Function at 0xa7b5d1
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push ebp
jmp 0xa7b4f5
xchg dword [esp], ebp
pop esp
push dword [esp]
pop eax
jmp 0xa7b5c9
jmp 0xa7b65e
mov ebp, 4
add ecx, ebp
pop ebp
add ecx, 4
xchg dword [esp], ecx
jmp 0xa7b57c
pop esp
jmp 0xa7b5b5
add edi, 0xcc449b14
sub eax, edi
pop edi
jmp 0xa7b4e6
push ecx
mov ecx, esp
jmp 0xa7b482
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
jmp 0xa7b48f
push eax
push esp
jmp 0xa7b712
xchg dword [esp], edx
mov esp, dword [esp]
mov ecx, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], edx
push ecx
jmp 0xa7b7ec
pop ebp
xchg dword [esp], edx
pop esp
add edx, 0x69a627f8
add edx, ecx
jmp 0xa7b6ac
add esp, 4
jmp 0xa7b832
pop ecx
push ebp
push esp
pop ebp
add ebp, 4
add ebp, 4
jmp 0xa7b6bb
sub edx, 0x69a627f8
mov ecx, dword [esp]
push eax
jmp 0xa7b6e4
xchg dword [esp], ebp
jmp 0xa7b72d
mov esp, dword [esp]
push ebx
push edx
mov ebx, dword [esp]
jmp 0xa7b7a7
push ecx
mov esi, dword [esp]
add esp, 4
push 0x6970264e
mov dword [esp], esi
jmp 0xa7b778
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
pop ebx
jmp 0xa7b7e7
push 0x7ba78bd1
mov dword [esp], edx
mov edx, 0x6faed7e1
dec edx
add edx, 0x73bb1680
push edx
jmp 0xa7b8f8
pop eax
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], ecx
push eax
push dword [esp]
jmp 0xa7b69a
pop esp
push esi
jmp 0xa7b6d0
add edi, 4
xchg dword [esp], edi
jmp 0xa7b6c3
push ebp
mov dword [esp], edi
mov edi, esp
add edi, 4
push ecx
mov ecx, 4
add edi, 0x74cfd662
sub edi, 0x7a372333
jmp 0xa7b913
mov ebp, 0x17ef1cb8
push ebp
sub dword [esp], 0x56dfc8e0
pop ecx
jmp 0xa7b7d7
pop eax
push dword [esp]
mov esi, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
add edx, 4
jmp 0xa7b665
sub edi, 0x74cfd662
mov ecx, dword [esp]
add esp, 4
jmp 0xa7b7ce
add esp, 4
push ebx
jmp 0xa7b7b3
push edx
mov dword [esp], eax
mov eax, 0x17ef1cb8
sub dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
pop edx
push ecx
push ebp
jmp 0xa7b765
xchg dword [esp], edi
pop esp
jmp 0xa7b734
add ecx, 0x56dfc8e0
push dword [esp]
pop ebp
push edx
jmp 0xa7b80b
jmp 0xa7b920
mov dword [esp], esi
push eax
mov dword [esp], ecx
mov dword [esp], edx
push ecx
mov dword [esp], ebx
push esi
mov dword [esp], 0x52c1cfce
mov dword [esp], esi
push ecx
jmp 0xa7b846
push esp
pop edx
add edx, 4
push 0x741d5b3b
mov dword [esp], ebp
mov ebp, 0x5d7b0f00
shl ebp, 7
shr ebp, 3
add ebp, 0x7eedcfbe
push ebx
jmp 0xa7b8a3
add esi, 0x78e971af
mov ecx, esi
push dword [esp]
pop esi
push edi
mov edi, esp
jmp 0xa7b6f8
push ebp
mov ebp, 0x7ffc7c66
mov ecx, ebp
pop ebp
not ecx
add ecx, 0x733dff74
not ecx
shl ecx, 2
add ecx, 0x7f52f1e6
add ecx, 0xbcaf0d26
mov esi, ecx
jmp 0xa7b86f
pop ecx
xor dword [esp + 4], esi
pop esi
pop edx
xor edx, 0x6efbf2d4
mov esi, edx
pop edx
push 0x2bac5d3c
mov dword [esp], esi
xor dword [esp], 0x3fb8dc7d
pop edx
xor edx, 0x3fb8dc7d
mov esi, dword [esp]
add esp, 4
jmp 0xa7b8b2
mov ebx, 0x969ebfba
sub ebp, ebx
pop ebx
add edx, ebp
jmp 0xa7b680
push edx
sub dword [esp], 0x7e774fff
mov ebx, dword [esp]
jmp 0xa7b8c2
add esp, 4
jmp 0xa7b8cd
add ebx, 0x7e774fff
mov edx, dword [esp]
add esp, 4
push esi
push ebx
mov dword [esp], ebp
jmp 0xa7b8e6
mov dword [esp], ecx
sub dword [esp], 0x78e971af
mov esi, dword [esp]
jmp 0xa7b692
not dword [esp]
pop edx
add edx, 0x7fd99273
add edx, 0x63905bf2
add edi, edx
push dword [esp]
pop edx
jmp 0xa7b742
add edi, ecx
add edi, 0x7a372333
jmp 0xa7b793
jmp 0xa7bcdb
push 0x4bf097b9
mov dword [esp], edi
mov dword [esp], ebp
mov dword [esp], eax
push dword [esp]
push dword [esp]
jmp 0xa7bd47
add edi, 4
jmp 0xa7bd8b
dec ecx
push esi
mov esi, 0x2fbe1356
xor esi, 0x6efdfa41
sub esi, 0x35ed33cb
inc esi
jmp 0xa7bdce
add esp, 4
add esp, 4
push esi
mov esi, esp
jmp 0xa7bd61
mov ecx, 0x3fcd8873
jmp 0xa7bcff
add eax, edx
pop edx
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
jmp 0xa7be2a
mov eax, dword [esp]
jmp 0xa7bd18
add esp, 4
xchg dword [esp], esi
mov esp, dword [esp]
push ebx
push dword [esp]
jmp 0xa7bdb7
push edi
mov dword [esp], ebp
push edx
jmp 0xa7bd6b
mov edx, 4
mov ebp, edx
pop edx
add esi, ebp
mov ebp, dword [esp]
add esp, 4
push 0x507a96a0
mov dword [esp], ecx
jmp 0xa7bd29
xchg dword [esp], edi
mov esp, dword [esp]
add esp, 4
push edi
mov edi, 4
add eax, edi
pop edi
push esi
mov dword [esp], edx
mov edx, 4
jmp 0xa7bd33
pop esi
sub esi, 0x65eb08b5
jmp 0xa7bdfb
mov ebx, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
jmp 0xa7be0b
and esi, 0x7c7f32f7
and esi, 0x5fa4096d
sub esi, 0x47d188b3
add ecx, esi
jmp 0xa7bdab
push dword [esp]
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
jmp 0xa7bcf4
add esi, ecx
add esi, 0x65eb08b5
mov ecx, dword [esp]
jmp 0xa7bd4f
pop esp
push 0x71c75b00
mov dword [esp], eax
sub esp, 4
push esp
pop dword [esp]
add dword [esp], 4
jmp 0xa7bde7
call 0xa7be2f
push dword [esp]
pop eax
push 0x389c73fc
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], eax
mov eax, 0x17f5092c
jmp 0xa7be5d
xchg dword [esp], ebp
pop esp
push ebx
push edx
jmp 0xa7be64
jmp 0xa7bfa2
neg eax
jmp 0xa7bf51
mov dword [esp], ebp
jmp 0xa7bec7
pop edx
jmp 0xa7bee8
mov ebp, esp
jmp 0xa7bf0b
add esp, 4
jmp 0xa7be89
mov eax, dword [esp]
jmp 0xa7be79
add ebp, ecx
pop ecx
add ebp, eax
sub ebp, 0x4fe5b25c
mov eax, dword [esp]
push 0x5d4407c7
mov dword [esp], esi
push 0x4e45a4d5
mov dword [esp], esp
add dword [esp], 4
pop esi
push eax
mov eax, 4
add esi, eax
pop eax
add esi, 4
xchg dword [esp], esi
pop esp
add ebp, 4
jmp 0xa7be4d
mov dword [esp], edi
push 0x60ba8532
mov dword [esp], ecx
mov ecx, 0x7bfffa04
push 0x6a671d16
mov dword [esp], edx
mov edx, ecx
push edx
pop edi
jmp 0xa7be6c
pop ecx
jmp 0xa7beee
mov ebx, 0x7bfff8a2
xor ebx, edi
mov edi, dword [esp]
sub esp, 4
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
jmp 0xa7bf29
add ebp, 4
sub esp, 4
mov dword [esp], ecx
jmp 0xa7bf1c
mov ecx, 4
add ebp, ecx
pop ecx
jmp 0xa7bf2f
push eax
jmp 0xa7bf3e
push ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
jmp 0xa7be58
mov eax, 4
add ecx, eax
pop eax
xchg dword [esp], ecx
pop esp
sub eax, ebx
jmp 0xa7bf8e
add eax, 0x17f50930
push ebp
mov dword [esp], ecx
mov ecx, 0x3f26f7ab
xor ecx, 0x78992186
and ecx, 0x67ea75eb
push ecx
xchg dword [esp], ecx
not ecx
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop ecx
add ecx, 0x7adc4fb3
push eax
mov eax, 0x7cd449d5
xor ecx, eax
jmp 0xa7be81
push dword [esp]
jmp 0xa7bf96
mov ebx, dword [esp]
add esp, 4
push ebp
jmp 0xa7be72
mov ecx, ebx
jmp 0xa7c2c1
mov eax, 0
cmp byte [ebp + 0x12453051], 0
je 0xa7c307
mov byte [ebp + 0x122d2f9e], 0x53
mov eax, 0x83d7652c
push eax
mov dword [esp], eax
push dword [ebp + 0x122d06b9]
call dword [ebp + 0x122d2d0e]
mov ebx, eax
lea eax, [ebp + 0x12453091]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x12453051]
push eax
mov dword [esp], eax
call ebx
cmp dword [ebp + 0x1245301f], 0
je 0xa7c31e
mov dword [ebp + 0x122d3841], 1
mov byte [ebp + 0x122d2f9e], 0x47
mov eax, 0x906d6c8d
nop
push eax
nop
push dword [ebp + 0x122d06b9]
call dword [ebp + 0x122d2d0e]
call eax
mov edi, eax
cmp byte [edi], 0x22
jne 0xa7c368
inc edi
mov al, 0x22
scasb al, byte es:[edi]
jne 0xa7c349
cmp byte [edi], 0
je 0xa7c728
inc edi
cmp byte [edi], 0
je 0xa7c728
jmp 0xa7c386
cmp byte [edi], 0
je 0xa7c728
cmp byte [edi], 0x20
jne 0xa7c380
inc edi
jmp 0xa7c386
inc edi
jmp 0xa7c368
cmp byte [edi], 0
jne 0xa7c394
jmp 0xa7c728
cmp byte [edi], 0x20
jne 0xa7c3a3
inc edi
jmp 0xa7c394
cmp byte [edi], 0
jne 0xa7c3b1
jmp 0xa7c728
call fcn.00a7c3c0
jmp 0xa7c386
mov eax, 0
test eax, eax
je 0xa7c73f
mov dword [ebp + 0x122d38d9], 0
cmp byte [ebp + 0x12453044], 0
je 0xa7c756
mov dword [ebp + 0x122d3841], 1
mov byte [ebp + 0x122d2f9e], 0x49
mov eax, 0x8c1529e9
push eax
mov dword [esp], eax
push dword [ebp + 0x122d06b9]
call dword [ebp + 0x122d2d0e]
mov dword [ebp + 0x122d373d], eax
mov byte [ebp + 0x122d2f9e], 0x49
mov eax, 0xf74ad7ca
nop
push eax
nop
push dword [ebp + 0x122d06b9]
call dword [ebp + 0x122d2d0e]
mov dword [ebp + 0x122d27ea], eax
cmp dword [ebp + 0x122d092d], 0
je 0xa7c839
mov byte [ebp + 0x122d2f9e], 0x47
mov eax, 0x83d0b5f3
nop
push eax
nop
push dword [ebp + 0x122d06b9]
call dword [ebp + 0x122d2d0e]
mov ebx, eax
push 0x10
lea eax, [ebp + 0x12453299]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x12453291]
push eax
mov dword [esp], eax
call ebx
test eax, eax
je 0xa7c839
lea eax, [ebp + 0x12453299]
push eax
mov dword [esp], eax
call fcn.00a7c6f1
mov dword [ebp + 0x122d39c9], eax
push 4
push dword [ebp + 0x122d39c9]
call dword [ebp + 0x122d373d]
test eax, eax
jne 0xa7c82f
mov eax, dword [ebp + 0x122d39c9]
cmp dword [eax], 0x9a761b13
je 0xa7c82a
mov dword [ebp + 0x122d39c9], 0
jmp 0xa7c839
mov dword [ebp + 0x122d39c9], 0
mov ecx, eax
jmp 0xa7d940
push ebx
mov dword [esp], edx
push esp
pop dword [esp]
push edi
push ecx
jmp 0xa80041
mov ecx, dword [esp]
add esp, 4
add edi, 4
jmp 0xa7f47c
mov ebp, esp
jmp 0xa800ac
mov esi, esp
jmp 0xa7ff7b
pop ebp
add eax, esi
add eax, 0x7da7b03a
pop esi
add esi, eax
pop eax
push ecx
mov ecx, 4
add esi, ecx
pop ecx
push 0x3b53500
mov dword [esp], esi
push dword [esp + 4]
pop esi
pop dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x122d39dd], 0
jne 0xa7dbd4
cmp dword [ebp + 0x122d3841], 0
je 0xa7dbe3
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2e38]
pop eax
cmp dword [ebp + 0x122d3841], 0
je 0xa7dbf9
push eax
mov eax, 0
call dword [ebp + 0x122d1f9f]
pop eax
push ebp
jmp 0xa7f5d7
mov eax, 0x6f6e5431
xor dword [esp + 4], eax
mov eax, dword [esp]
push ecx
mov ecx, esp
push 0x3105c166
mov dword [esp], ebx
jmp 0xa800c0
and ecx, 0x3f3a0430
dec ecx
shr ecx, 3
jmp 0xa80f93
push ebx
mov ebx, 0x5ff7e0a5
sub dword [esp + 8], ebx
pop ebx
push dword [esp]
pop edi
add esp, 4
mov eax, dword [esp]
push eax
push esp
pop eax
push ecx
mov ecx, 4
add eax, ecx
pop ecx
add eax, 4
sub esp, 4
mov dword [esp], eax
jmp 0xa81eab
xchg dword [esp], ecx
mov esp, dword [esp]
pop dword [esp]
mov esp, dword [esp]
mov dword [ebp + 0x122d2181], eax
mov dword [ebp + 0x122d2eea], 0
sub esp, 4
mov dword [esp], eax
mov dword [esp], 0x619e703e
mov dword [esp], eax
push edi
jmp 0xa804e3
xchg dword [esp], edi
pop esp
push esi
mov esi, 0x7f3fc80f
sub esi, 0x5833637d
add esi, 0x4861ef9f
xor eax, esi
pop esi
cmp dword [ebp + 0x122d39dd], 0
jne 0xa7f4a7
cmp dword [ebp + 0x122d3841], 0
je 0xa7f4bc
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d3147], eax
call dword [ebp + 0x122d3041]
pop eax
push esi
push esp
pop esi
jmp 0xa80f04
mov dword [esp], eax
push ebp
mov ebp, 0x66fde2b3
sub esp, 4
mov dword [esp], esi
jmp 0xa80da8
add esi, 0x80bf8678
push ebp
jmp 0xa82afb
push eax
push ecx
push 0x79ef233f
pop ecx
mov eax, 0x1c2e60b
sub eax, 0x5bf9e370
add eax, ecx
add eax, 0x5bf9e370
pop ecx
xchg ebp, eax
xchg ebp, ebx
dec ebx
xchg ebp, ebx
xchg ebp, eax
jmp 0xa80e4d
mov ecx, 4
mov edi, ecx
jmp 0xa81e8f
push 0x585bcf91
mov dword [esp], ebx
mov ebx, 4
add ebp, ebx
jmp 0xa80ff2
mov ebx, 4
add ecx, ebx
mov ebx, dword [esp]
add esp, 4
jmp 0xa80916
mov dword [esp], eax
jmp 0xa7e323
push ebp
mov ebp, 4
add ecx, ebp
pop ebp
xchg dword [esp], ecx
pop esp
push dword [esp]
pop eax
push edi
push esp
pop edi
push ecx
jmp 0xa80b8a
mov ecx, 0x59ddff3b
jmp 0xa7e6b7
mov esi, 0x1b5e4a8c
jmp 0xa7e408
inc eax
jmp 0xa82730
add esi, 4
sub esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
jmp 0xa810c5
shr ecx, 3
neg ecx
xor ecx, 0x84e48c48
add ecx, 0x8480ec4c
add edi, ecx
jmp 0xa7dae5
mov ebx, dword [esp]
add esp, 4
push edi
push edx
jmp 0xa813a9
pop esp
mov dword [esp], ebp
mov dword [esp], eax
push eax
jmp 0xa81d7a
push ecx
mov dword [esp], 0x7ff7a1e2
pop edx
xor edx, 0x73f46a00
sub edx, 0xc03cbde
mov edi, edx
pop edx
add ebp, 0x7df64c6c
add ebp, edi
sub ebp, 0x7df64c6c
pop edi
xchg dword [esp], ebp
pop esp
sub eax, 0x77a771e9
push ebp
jmp 0xa81f42
mov dword [esp], 0x4776e137
mov dword [esp], edx
mov edx, 0x77a771e9
add dword [esp + 4], edx
pop edx
push dword [esp]
mov eax, dword [esp]
add esp, 4
push ebp
jmp 0xa7daf9
pop ecx
add dword [esp + 4], 0x5ff7e0a5
add dword [esp + 4], edi
jmp 0xa7ef0f
push dword [esp + 4]
mov eax, dword [esp]
jmp 0xa82219
mov dword [esp], 0x42dc814f
mov dword [esp], eax
jmp 0xa82480
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
jmp 0xa7f113
mov eax, dword [esp]
push edx
mov dword [esp], esi
jmp 0xa7db56
shr eax, 6
push esi
mov esi, 0x7d51b167
jmp 0xa7f7e6
mov ebp, 0x7da7b03a
jmp 0xa82dba
sub eax, ebp
jmp 0xa7db9a