Themida 3.x Unpacker -

Themida 3.x replaces direct API calls with a massive dispatcher function. All imported functions are resolved at runtime via a custom loader. Rebuilding a clean IAT requires hooking the loader and logging every resolved API.

Anyone working with Themida unpacking should be aware of important safety and legal issues. Themida 3.x Unpacker

The open-source standard for user-mode debugging on Windows. Themida 3

The closest you can get to an unpacker is a combination of: Themida 3.x Unpacker

Before unpacking, you must subvert the anti-debug. A custom unpacker for Themida 3.x would need a kernel driver (or a sophisticated userland hook) to:

Themida 3.x relies on layered security to defeat standard debugging workflows. 1. Code Virtualization (SecureEngine)