Originally Posted by
scizzydo
There is a bunch of other functions that also use the movement structure. Anything that checks movement flags/moves you can be other ones.... Best thing to do though is learn how to de-obfuscate the obfuscations. They're fairly simple, looking for alternating jumps indicates something, looking at instructions that clear/set eflags before a jump, etc. If you can learn how to overcome that, you can write an IDA plugin to de-obfuscate the whole function to pseudocode it