It's called an Obfuscation Virtual Machine running custom opcodes. These opcodes were decoded in a special way and a single x86 instruction like mov imm, reg

It's called an Obfuscation Virtual Machine running custom opcodes. These opcodes were decoded in a special way and a single x86 instruction like mov imm, reg would get translated in 20-30 instructions most of them junk, but they were not laid out contiguously, you would execute one junk instruction and then return to the dispatcher to get to the next one, if I remember correctly. This made the VM and tracing dog slow. Additionally it used a small 256 or 1024 byte scratch buffer for the virtual registers that held data. I've forgotten now how it was exactly. The entire VM used only jmp instructions which was how you would spot it.