Dropper Analysis: Stage 0 → ShellcodeReversing a multi-stage dropper: XOR-encrypted stage-1, reflective PE loader, final shellcode execution.