I am currently reversing a binary and I am stuck at understanding what the application is trying to do. There is a memcpy operation which is copying almost 1MB from a .data section to a .bss section. This operation is made in an initialising phase and I suspect that the code running subsequently is obfuscated. The reason I think this is that the subsequent code is very convoluted. Would the large memory block being loaded have anything to do with it being obfuscated, a virtual machine maybe? The code isn't junk afterwards but just too complicated to follow what it is doing. It doesn't seem to have any large jump tables so I am sure what I am looking at.