Trace the VM compares. I doubt they changed it that much.
Break on checksummappedfile, then bp in the VM (CISC)
cmp ecx,eax
pushfd
In RISC it'll be slightly different, can't remember something like cmp eax, ebx or so.
The correct checksum will be the one that differs from the original.
