britedream,

I had the exact same IAT as you, so I guess I did at least that much correctly . But, you are absolutely correct on the OEP and stolen bytes; I missed the PUSH EBX, but at least had the correct distance between EBP and ESP...

I am reviewing the rest of the information you posted, of the addresses to patch. Thank you very much for looking into this , it is nice to see the solution to this after as much time as I spent trying to figure it out, unsuccessfully.