diff --git a/loader/pico.spec b/loader/pico.spec
index 905fa19..5089a05 100644
--- a/loader/pico.spec
+++ b/loader/pico.spec
@@ -2,69 +2,71 @@ x64:
     load "bin/pico.x64.o"
         make object +disco
     
-        # merge the hook functions
-        load "bin/hooks.x64.o"
-            merge
+    # merge the hook functions
+    load "bin/hooks.x64.o"
+        merge
 
-        # merge the call stack spoofing
-        load "bin/spoof.x64.o"
-            merge
+    # merge the call stack spoofing
+    load "bin/spoof.x64.o"
+        merge
 
-        # merge the asm stub
-        load "bin/draugr.x64.bin"
-            linkfunc "draugr_stub"
+    # merge the asm stub
+    load "bin/draugr.x64.bin"
+        linkfunc "draugr_stub"
 
-        # merge mask
-        load "bin/mask.x64.o"
-            merge
+    # merge mask
+    load "bin/mask.x64.o"
+        merge
 
-        # generate and patch
-        # in a random key
-        generate $KEY 128
-        patch "xorkey" $KEY
+    # generate and patch in a random key
+    generate $KEY 128
+    patch "xorkey" $KEY
 
-        # merge cfg code
-        load "bin/cfg.x64.o"
-            merge
+    # merge cfg code
+    load "bin/cfg.x64.o"
+        merge
             
-        # merge cleanup
-        load "bin/cleanup.x64.o"
-            merge
+    # merge cleanup
+    load "bin/cleanup.x64.o"
+        merge
 
-        # export setup_hooks and setup_memory
-        exportfunc "setup_hooks"  "__tag_setup_hooks"
-        exportfunc "setup_memory" "__tag_setup_memory"
+    # export setup_hooks and setup_memory
+    exportfunc "setup_hooks"  "__tag_setup_hooks"
+    exportfunc "setup_memory" "__tag_setup_memory"
 
-        # hook functions in the DLL
-        addhook "WININET$InternetOpenA"       "_InternetOpenA"
-        addhook "WININET$InternetConnectA"    "_InternetConnectA"
-        addhook "KERNEL32$CloseHandle"        "_CloseHandle"
-        addhook "KERNEL32$CreateFileMappingA" "_CreateFileMappingA"
-        addhook "KERNEL32$CreateProcessA"     "_CreateProcessA"
-        addhook "KERNEL32$CreateRemoteThread" "_CreateRemoteThread"
-        addhook "KERNEL32$CreateThread"       "_CreateThread"
-        addhook "KERNEL32$DuplicateHandle"    "_DuplicateHandle"
-        addhook "KERNEL32$ExitThread"         "_ExitThread"
-        addhook "KERNEL32$GetProcAddress"     "_GetProcAddress"
-        addhook "KERNEL32$GetThreadContext"   "_GetThreadContext"
-        addhook "KERNEL32$LoadLibraryA"       "_LoadLibraryA"
-        addhook "KERNEL32$MapViewOfFile"      "_MapViewOfFile"
-        addhook "KERNEL32$OpenProcess"        "_OpenProcess"
-        addhook "KERNEL32$OpenThread"         "_OpenThread"
-        addhook "KERNEL32$ReadProcessMemory"  "_ReadProcessMemory"
-        addhook "KERNEL32$ResumeThread"       "_ResumeThread"
-        addhook "KERNEL32$SetThreadContext"   "_SetThreadContext"
-        addhook "KERNEL32$Sleep"              "_Sleep"
-        addhook "KERNEL32$UnmapViewOfFile"    "_UnmapViewOfFile"
-        addhook "KERNEL32$VirtualAlloc"       "_VirtualAlloc"
-        addhook "KERNEL32$VirtualAllocEx"     "_VirtualAllocEx"
-        addhook "KERNEL32$VirtualFree"        "_VirtualFree"
-        addhook "KERNEL32$VirtualProtect"     "_VirtualProtect"
-        addhook "KERNEL32$VirtualProtectEx"   "_VirtualProtectEx"
-        addhook "KERNEL32$VirtualQuery"       "_VirtualQuery"
-        addhook "KERNEL32$WriteProcessMemory" "_WriteProcessMemory"
-        addhook "OLE32$CoCreateInstance"      "_CoCreateInstance"
+    # hook functions in the DLL
+    addhook "WININET$InternetOpenA"       "_InternetOpenA"
+    addhook "WININET$InternetConnectA"    "_InternetConnectA"
+    addhook "KERNEL32$CloseHandle"        "_CloseHandle"
+    addhook "KERNEL32$CreateFileMappingA" "_CreateFileMappingA"
+    addhook "KERNEL32$CreateProcessA"     "_CreateProcessA"
+    addhook "KERNEL32$CreateRemoteThread" "_CreateRemoteThread"
+    addhook "KERNEL32$CreateThread"       "_CreateThread"
+    addhook "KERNEL32$DuplicateHandle"    "_DuplicateHandle"
+    addhook "KERNEL32$ExitThread"         "_ExitThread"
+    addhook "KERNEL32$GetProcAddress"     "_GetProcAddress"
+    addhook "KERNEL32$GetThreadContext"   "_GetThreadContext"
+    addhook "KERNEL32$LoadLibraryA"       "_LoadLibraryA"
+    addhook "KERNEL32$MapViewOfFile"      "_MapViewOfFile"
+    addhook "KERNEL32$OpenProcess"        "_OpenProcess"
+    addhook "KERNEL32$OpenThread"         "_OpenThread"
+    addhook "KERNEL32$ReadProcessMemory"  "_ReadProcessMemory"
+    addhook "KERNEL32$ResumeThread"       "_ResumeThread"
+    addhook "KERNEL32$SetThreadContext"   "_SetThreadContext"
+    addhook "KERNEL32$Sleep"              "_Sleep"
+    addhook "KERNEL32$UnmapViewOfFile"    "_UnmapViewOfFile"
+    addhook "KERNEL32$VirtualAlloc"       "_VirtualAlloc"
+    addhook "KERNEL32$VirtualAllocEx"     "_VirtualAllocEx"
+    addhook "KERNEL32$VirtualFree"        "_VirtualFree"
+    addhook "KERNEL32$VirtualProtect"     "_VirtualProtect"
+    addhook "KERNEL32$VirtualProtectEx"   "_VirtualProtectEx"
+    addhook "KERNEL32$VirtualQuery"       "_VirtualQuery"
+    addhook "KERNEL32$WriteProcessMemory" "_WriteProcessMemory"
+    addhook "OLE32$CoCreateInstance"      "_CoCreateInstance"
 
-        mergelib "../libtcg.x64.zip"
+    # hook functions in pico
+    attach "KERNEL32$VirtualProtect" "_VirtualProtect"  # this is needed to hook VirtualProtect in mask.c
+
+    mergelib "../libtcg.x64.zip"
 
     export
diff --git a/loader/src/cleanup.c b/loader/src/cleanup.c
index 3494efd..4446a69 100644
--- a/loader/src/cleanup.c
+++ b/loader/src/cleanup.c
@@ -11,7 +11,6 @@ DECLSPEC_IMPORT LPVOID WINAPI KERNEL32$HeapAlloc             ( HANDLE, DWORD, SI
 DECLSPEC_IMPORT VOID   WINAPI KERNEL32$RtlCaptureContext     ( PCONTEXT );
 DECLSPEC_IMPORT VOID   WINAPI KERNEL32$Sleep                 ( DWORD );
 DECLSPEC_IMPORT BOOL   WINAPI KERNEL32$VirtualFree           ( LPVOID, SIZE_T, DWORD );
-
 DECLSPEC_IMPORT ULONG  NTAPI  NTDLL$NtContinue               ( CONTEXT *, BOOLEAN );
 
 #define memcpy(x, y, z) __movsb ( ( unsigned char * ) x, ( unsigned char * ) y, z );
diff --git a/loader/src/mask.c b/loader/src/mask.c
index 7afbe2d..fe6ba3f 100644
--- a/loader/src/mask.c
+++ b/loader/src/mask.c
@@ -1,8 +1,6 @@
 #include <windows.h>
 #include "memory.h"
-#include "spoof.h"
 
-DECLSPEC_IMPORT VOID WINAPI KERNEL32$Sleep          ( DWORD );
 DECLSPEC_IMPORT BOOL WINAPI KERNEL32$VirtualProtect ( LPVOID, SIZE_T, DWORD, PDWORD );
 
 char xorkey [ 128 ] = { 1 };
diff --git a/local-loader/loader.spec b/local-loader/loader.spec
index 2ac63cd..d99eaf0 100644
--- a/local-loader/loader.spec
+++ b/local-loader/loader.spec
@@ -21,11 +21,10 @@ x64:
         linkfunc "draugr_stub"
 
     # hook functions that the loader uses
-    attach "KERNEL32$LoadLibraryA"    "_LoadLibraryA"
-    attach "KERNEL32$VirtualAlloc"    "_VirtualAlloc"
-    attach "KERNEL32$VirtualProtect"  "_VirtualProtect"
-    attach "KERNEL32$VirtualFree"     "_VirtualFree"
-
+    attach "KERNEL32$LoadLibraryA"   "_LoadLibraryA"
+    attach "KERNEL32$VirtualAlloc"   "_VirtualAlloc"
+    attach "KERNEL32$VirtualProtect" "_VirtualProtect"
+    attach "KERNEL32$VirtualFree"    "_VirtualFree"
     preserve "KERNEL32$LoadLibraryA" "init_frame_info"
 
     # mask & link the dll
diff --git a/local-loader/pico.spec b/local-loader/pico.spec
index ccccd0b..5089a05 100644
--- a/local-loader/pico.spec
+++ b/local-loader/pico.spec
@@ -2,68 +2,71 @@ x64:
     load "bin/pico.x64.o"
         make object +disco
     
-        # merge the hook functions
-        load "bin/hooks.x64.o"
-            merge
+    # merge the hook functions
+    load "bin/hooks.x64.o"
+        merge
 
-        # merge the call stack spoofing
-        load "bin/spoof.x64.o"
-            merge
+    # merge the call stack spoofing
+    load "bin/spoof.x64.o"
+        merge
 
-        # merge the asm stub
-        load "bin/draugr.x64.bin"
-            linkfunc "draugr_stub"
+    # merge the asm stub
+    load "bin/draugr.x64.bin"
+        linkfunc "draugr_stub"
 
-        # merge mask
-        load "bin/mask.x64.o"
-            merge
+    # merge mask
+    load "bin/mask.x64.o"
+        merge
 
-        # generate and patch
-        # in a random key
-        generate $KEY 128
-        patch "xorkey" $KEY
+    # generate and patch in a random key
+    generate $KEY 128
+    patch "xorkey" $KEY
 
-        # merge cfg code
-        load "bin/cfg.x64.o"
-            merge
+    # merge cfg code
+    load "bin/cfg.x64.o"
+        merge
             
-        # merge cleanup
-        load "bin/cleanup.x64.o"
-            merge
+    # merge cleanup
+    load "bin/cleanup.x64.o"
+        merge
 
-        # export setup_hooks and setup_memory
-        exportfunc "setup_hooks"  "__tag_setup_hooks"
-        exportfunc "setup_memory" "__tag_setup_memory"
+    # export setup_hooks and setup_memory
+    exportfunc "setup_hooks"  "__tag_setup_hooks"
+    exportfunc "setup_memory" "__tag_setup_memory"
 
-        # hook functions in the DLL
-        addhook "WININET$InternetOpenA"       "_InternetOpenA"
-        addhook "WININET$InternetConnectA"    "_InternetConnectA"
-        addhook "KERNEL32$CloseHandle"        "_CloseHandle"
-        addhook "KERNEL32$CreateFileMappingA" "_CreateFileMappingA"
-        addhook "KERNEL32$CreateProcessA"     "_CreateProcessA"
-        addhook "KERNEL32$CreateRemoteThread" "_CreateRemoteThread"
-        addhook "KERNEL32$CreateThread"       "_CreateThread"
-        addhook "KERNEL32$DuplicateHandle"    "_DuplicateHandle"
-        addhook "KERNEL32$ExitThread"         "_ExitThread"
-        addhook "KERNEL32$GetThreadContext"   "_GetThreadContext"
-        addhook "KERNEL32$LoadLibraryA"       "_LoadLibraryA"
-        addhook "KERNEL32$MapViewOfFile"      "_MapViewOfFile"
-        addhook "KERNEL32$OpenProcess"        "_OpenProcess"
-        addhook "KERNEL32$OpenThread"         "_OpenThread"
-        addhook "KERNEL32$ReadProcessMemory"  "_ReadProcessMemory"
-        addhook "KERNEL32$ResumeThread"       "_ResumeThread"
-        addhook "KERNEL32$SetThreadContext"   "_SetThreadContext"
-        addhook "KERNEL32$Sleep"              "_Sleep"
-        addhook "KERNEL32$UnmapViewOfFile"    "_UnmapViewOfFile"
-        addhook "KERNEL32$VirtualAlloc"       "_VirtualAlloc"
-        addhook "KERNEL32$VirtualAllocEx"     "_VirtualAllocEx"
-        addhook "KERNEL32$VirtualFree"        "_VirtualFree"
-        addhook "KERNEL32$VirtualProtect"     "_VirtualProtect"
-        addhook "KERNEL32$VirtualProtectEx"   "_VirtualProtectEx"
-        addhook "KERNEL32$VirtualQuery"       "_VirtualQuery"
-        addhook "KERNEL32$WriteProcessMemory" "_WriteProcessMemory"
-        addhook "OLE32$CoCreateInstance"      "_CoCreateInstance"
+    # hook functions in the DLL
+    addhook "WININET$InternetOpenA"       "_InternetOpenA"
+    addhook "WININET$InternetConnectA"    "_InternetConnectA"
+    addhook "KERNEL32$CloseHandle"        "_CloseHandle"
+    addhook "KERNEL32$CreateFileMappingA" "_CreateFileMappingA"
+    addhook "KERNEL32$CreateProcessA"     "_CreateProcessA"
+    addhook "KERNEL32$CreateRemoteThread" "_CreateRemoteThread"
+    addhook "KERNEL32$CreateThread"       "_CreateThread"
+    addhook "KERNEL32$DuplicateHandle"    "_DuplicateHandle"
+    addhook "KERNEL32$ExitThread"         "_ExitThread"
+    addhook "KERNEL32$GetProcAddress"     "_GetProcAddress"
+    addhook "KERNEL32$GetThreadContext"   "_GetThreadContext"
+    addhook "KERNEL32$LoadLibraryA"       "_LoadLibraryA"
+    addhook "KERNEL32$MapViewOfFile"      "_MapViewOfFile"
+    addhook "KERNEL32$OpenProcess"        "_OpenProcess"
+    addhook "KERNEL32$OpenThread"         "_OpenThread"
+    addhook "KERNEL32$ReadProcessMemory"  "_ReadProcessMemory"
+    addhook "KERNEL32$ResumeThread"       "_ResumeThread"
+    addhook "KERNEL32$SetThreadContext"   "_SetThreadContext"
+    addhook "KERNEL32$Sleep"              "_Sleep"
+    addhook "KERNEL32$UnmapViewOfFile"    "_UnmapViewOfFile"
+    addhook "KERNEL32$VirtualAlloc"       "_VirtualAlloc"
+    addhook "KERNEL32$VirtualAllocEx"     "_VirtualAllocEx"
+    addhook "KERNEL32$VirtualFree"        "_VirtualFree"
+    addhook "KERNEL32$VirtualProtect"     "_VirtualProtect"
+    addhook "KERNEL32$VirtualProtectEx"   "_VirtualProtectEx"
+    addhook "KERNEL32$VirtualQuery"       "_VirtualQuery"
+    addhook "KERNEL32$WriteProcessMemory" "_WriteProcessMemory"
+    addhook "OLE32$CoCreateInstance"      "_CoCreateInstance"
 
-        mergelib "../libtcg.x64.zip"
+    # hook functions in pico
+    attach "KERNEL32$VirtualProtect" "_VirtualProtect"  # this is needed to hook VirtualProtect in mask.c
+
+    mergelib "../libtcg.x64.zip"
 
     export
diff --git a/postex-loader/loader.spec b/postex-loader/loader.spec
index a423592..e2beb68 100644
--- a/postex-loader/loader.spec
+++ b/postex-loader/loader.spec
@@ -23,11 +23,10 @@ x64:
         link "draugr_stub"
 
     # hook functions that the loader uses
-    attach "KERNEL32$LoadLibraryA"    "_LoadLibraryA"
-    attach "KERNEL32$VirtualAlloc"    "_VirtualAlloc"
-    attach "KERNEL32$VirtualProtect"  "_VirtualProtect"
-    attach "KERNEL32$VirtualFree"     "_VirtualFree"
-
+    attach "KERNEL32$LoadLibraryA"   "_LoadLibraryA"
+    attach "KERNEL32$VirtualAlloc"   "_VirtualAlloc"
+    attach "KERNEL32$VirtualProtect" "_VirtualProtect"
+    attach "KERNEL32$VirtualFree"    "_VirtualFree"
     preserve "KERNEL32$LoadLibraryA" "init_frame_info"
 
     # mask & link the dll
diff --git a/postex-loader/pico.spec b/postex-loader/pico.spec
index acad412..021e111 100644
--- a/postex-loader/pico.spec
+++ b/postex-loader/pico.spec
@@ -2,34 +2,35 @@ x64:
     load "bin/pico.x64.o"
         make object +disco
     
-        # merge the hook functions
-        load "bin/hooks.x64.o"
-            merge
+    # merge the hook functions
+    load "bin/hooks.x64.o"
+        merge
 
-        # merge the call stack spoofing
-        load "bin/spoof.x64.o"
-            merge
+    # merge the call stack spoofing
+    load "bin/spoof.x64.o"
+        merge
 
-        # merge the asm stub
-        load "bin/draugr.x64.bin"
-            linkfunc "draugr_stub"
+    # merge the asm stub
+    load "bin/draugr.x64.bin"
+        linkfunc "draugr_stub"
 
-        # merge cfg code
-        load "bin/cfg.x64.o"
-            merge
+    # merge cfg code
+    load "bin/cfg.x64.o"
+        merge
             
-        # merge cleanup
-        load "bin/cleanup.x64.o"
-            merge
+    # merge cleanup
+    load "bin/cleanup.x64.o"
+        merge
 
-        # export setup_hooks and setup_memory
-        exportfunc "setup_hooks"  "__tag_setup_hooks"
-        exportfunc "setup_memory" "__tag_setup_memory"
+    # export setup_hooks and setup_memory
+    exportfunc "setup_hooks"  "__tag_setup_hooks"
+    exportfunc "setup_memory" "__tag_setup_memory"
 
-        # hook functions in the DLL
-        addhook "KERNEL32$LoadLibraryW"  "_LoadLibraryW"
-        addhook "KERNEL32$ExitThread"    "_ExitThread"
+    # hook functions in the DLL
+    addhook "KERNEL32$GetProcAddress" "_GetProcAddress"
+    addhook "KERNEL32$LoadLibraryW"   "_LoadLibraryW"
+    addhook "KERNEL32$ExitThread"     "_ExitThread"
 
-        mergelib "../libtcg.x64.zip"
+    mergelib "../libtcg.x64.zip"
 
     export
diff --git a/postex-loader/src/cleanup.c b/postex-loader/src/cleanup.c
index 70c5040..4446a69 100644
--- a/postex-loader/src/cleanup.c
+++ b/postex-loader/src/cleanup.c
@@ -1,7 +1,6 @@
 #include <windows.h>
 #include "memory.h"
 #include "cfg.h"
-#include "spoof.h"
 #include "tcg.h"
 
 DECLSPEC_IMPORT HANDLE WINAPI KERNEL32$CreateTimerQueue      ( );
@@ -12,7 +11,6 @@ DECLSPEC_IMPORT LPVOID WINAPI KERNEL32$HeapAlloc             ( HANDLE, DWORD, SI
 DECLSPEC_IMPORT VOID   WINAPI KERNEL32$RtlCaptureContext     ( PCONTEXT );
 DECLSPEC_IMPORT VOID   WINAPI KERNEL32$Sleep                 ( DWORD );
 DECLSPEC_IMPORT BOOL   WINAPI KERNEL32$VirtualFree           ( LPVOID, SIZE_T, DWORD );
-
 DECLSPEC_IMPORT ULONG  NTAPI  NTDLL$NtContinue               ( CONTEXT *, BOOLEAN );
 
 #define memcpy(x, y, z) __movsb ( ( unsigned char * ) x, ( unsigned char * ) y, z );
@@ -81,9 +79,6 @@ void cleanup_memory ( MEMORY_LAYOUT * memory )
             ctx_free[ 1 ].Rdx = ( DWORD64 ) ( 0 );
             ctx_free[ 1 ].R8  = ( DWORD64 ) ( MEM_RELEASE );
 
-            dprintf("dll @ 0x%p\n", memory->Dll.BaseAddress);
-            dprintf("pico @ 0x%p\n", memory->Pico.BaseAddress);
-
             /* give a decent delay so ExitThread has time to be called */
             KERNEL32$CreateTimerQueueTimer ( &timer, timer_queue, ( WAITORTIMERCALLBACK ) ( NTDLL$NtContinue ), &ctx_free [ 0 ], 500, 0, WT_EXECUTEINTIMERTHREAD );
             KERNEL32$CreateTimerQueueTimer ( &timer, timer_queue, ( WAITORTIMERCALLBACK ) ( NTDLL$NtContinue ), &ctx_free [ 1 ], 500, 0, WT_EXECUTEINTIMERTHREAD );