Help Finding VA_DecryCall and VA_DecryCallCore

[cw2k]

Oh dear thats years now.

Well in the beginning you use the script with the old and original version it was supposed to be used.

Load the Dll twice in olly. The base adress should stay the same.
If it's changing it's because of ASLR
Disable it using EMET.

Well VA_DecryCall is the adress of the Call that does the string decryption.
You may find that easy while debugging the ioncube dll and come across encrypted strings.