Had also a look at Denuvo a while ago. Used LLVM to remove the x86 obfuscation and broke it down to VM-Opcodes. Atleast back then, Denuvo seemd to translate gamecode into a stackmachine.

This is how a VM push looks like:

      temp[0]=add(mem[e268], fffffffffffffff8)
      mem[temp[0]]]=mem[e560]
      mem[e268]=temp[0]

(vmreg_e268 is stackpointer, its decremented and stored in tempreg, then the value of vmreg_e560 is copied to stackpointeraddr, then new stackpointervalue is written back)

But i quickly lost interest when it became MBA galore:

      temp[7]=sub(add(add(and(mem[ebe8], b2f7), 3fd8), xor(lshr(mem[ebe8], 1), 2684)), lshr(add(mem[ebe8], b2f8), 1))
      temp[d]=or(sub(sub(4ad, temp[7]), xor(and(shl(temp[7], 1), 95c), 95c)), 8000)
      temp[e]=lshr(temp[d], 1)
      temp[11]=lshr(add(temp[d], 8001), 1)
      mem[ebe8]=sub(xor(xor(temp[e], 3fff), temp[11]), shl(and(and(temp[e], 3fff), temp[11]), 1))

(looks like its doing some operation with a constant to vmreg_ebe8, but obfuscated by MBAs and most likely the result won't ever being used, so its just noise to drown out the real operations)

BTW: anyone aware of LLVM optimizer passimplementations that can deal with MBAs ?