For further deobfuscation you might want to record runtime stats and code flow.