The structure was classic. There was the "Entry Stub," a tiny chunk of code that pushed the arguments onto a stack, set up the virtual instruction pointer (VIP), and jumped into the heart of the beast—the VMDispatcher .

Here's a high-level overview of how VMProtect works:

A typical VM handler looks like this: