I don't claim to be an expert at a 2.xx Armadildo, but are you sure its copymem2 and not just debug blocker? On any armadildo I'm aware of except on VB Targets youll have to take action to prevent Dildo from messing up the IAT, IE on 4.xx there's the trick where you break on the start of the IAT and trace abit to disable it messing up the imports leaving you with a valid table etc. If it is CopyMem2, are you sure you defeated it correctly and the whole file is decrypted?