@nilsding It's denuvo. Pretty sure it works by just obfuscating the .exe by taking every function, then creating 20 new obfuscated functions to pass the data through until it does the actual thing it's supposed to. Of course how it actually works is proprietary. But if you have the following code in some fictional generic language:
return1 () {
return 1;
}
return1()
What Denuvo does is take it and pre-compilation turns it into something like the following (in reality it's probably way worse with all kinds of confusing pointers and shit):
aGVsbG8gd29ybG(ayy: int) {
return ayy * 2
}
8gd29ybGQgdGhpcyBpc(b: int) {
return 0IGZvciBiYXNlNjQgZ2V(b.toStr())
}
0IGZvciBiYXNlNjQgZ2V(i: str) {
r = i.toInt() / 16
return aGVsbG8gd29ybG(r)
}
GhpcyBp() {
return 8gd29ybGQgdGhpcyBpc(8)
}
GhpcyBp()