De-obfuscating Malware (Subtracting Hex)