I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps.
<func1>:
0: insn..
1: jmpq xx100
2: callq sub
3: jmpq xx104
...
<nonfunc>:
..
xx100: insn...
xx101: jmpq 2
..
xx104: insn
...
Is there a tool/plugin that can reassemble the function code by following the jmpq blocks and appending the chunks? I guess it is not that trivial because you also have to account for relative offsets and patch relocation sections, etc. .