Decrypted SYS4AB: 0x2c header (S4AB magic + 0x10E000 size + 8-byte key) then XOR-0xFF payload == AGE.EXE byte-for-byte. Not a patched/unpacked VM. Real handler code exists only unpacked in the runtime heap (0x62411000). Corrects the 'likely the patched VM' assumption. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>