Aaron,
>>At what stage does your Hardlock shell tool decrypt the exe ? Does it decrypt it when loading it into memory ?<<
What the manufacturer's manual says is that the exe's entire binary image is subject to encryption and this is only transformed back into its original form once the program is running.
You get a modified exe which at run time loads and decrypt your app. "on the fly".
Regards,
Roberto