🧩
Encrypted payload dump
Locates the encrypted blob inside the host PE, applies the detected XOR / RC4 / AES routine, and writes the raw decrypted payload to disk.
Windows PE reverse-engineering tool
Decrypt, rebuild & mount encrypted DLL payloads
dll-decryptor dumps encrypted DLL payloads, resolves the import table, rebuilds
the PE headers, and exports or memory-maps the decrypted module — ready for static
analysis or live loading in one pass.
48,200+
Downloads
v2.4.1
Latest release
Windows 10 / 11
Platform
Free & open source
License
Features
Everything you need to unwrap a protected module
Built for analysts who need a decrypted DLL they can actually load, link and inspect.
🔗