Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as:
mov edx, 5B1F04F1h
xor edx, 6ADB1F45h
add edx, 0CE3BE450h
Can be convert to:
mov r32, imm32_1
xor r32, imm32_2
add r32, imm32_3
Pack into:
mov r32, (imm32_1 ^ imm32_2 + imm32_3)
And later become:
mov edx, 4h
