A lot of the time I find that the actual stolen bytes are simply parts of the standard startup code for a certain compiler, so once you know what it's been compiled with, it's normally easy to replace the stolen bytes by simply copying and pasting from another program compiled in the same way. Certainly easier than trying to find the original bytes, and much faster
