search for: 0075f0cb

...at 0x757000, and then then program ran normally. Probably no coincidence, since the next writable segment starts at 0x759000. So apparently the program is designed to throw the exceptions. Just before the call to VirtualProtect: 0806d398:Call kernel32.SetUnhandledExceptionFilter(0075f447) ret=0075f0cb 0806d398:Ret kernel32.SetUnhandledExceptionFilter() retval=00000000 ret=0075f0cb This function is this: 0075F447 sub_75F447 proc near 0075F447 call sub_75F047 0075F44C xor eax, eax 0075F44E retn 4 0075F44E sub_75F447 endp eax...