A Python 3 tool to statically deobfuscate functions protected by Themida 3.x's mutation-based obfuscation.
Features
Automatically resolve trampolines' destination addresses
Statically deobfuscate mutated functions
Rebuild fully working binaries
Binary Ninja integration
Known Limitations
Doesn't support ARM64 binaries
Homepage
Code:
https://github.com/ergrelet/themida-unmutate