poly_oep_enter is deobsfucated call to poly_oep
purpose of this call is to save registers + data to recognize VM opcode
it can be found in poly oep by sig scanning for

push xxxxx
call __poly_oep_enter

poly_oep_out is deobsfucated procedure which will take us to real code


hash procs are actually parts of VM, at first I tought that those
are hashing procs but those are only used to extract data from VM opcode.

hash_proc1.asm is used in poly_oep_dispatcher to find correct VM opcode
hash_proc2.asm is used to determine if this is call/jmp or jcc or emulated
               cmp/jcc

other hashing procs (3/4) are used to extract RVA where jcc goes if jmp taken/not taken
                          or to extract RVA of code in poly oep or in code depending
                          where entry goes

others are used in cmp/jcc emulation and are used to extracteither data from registers
                or are used to see what kind of comparation we have
                
vm_dataz.asm are only data used by poly_oep_dispatcher to determine what and when
                 VM opcode procedure to call and also have some constants important
                 for jcc type identification, also it has number of poly entries,
                 imagebase, poly_oep_va, start of VM opcodes and their size (3A)
                 etc...
                 
poly_oep.asm - this is complete RIP of poly_oep_dispatcher and needed procedures
               to run poly_oep as is without fixing. This is compiled as .dll
               and in aspr_new_approach.exe is injected loader which will load
               poly_oep.dll and call poly_oep_start export. From there everything
               is going like a charm, poly_oep is called and all obsfucation is
               handled by ASPR itself.
                              
VERY importatn part is here in poly_oep.asm, also present in all poly_oep_dispatchers
               in 2.xx SKE versions of ASPR:
               
		mov     eax, 114h        ;mov	eax, ds:aspr_saved_apis
		                         ;mov	eax, [eax+34h]
		                         ;call	eax		; GetCurrentProcessId               

This part is probably used to make poly_oep specific for current process so applying it
to other process will not help. My trick is simple, return PID of process that I'm 
dumping. neet isn't it :P

               
                                                                  