[TippeX]

heh disassembly is only the first step, you'll definately need to debug it, so u gotta figure out how to bypass the anti debug, then you have to figure out what the ring 0 drivers do , then what the ring 3 code does, then figure out what the vm's do, then rebuild exe, repair imports, handle hidden file system, handle vm p-code (if present), tons of work....