Easy,Run ProcHollow1.exe , bp on LoadResourcesave loaded resource as childxxxxx.exe and run ollybp on 00A4215Dthe flag is written as byte sequences00A4215D   |.  C685 94FEFFFF>MOV BYTE PTR SS:[EBP-16C],41<span>00A42164   |.  C685 95FEFFFF>MOV BYTE PTR SS:[EBP-16B],52...--------------or u can nop this call00A422E5   |.  E8 2AEDFFFF   CALL ProcHoll.00A41014and rundecrypted : ARIA_IS_GOOOD!~!</span>