Function at 0xbb5a10
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
add eax, 0x493f4cc3
pop edi
xor eax, 0x2c02abc
sub eax, 0x70b45124
jmp 0xbb59dd
add ebx, 0x24842f0d
add ebx, 0x8c3e97ff
add esi, ebx
pop ebx
sub esi, 4
xchg dword [esp], esi
jmp 0xbb1468
pop esp
mov dword [esp], ebp
push eax
mov eax, 0x5d896e8b
jmp 0xbb3b7f
mov dword [esp], ecx
mov ecx, 0x32f95af2
jmp 0xbb1bc6
add dword [esp + 4], ecx
mov ecx, dword [esp]
jmp 0xbb5c99
push 0x1b521852
jmp 0xbb32a5
push edx
mov edx, 0x41e0de4
sub edx, 0x94e0f87c
add eax, edx
jmp 0xbb4f77
add dword [esp], 4
pop eax
sub esp, 4
mov dword [esp], esi
mov esi, 0x5c935da8
sub esi, 0x7c511570
dec esi
jmp 0xbb543d
add esi, 4
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
jmp 0xbb34ce
mov dword [esp], eax
jmp 0xbb1f1b
add edi, 0x78704d1a
not edi
xor edi, 0x8e704144
add edx, edi
pop edi
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
push ebp
sub esp, 4
mov dword [esp], ecx
mov ecx, eax
push 0x2e3f
mov dword [esp], eax
mov eax, ecx
mov ebp, eax
pop eax
push dword [esp]
jmp 0xbb5767
pop esp
mov ebp, dword [esp]
add esp, 4
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb187a
cmp dword [ebp + 0x10da27fb], 0
je 0xbb1889
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x10da19ea]
pop eax
push 0x3116
mov dword [esp], edx
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
push ecx
jmp 0xbb18d0
sub esp, 4
push esp
pop dword [esp]
add dword [esp], 4
jmp 0xbb4e8d
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
jmp 0xbb25d9
mov eax, dword [esp]
push ebx
mov dword [esp], esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
push edx
push ebp
mov ebp, 0x5ca741d2
mov edx, 0x9c585f69
sub edx, ebp
jmp 0xbb53a3
xor dword [esp + 4], ebp
pop ebp
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push 0x466b
mov dword [esp], ecx
push ebp
mov ebp, 0x72b51359
mov ecx, ebp
pop ebp
xor ecx, 0x599739f1
jmp 0xbb329c
push ecx
mov ecx, 0x1cbe7501
mov eax, 0x2f2bf074
jmp 0xbb15cb
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb19c1
cmp dword [ebp + 0x10da27fb], 0
je 0xbb19d6
push eax
mov eax, eax
mov eax, 0x7d1
mov dword [ebp + 0x10da1a85], eax
call dword [ebp + 0x10da1afa]
pop eax
push eax
push edi
push esi
push 0x25d74edd
pop esi
and esi, 0x53801a08
shr esi, 4
shl esi, 5
jmp 0xbb1f73
add edi, ecx
pushfd
add dword [ebp + 0x4c400], edi
add byte [eax], al
xor edi, dword [esp]
xor dword [esp], edi
jmp 0xbb20b8
push esp
pop ecx
add ecx, 4
push edx
push 4
pop edx
add ecx, edx
pop edx
jmp 0xbb2d36
pop edi
sub eax, 0x493f4cc3
sub eax, edi
jmp 0xbb12db
and ecx, 0x21ea778d
jmp 0xbb3210
add edi, 0x5a207a62
add edi, 0x471b8610
xor dword [esp + 4], edi
pop edi
jmp 0xbb18e6
xchg ebx, ecx
neg ecx
xchg ebx, ecx
jmp 0xbb50c8
mov ebx, 0x5350505d
or ecx, ebx
pop ebx
and ecx, 0xe316e4d
add ecx, 0x8155596
add ebx, 0x6ea4759e
sub ebx, ecx
sub ebx, 0x6ea4759e
pop ecx
sub ecx, ebx
pop ebx
jmp 0xbb4e53
pop esp
mov dword [esp], eax
push dword [esp]
pop eax
jmp 0xbb55a4
push ebx
mov ebx, 0x55f07efb
sub ebx, 0x3e557746
sub ebx, 0xfaa6cc89
sub edx, ebx
mov ebx, dword [esp]
add esp, 4
pop esi
add ebx, edx
pop edx
sub esp, 4
mov dword [esp], ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb1f00
cmp dword [ebp + 0x10da27fb], 0
je 0xbb1f11
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x10da1c7b]
pop ebx
pop eax
push edi
push ebp
mov dword [esp], eax
jmp 0xbb4ce0
mov eax, 0x343c7d83
dec eax
inc eax
sub eax, 0xd05b6308
add esi, eax
pop eax
jmp 0xbb2d79
xor esi, 0x776a64db
jmp 0xbb4f34
sub esp, 4
mov dword [esp], esi
jmp 0xbb3381
add esi, edi
pop edi
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
mov esp, dword [esp]
push 0x32fc
mov dword [esp], ebx
mov dword [esp], ecx
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
add esp, 4
jmp 0xbb1fae
mov ebx, esp
add ebx, 4
push edx
mov edx, 0x6625043c
push edx
push edi
jmp 0xbb51f5
xor edi, dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb20d0
cmp dword [ebp + 0x10da27fb], 0
je 0xbb20e5
push eax
mov eax, eax
mov eax, 0x7d0
mov dword [ebp + 0x10da1a85], eax
call dword [ebp + 0x10da1afa]
pop eax
push 0x2d16
mov dword [esp], ecx
mov dword [esp], edx
mov dword [esp], eax
push edx
mov edx, 0x1ddb5264
xor edx, 0x4652c75
xor edx, 0x25ab5bd4
add dword [esp + 4], 0x51e611b5
sub dword [esp + 4], edx
sub dword [esp + 4], 0x51e611b5
jmp 0xbb2236
add esp, 4
push 0x17d5
mov dword [esp], edx
mov edx, 0x71a065ac
shr edx, 8
push ebx
mov ebx, 0xc45c7aa0
sub edx, ebx
pop ebx
add eax, edx
mov edx, dword [esp]
push esi
jmp 0xbb46fe
mov dword [esp], ebx
push 0x5bcf193b
push dword [esp]
pop ebx
add esp, 4
and ebx, 0x21af0839
add ebx, 0xf390c69
mov ebp, ebx
push dword [esp]
mov ebx, dword [esp]
jmp 0xbb287f
push ebx
jmp 0xbb21d9
mov ebx, 0x39e5910
shr ebx, 5
xor ebx, 0x28913919
jmp 0xbb3335
mov eax, dword [esp]
jmp 0xbb3c25
pop edx
jmp 0xbb5c39
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0xbb220d
push 0x2736
mov dword [esp], edi
sub dword [esp], 0x2cc47325
push dword [esp]
mov eax, dword [esp]
add esp, 4
jmp 0xbb59c1
sub eax, 0xecd4d62
pop ebp
jmp 0xbb53eb
add ebp, eax
pop eax
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0xbb211e
push esi
push ebp
mov dword [esp], esi
jmp 0xbb2fec
mov esp, dword [esp]
push ebx
push 0x17b3
mov dword [esp], ebx
mov dword [esp], esp
jmp 0xbb2626
mov ebp, esp
push 0x11b4
mov dword [esp], esi
jmp 0xbb2bb4
add dword [esp], 4
pop ebx
add ebx, 4
push eax
push ecx
mov dword [esp], edi
mov edi, 0xd133a1f
push edi
push ebx
mov ebx, 0x2af06e1
mov edi, ebx
pop ebx
neg edi
add edi, 0x8236bc94
mov eax, edi
jmp 0xbb1bb9
push eax
jmp 0xbb51da
xor esi, 0x1c595cb5
add ebp, esi
pop esi
sub esp, 4
mov dword [esp], ecx
mov ecx, 4
add ebp, ecx
jmp 0xbb5008
add esp, 4
push eax
mov eax, esp
push edx
mov dword [esp], ecx
mov ecx, 0x36481e38
jmp 0xbb36b5
add edx, 0x60226d67
jmp 0xbb2a03
push eax
mov eax, 0x6de602fb
inc eax
push ebp
mov ebp, 0
sub ebp, eax
xchg ebp, eax
pop ebp
xor eax, 0x82cafd96
mov edi, eax
pop eax
add edi, ecx
jmp 0xbb510f
sub edx, 0xffffffff
jmp 0xbb4f3c
push ebp
jmp 0xbb4fa1
add esp, 4
sub eax, 4
push eax
jmp 0xbb2e85
xchg dword [esp], ecx
jmp 0xbb185e
push edi
mov edi, 0x395f3f8a
xor ebp, edi
pop edi
mov esi, ebp
jmp 0xbb2fa7
sub esi, 0x35ad719b
add esi, ecx
add esi, 0x35ad719b
sub esi, 0x63e11a7b
mov ecx, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], esi
mov dword [esp], edi
jmp 0xbb3054
mov esi, 0x4e394b69
xor ecx, esi
pop esi
xor eax, ecx
pop ecx
push dword [esp]
pop edx
push edi
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
mov edi, dword [esp]
add esp, 4
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0xbb5900
push dword [esp + 4]
push dword [esp]
pop eax
push ebp
jmp 0xbb4c6c
pop esi
jmp 0xbb4e07
add eax, 0xecd4d62
sub eax, ebp
jmp 0xbb2497
pop ebp
jmp 0xbb27fa
mov dword [esp], esp
add dword [esp], 4
pop esi
sub esp, 4
mov dword [esp], ecx
mov ecx, 4
push 0x1eb6
jmp 0xbb1709
xchg esi, ecx
or esi, 0xf9a1059
xor esi, 0xfab996c4
mov ebp, esi
pop esi
jmp 0xbb2d4b
mov edi, 4
jmp 0xbb1feb
shl ecx, 6
push eax
jmp 0xbb1997
sub ecx, 0xffffffff
push esi
jmp 0xbb2db1
pop ebp
xor ebp, ebx
xor ebx, ebp
xor ebp, ebx
jmp 0xbb414b
xor ebx, 0x583d8260
mov ecx, ebx
jmp 0xbb3d68
mov dword [esp], ebx
jmp 0xbb2069
push edx
mov edx, 0x4ad93a42
mov eax, 0xb526c5c2
add eax, edx
pop edx
add edx, 0x316d016f
add edx, eax
push ebx
mov ebx, 0x22c72544
dec ebx
sub ebx, 0x287e7140
jmp 0xbb1c42
xor esi, dword [esp]
pop esp
add eax, 0x2cc47325
mov edi, dword [esp]
push edx
jmp 0xbb3b98
sub ecx, 0x36481e34
add eax, ecx
pop ecx
jmp 0xbb5984
not esi
not esi
add esi, 0xbe1441b9
add edx, 0x1cf43b2c
sub edx, esi
jmp 0xbb1ebb
mov ebp, eax
pop eax
push edx
mov edx, 0xecd924da
sub ebp, edx
pop edx
jmp 0xbb2f90
mov edx, esp
push eax
jmp 0xbb342d
call dword [ebp + 0x10da1b65]
mov dword [ebp + 0x10da2b65], eax
push 0xffffffffffffffff
push dword [ebp + 0x10da2b65]
call dword [ebp + 0x10da19cf]
push 0x58af
mov dword [esp], eax
push ebx
mov dword [esp], ebp
push ecx
push esp
pop ecx
add ecx, 4
sub ecx, 4
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
jmp 0xbb2171
add esp, 4
push edx
mov edx, 0x1ed5398f
add eax, 0x726654f1
jmp 0xbb444b
pop ecx
inc eax
sub eax, 0x2aea7f71
neg eax
xor eax, 0x8179217c
xor ecx, eax
pop eax
push ebx
jmp 0xbb1d7d
pop ebx
jmp 0xbb14c8
xor esi, ecx
xor ecx, esi
xor esi, ecx
inc ecx
xchg esi, ecx
xchg esi, ecx
not ecx
jmp 0xbb300f
add eax, 4
add eax, 4
xor eax, dword [esp]
xor dword [esp], eax
jmp 0xbb5205
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
jmp 0xbb5645
shr edi, 3
not edi
jmp 0xbb181a
xor esi, 0x78bf1206
shl esi, 8
not esi
jmp 0xbb39b5
inc ebx
xchg ebp, ebx
shl ebp, 6
add ebp, 0x2b79eb44
mov edx, ebp
pop ebp
jmp 0xbb5bdd
pop ebx
mov eax, dword [esp]
add esp, 4
push edi
mov edi, 0x370472d2
jmp 0xbb3fec
add eax, edx
sub eax, 0x726654f1
mov edx, dword [esp]
add esp, 4
pop edx
jmp 0xbb4e12
not edi
xchg edx, edi
or edx, 0xb93174
or edx, 0x560c181b
xor edx, 0x12675486
shr edx, 1
push 0x68d
mov dword [esp], esi
mov esi, 0x6ae855ec
jmp 0xbb401f
mov dword [esp], ebp
push dword [esp]
pop eax
push 0x4091
mov dword [esp], ecx
jmp 0xbb1b38
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
mov byte [ebp + 0x10da16e4], 0x53
push 0x99395f90
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da2448], eax
mov byte [ebp + 0x10da16e4], 0x57
push 0x90045206
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da19cf], eax
mov byte [ebp + 0x10da16e4], 0x43
push 0xbc907028
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da1b65], eax
mov byte [ebp + 0x10da16e4], 0x4c
push 0xd9da1ce9
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da246e], eax
mov byte [ebp + 0x10da16e4], 0x46
push 0xbade0614
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da1b07], eax
mov byte [ebp + 0x10da16e4], 0x47
push 0x8a0fb5e2
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da29e3], eax
mov byte [ebp + 0x10da16e4], 0x47
push 0x83d0b5f3
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da2aba], eax
mov byte [ebp + 0x10da16e4], 0x77
push 0xf397a8a3
push dword [ebp + 0x10da2443]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da2425], eax
mov byte [ebp + 0x10da16e4], 0x47
push 0x8728faf6
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da1a96], eax
mov byte [ebp + 0x10da16e4], 0x43
push 0xbc8e6efc
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da2a5b], eax
mov byte [ebp + 0x10da16e4], 0x45
push 0xc01db569
add byte [ebp + 0x10da0b19], dh
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da2ac0], eax
mov byte [ebp + 0x10da16e4], 0x44
push 0xb8f2ec64
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da1e19], eax
push 0xcee4e7b8
push dword [ebp + 0x10da16f3]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da253a], eax
mov byte [ebp + 0x10da16e4], 0x43
push 0xc0764aa7
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10de5f93], eax
mov byte [ebp + 0x10da16e4], 0x56
push 0xd41f6d39
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da277f], eax
mov byte [ebp + 0x10da16e4], 0x53
push 0xfcb148d8
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
mov dword [ebp + 0x10da184a], eax
cmp byte [ebp - 0x6fc8], 0
je 0xbb3bc9
lea eax, [ebp + 0x10dead8c]
push ecx
mov ecx, esp
add ecx, 4
push ebx
push 0x2325ac8
pop ebx
sub ebx, 0x60ce06a5
xor ebx, 0x325b4d2c
neg ebx
push ebp
jmp 0xbb27c0
push esi
push 0x2fc00a07
pop esi
jmp 0xbb3daa
pop edx
mov byte [ebp + 0x10da16e4], 0x47
push 0x93c8f7c1
push dword [ebp + 0x10da0b19]
call dword [ebp + 0x10da212a]
push edi
jmp 0xbb18a0
mov ebp, esp
push edx
mov edx, 4
add ebp, edx
pop edx
jmp 0xbb502f
xchg dword [esp], ebp
pop esp
mov dword [esp], ebp
jmp 0xbb4add
pop ebp
push eax
mov eax, 4
jmp 0xbb24fd
pop edi
jmp 0xbb22ca
mov dword [esp], eax
push dword [esp]
pop eax
jmp 0xbb25a0
push ebx
mov ebx, 0x4f3d38f8
jmp 0xbb13f6
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb4e24
cmp dword [ebp + 0x10da27fb], 0
je 0xbb4e39
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x10da1a85], eax
call dword [ebp + 0x10da1afa]
pop eax
sub esp, 4
mov dword [esp], ecx
mov dword [esp], eax
sub esp, 4
mov dword [esp], eax
mov dword [esp], ecx
jmp 0xbb21d3
push ecx
push dword [esp + 4]
mov ecx, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
push 1
push 0
push 0
jmp 0xbb3baf
pop edi
push ebp
mov dword [esp], edx
mov edx, 0x5c474c01
jmp 0xbb29bb
mov edi, esi
pop esi
jmp 0xbb1c09
pop edx
add eax, ecx
sub eax, 0x6f3d1568
jmp 0xbb3cae
mov ebp, esp
add ebp, 4
jmp 0xbb5a35
pop ecx
xchg dword [esp], ebp
mov esp, dword [esp]
sub esp, 4
mov dword [esp], esi
mov dword [esp], eax
mov eax, dword [esp]
push 0x449f
mov dword [esp], edi
push esp
mov edi, dword [esp]
push ebp
mov ebp, esp
jmp 0xbb5232
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
pop dword [esp]
jmp 0xbb1eae
xor ebx, 0x34da4a92
sub edx, ebx
jmp 0xbb4351
pop ecx
push eax
mov eax, 0xd1a6540
jmp 0xbb5bbc
mov eax, 0x6b087b70
mov ebp, 0xf77dffa6
add ebp, eax
pop eax
xor ebx, ebp
pop ebp
sub esp, 4
jmp 0xbb14b4
pop edx
pop edi
jmp 0xbb4480
xor eax, dword [esp]
mov esp, dword [esp]
pop eax
push esi
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
jmp 0xbb2f06
push edx
mov edx, 4
add ebp, edx
pop edx
add ebp, 4
xchg dword [esp], ebp
pop esp
push edx
push ebp
jmp 0xbb1574
push 0x7f7a
mov dword [esp], edx
jmp 0xbb44aa
mov ebp, dword [esp]
add esp, 4
shr edx, 3
not edx
dec edx
shr edx, 5
push edi
push ecx
mov ecx, 0x53303417
jmp 0xbb29e3
sub esp, 4
mov dword [esp], edx
sub esp, 4
mov dword [esp], eax
pop edx
push 0x7cb6
mov dword [esp], edx
push ebp
mov ebp, 0x651b61c0
jmp 0xbb190f
add esi, 1
xor esi, 0x455864f6
sub esi, 0xa51a2cca
add eax, esi
mov esi, dword [esp]
jmp 0xbb2cd3
push ebp
push esp
pop ebp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb55c6
cmp dword [ebp + 0x10da27fb], 0
je 0xbb55d5
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x10da24a8]
pop eax
push 0x3a5d
jmp 0xbb3f52
pop esp
push ebp
jmp 0xbb25ed
pop ecx
push ecx
mov dword [esp], ebp
jmp 0xbb5c85
cmp dword [ebp + 0x10da29e7], 0
jne 0xbb5912
cmp dword [ebp + 0x10da27fb], 0
je 0xbb5921
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x10da247c]
pop eax
cmp dword [ebp + 0x10da27fb], 0
je 0xbb5937
push eax
mov eax, 0
call dword [ebp + 0x10da252b]
pop eax
push 0x6574
jmp 0xbb4de2
add eax, 4
xchg dword [esp], eax
pop esp
sub dword [esp + 4], 0x6b0b1f33
sub dword [esp + 4], ebp
add dword [esp + 4], 0x6b0b1f33
pop ebp
mov eax, dword [esp]
add esp, 4
push edx
mov edx, 0x10c814a2
add eax, edx
pop edx
jmp 0xbb19af
push esi
mov esi, esp
jmp 0xbb1686
add ebx, eax
pop eax
push ebx
push dword [esp + 4]
mov ebx, dword [esp]
add esp, 4
pop dword [esp]
pop esp
push ecx
mov dword [esp], eax
sub esp, 4
mov dword [esp], esp
jmp 0xbb1620
push ebp
mov ebp, esp
add ebp, 4
jmp 0xbb22b6
sub ebp, 4
jmp 0xbb4c8f
or edi, eax
pop eax
shl edi, 2
push edi
neg dword [esp]
pop edi
add edi, 0x2e065686
sub edi, 0x6bb25c77
add edx, edi
pop edi
xor eax, edx
jmp 0xbb4c1a
add edi, edx
mov edx, dword [esp]
add esp, 4
push ecx
mov ecx, 4
jmp 0xbb1b18
push dword [esp]
push dword [esp]
pop eax
push ebp
push eax
mov dword [esp], esp
add dword [esp], 4
jmp 0xbb4ca9
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0xbb535f
push eax
mov eax, esp
jmp 0xbb3edb