  Disassembly is a challenging task, particularly for obfuscated executables
containing junk bytes, which is designed to induce disassembly errors. Existing
solutions rely on heuristics or leverage machine learning techniques, but only
achieve limited successes. Fundamentally, such obfuscation cannot be defeated
without in-depth understanding of the binary executable's semantics, which is
made possible by the emergence of large language models (LLMs). In this paper,
we present DisasLLM, a novel LLM-driven dissembler to overcome the challenge in
analyzing obfuscated executables. DisasLLM consists of two components: an
LLM-based classifier that determines whether an instruction in an assembly code
snippet is correctly decoded, and a disassembly strategy that leverages this
model to disassemble obfuscated executables end-to-end. We evaluated DisasLLM
on a set of heavily obfuscated executables, which is shown to significantly
outperform other state-of-the-art disassembly solutions.
