnerability
there is a thread here about it named armadillo crashes ollydbg