Finding the OEP is only half the battle. Once your debugger is paused at the OEP, the unpacked code exists entirely in the virtual memory of your computer, but it cannot yet run as a standalone file on disk. You must use two tools to rebuild it: 1. Dumping the Memory (Scylla or OllyDumpEx)
The very first instruction (or one of the first few) will almost certainly be PUSHAD . This instruction pushes all general-purpose registers onto the stack to save the original environment. aspack unpacker
is a popular 32-bit Windows executable compressor used to reduce file sizes (by up to 70%) and provide a layer of protection against basic reverse engineering. Finding the OEP is only half the battle