This runs on what is essentially an emulator, and I expect it to use techniques that rewrites executable memory or does unusual system calls. Malware use similar techniques to hide themselves, and therefore, false positives are to be expected.

These are also very common in size constrained demoscene productions. This especially funny to coders who work really hard to squeeze every single byte out of their production to suggest that they can fit a malware in there.