Function at 0x5ee631
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebp
push esp
pop ebp
jmp 0x5ea259
add esi, 0x57dfd2c1
jmp 0x5ea194
mov ecx, ebp
pop ebp
or ecx, 0x796f715d
push ebx
mov dword [esp], 0x387f54d9
mov dword [esp], esi
push ecx
push eax
mov eax, 0x74f7c693
mov ecx, 0x5de11af
push edx
jmp 0x5ea168
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], ebp
jmp 0x5ea26b
mov dword [esp], 0x6af994cc
sub dword [esp], 1
neg dword [esp]
dec dword [esp]
add dword [esp], 0xcac4e634
pop ebp
push eax
mov eax, 0x47f9f25a
add eax, 0xc83a0cd1
add ebp, eax
pop eax
jmp 0x5ea0e6
pop edx
pop edi
add ebp, ebx
jmp 0x5ea24b
xor edx, 0x67e47af4
add ebx, edx
jmp 0x5ea152
mov edx, 0x3f6b9b75
xor edx, 0x3fd10f10
and edx, 0x565f3c73
add edx, 0x5fd53170
sub ecx, edx
jmp 0x5ea186
mov edx, dword [esp]
add esp, 4
add ecx, eax
push esi
jmp 0x5ea1b1
pop ebx
xchg dword [esp], esi
jmp 0x5ea253
pop ebp
shl ebx, 6
jmp 0x5ea1cc
push edx
mov edx, 0x1d87f400
jmp 0x5ea210
mov esi, 0x5fef45d1
add ecx, esi
pop esi
pop eax
mov esi, 0xfad669b2
sub esi, ecx
pop ecx
add ecx, esi
pop esi
sub eax, ecx
jmp 0x5ea1dd
push ebp
mov ebp, 0x7f3fd4f4
add ebx, ebp
pop ebp
neg ebx
push edi
jmp 0x5ea1a6
push dword [esp]
pop ecx
push esi
mov esi, esp
add esi, 4
push ebx
mov ebx, 4
sub esi, 0x57dfd2c1
jmp 0x5ea244
add esp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push ecx
push ebp
push eax
jmp 0x5ea126
push 0xf5f476c8
pop edi
xor edi, edx
mov edx, dword [esp]
add esp, 4
push 0x6eb72455
mov dword [esp], edx
mov edx, 0x5b47e0f4
sub ebx, edx
pop edx
sub ebx, edi
push edx
mov edx, 0x3fbbdf49
and edx, 0x7ce79ab2
jmp 0x5ea15b
add esi, ebx
jmp 0x5ea0db
mov ebx, dword [esp]
jmp 0x5ea1fb
pop esp
jmp 0x5ea27c
push ebx
mov ebx, 0x2ffbc533
add ebx, 0x6e6f3b48
push ecx
jmp 0x5ea10c
mov ebp, 0x6ff63226
jmp 0x5ea275
add ebx, ebp
jmp 0x5ea19d
mov ecx, ebx
jmp 0x5eb383
push 0x1021a66c
mov dword [esp], ecx
mov dword [esp], 0x3cee5b53
push esp
pop dword [esp]
jmp 0x5ef66b
mov dword [esp], 0x7d75ccf9
dec dword [esp]
jmp 0x5eb5d2
push ecx
mov dword [esp], ebp
push edi
push esi
mov esi, 0x3ffbc291
jmp 0x5ed471
mov esp, dword [esp]
sub dword [esp + 4], edi
push dword [esp]
push dword [esp]
pop edi
jmp 0x5f0daf
xor dword [esp], ebx
xor ebx, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
jmp 0x5ec9c2
add edx, 0xf97136e4
add eax, edx
mov edx, dword [esp]
add esp, 4
xor eax, dword [esp]
xor dword [esp], eax
jmp 0x5eeb2f
sub ebp, 0x11a28d78
jmp 0x5ecabf
push 0x48d53072
mov dword [esp], esi
jmp 0x5eef95
push dword [esp]
pop eax
push 0x6228fe96
mov dword [esp], edi
mov dword [esp], 0x5fcfa070
jmp 0x5eccc4
add eax, 4
push 0x4414f697
jmp 0x5ed9e5
add esp, 4
pop edx
xor edx, 0x7fffde7e
push eax
jmp 0x5ed30f
sub esp, 4
mov dword [esp], edx
jmp 0x5ed31c
sub edx, ecx
jmp 0x5f0bc6
add esp, 4
push edx
sub esp, 4
mov dword [esp], ecx
push 0x756f6923
pop ecx
mov edx, 0x4d11ec6
xor edx, ecx
pop ecx
jmp 0x5edc60
push eax
mov eax, 0x6fe79e85
add ecx, eax
pop eax
mov edx, dword [esp]
add esp, 4
sub eax, ecx
pop ecx
push 0x1f323131
mov dword [esp], eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
mov dword [esp], edx
add dword [esp], 0x7f7611b6
mov eax, dword [esp]
add esp, 4
sub eax, 0x7f7611b6
pop edx
cmp dword [ebp + 0x122d2b73], 0
jne 0x5ec28f
cmp dword [ebp + 0x122d2b9b], 0
je 0x5ec2a0
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x12451ba1]
pop ebx
pop eax
push edi
jmp 0x5ed646
mov dword [esp], ebp
jmp 0x5eed11
push edi
pop ebx
pop edi
mov edx, dword [esp]
add esp, 4
add dword [esp + 4], ebx
pop ebx
mov eax, dword [esp]
add esp, 4
push ebp
push 0x68fbfcb4
mov ebp, dword [esp]
add esp, 4
push eax
mov eax, 0xd6e2d183
add ebp, 0x5def0642
jmp 0x5f0772
add esi, ecx
push dword [esp]
pop ecx
add esp, 4
push ecx
push edi
mov edi, 0x36ff3c82
xor edi, 0x36ff3c86
mov ecx, edi
pop edi
add esi, ecx
pop ecx
xchg dword [esp], esi
pop esp
mov eax, dword [esp]
add esp, 4
sub eax, 0x6fe52a8f
push 0x46df5f5e
mov dword [esp], esi
mov dword [esp], ebx
mov dword [esp], eax
jmp 0x5ebee3
add dword [esp + 4], 0x2fbf91ae
jmp 0x5ed1b1
or eax, edx
pop edx
push edi
mov edi, 0x5fd7a926
sub edi, 0x74f71b3c
jmp 0x5f1059
add eax, 4
push ecx
push edx
jmp 0x5ed491
push 0x2866b376
jmp 0x5ef6c4
cmp dword [ebp + 0x122d2b73], 0
jne 0x5ec9d4
cmp dword [ebp + 0x122d2b9b], 0
je 0x5ec9e3
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d5917]
pop eax
push ebp
mov dword [esp], ecx
jmp 0x5ee332
sub eax, 0x5f3f4f14
jmp 0x5ef5da
or edx, ebp
mov ebp, dword [esp]
add esp, 4
shl edx, 6
sub edx, 0xffe1fcbc
jmp 0x5f0caa
pop edi
pop dword [esp]
pop esp
push ecx
mov dword [esp], 0x4d60cd32
jmp 0x5f0f66
mov dword [esp], ecx
mov ecx, esp
jmp 0x5ef6d6
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x5f0dbe
push edi
mov edi, 0x5ffb7edd
jmp 0x5efc17
push dword [esp]
mov ebx, dword [esp]
jmp 0x5edadb
mov esi, ebx
mov ebx, dword [esp]
add esp, 4
sub esi, 0x7fb952c4
jmp 0x5ee5be
mov eax, esp
jmp 0x5ec71c
mov edx, 0x7ff7ba51
inc edx
sub edx, 0x3b7c5d4b
inc edx
add edx, 0x676f28c0
add edx, 0x7bf77875
sub edx, 0x3cdbb3f5
xor edi, edx
pop edx
sub eax, edi
pop edi
push ecx
mov ecx, 0x77f54909
and ecx, 0x7dde5501
jmp 0x5edaae
add esi, 0x7fff7334
dec esi
and esi, 0x7567b58f
add esi, 0x19741b59
mov edi, esi
pop esi
shr edi, 6
not edi
jmp 0x5f0c32
mov edx, 0x69fada13
mov ecx, 0x960525f1
sub ecx, 0x6fe79e85
add ecx, edx
jmp 0x5ec241
push ebp
mov ebp, eax
mov edi, ebp
pop ebp
push 0x5e4ddd46
mov dword [esp], edi
add dword [esp], 0x7f9bd622
mov eax, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
sub eax, 0x7f9bd622
push dword [esp]
jmp 0x5ef760
mov dword [esp], ecx
mov ecx, 4
jmp 0x5ed170
shl ecx, 6
jmp 0x5f0e75
add esp, 4
jmp 0x5ebd56
add eax, ecx
push ebx
mov ebx, 0x7fb7614f
or ebx, 0x7f9f9c9a
xor ebx, 0x21563c
add eax, ebx
pop ebx
add eax, 0x5ffb7edd
pop ecx
push edx
mov dword [esp], 0x548058f1
mov dword [esp], eax
push dword [esp + 4]
pop eax
pop dword [esp]
mov esp, dword [esp]
jmp 0x5f066c
sub esp, 4
mov dword [esp], edi
jmp 0x5efe88
add ebx, 4
push eax
mov eax, 4
add ebx, eax
pop eax
xchg dword [esp], ebx
pop esp
add esp, 4
cmp dword [ebp + 0x122d2b73], 0
jne 0x5edf44
cmp dword [ebp + 0x122d2b9b], 0
je 0x5edf59
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d2f15], eax
call dword [ebp + 0x122d2f0f]
pop eax
push 0x6427d9b
mov dword [esp], eax
sub esp, 4
mov dword [esp], edi
push ecx
mov ecx, 0x7dbf43c4
sub esp, 4
jmp 0x5ec318
xchg dword [esp], edx
pop esp
add eax, 0x7dbf43c4
push eax
push edx
mov edx, 0x71be77e5
jmp 0x5f0e2b
mov ecx, esp
jmp 0x5ee530
pop ecx
jmp 0x5f0fe8
add ecx, 4
push ebx
mov ebx, 4
sub ecx, ebx
pop ebx
xchg dword [esp], ecx
pop esp
mov dword [esp], eax
sub esp, 4
mov dword [esp], ebx
mov ebx, 0x6fe52a8f
sub dword [esp + 4], 0x2fbf91ae
add dword [esp + 4], ebx
jmp 0x5ec6b0
add edi, esi
mov esi, dword [esp]
add esp, 4
add edi, 4
sub esp, 4
mov dword [esp], edi
push dword [esp + 4]
jmp 0x5ecb0f
add esp, 4
push dword [esp]
pop eax
push ebp
mov ebp, esp
add ebp, 4
push eax
jmp 0x5f0baa
xor eax, dword [esp]
mov esp, dword [esp]
mov eax, ecx
pop ecx
push edx
mov dword [esp], 0x6bd060a0
mov dword [esp], ebx
mov dword [esp], 0x6fbad5b6
not dword [esp]
sub dword [esp], 0x8b72f8c3
mov dword [esp], ebx
mov ebx, esp
push esi
jmp 0x5f10ee
mov ebp, ecx
mov edi, ebp
jmp 0x5f0d18
mov ecx, 4
jmp 0x5ebf61
mov esi, esp
sub esp, 4
jmp 0x5ef003
mov dword [esp], ecx
mov ecx, 4
jmp 0x5ec519
dec edi
jmp 0x5f0e5e
push dword [esp]
pop eax
push edx
mov edx, esp
add edx, 4
jmp 0x5f0d04
add ebp, eax
pop eax
xchg dword [esp], ebp
pop esp
mov dword [ebp + 0x122d2201], eax
mov dword [ebp + 0x122d319f], 0
push esi
jmp 0x5ef9f4
push edx
mov edx, esp
add edx, 4
push edx
mov dword [esp], ecx
jmp 0x5eef8b
mov dword [esp], eax
mov eax, esp
jmp 0x5ebf31
pop edi
jmp 0x5ec773
mov dword [esp], edi
mov dword [esp], edx
jmp 0x5eb51a
sub eax, edi
pop edi
sub eax, 0x7f9eabe3
jmp 0x5edc28
mov edi, 0x77d3ab71
jmp 0x5ef0b9
push eax
push ebx
jmp 0x5f06ed
push edx
mov edx, 0x3fdece37
push edi
mov edi, edx
jmp 0x5ec3c0
add ebp, eax
push edi
mov edi, 0x5def0642
sub ebp, 0x6ff4aede
sub ebp, edi
jmp 0x5f0cc7
mov eax, 0x5f3f4f18
jmp 0x5eca65
pop ecx
jmp 0x5f0bcc
xchg dword [esp], edx
jmp 0x5f0c71
sub edi, 0x6fff0ac7
push ecx
mov ecx, 0xb17ed71c
xor edi, ecx
pop ecx
mov ebp, edi
pop edi
xor dword [esp + 4], ebp
pop ebp
add dword [esp], 0x31f597d4
mov dword [esp], eax
mov dword [esp], esi
mov dword [esp], ecx
mov dword [esp], 0x10d66100
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
push ebx
mov ebx, esp
jmp 0x5edf1c
pop esp
jmp 0x5f0c77
mov dword [esp], edx
mov edx, 0x63ee87f2
push eax
mov dword [esp], ebp
mov ebp, 0xffeb61b
dec ebp
push edi
mov edi, 0x77d741a7
xor edi, 0x8e862a4
xor ebp, edi
pop edi
jmp 0x5ebb95
add dword [esp + 4], edx
mov edx, dword [esp]
jmp 0x5ee62a
add edi, 0x800c0553
mov esi, edi
pop edi
add edx, esi
pop esi
jmp 0x5ececc
add ebp, 0x6ff4aede
pop edi
pop eax
push ecx
mov ecx, 0x7f6f034b
xor ecx, 0x3ef3715e
shr ecx, 3
shr ecx, 3
push eax
mov eax, 0
sub eax, ecx
jmp 0x5f0fa1
add edx, 4
jmp 0x5ee096
pop ebp
mov ecx, dword [esp]
jmp 0x5f0d98
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
jmp 0x5eb5e2
push edx
mov edx, esp
push esi
push edi
mov edi, 0x7ff3fab1
jmp 0x5f0cb6
add esp, 4
jmp 0x5ef5b5
add dword [esp + 4], edx
mov edx, dword [esp]
push ecx
jmp 0x5f0e38
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp]
pop eax
jmp 0x5ec1c2
or edi, 0x3ff69afb
xor edi, 0x3dee942f
add edi, 0x7abf9995
jmp 0x5ebf53
add ecx, 0xceaeda33
push ebp
mov ebp, 0x5ffb8181
jmp 0x5f0e86
and ebp, 0x7ffd2f79
sub ebp, 0x7fffc70d
add ebp, 0x9d82020c
jmp 0x5f0eb4
sub eax, ebp
pop ebp
add eax, ecx
add eax, 0x7d7b3c00
mov ecx, dword [esp]
add esp, 4
sub eax, edx
sub eax, 0x43bf1a73
add eax, 0x57de8321
pop edx
cmp dword [ebp + 0x122d2b73], 0
jne 0x5f0ee6
cmp dword [ebp + 0x122d2b9b], 0
je 0x5f0ef5
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2a92]
pop eax
cmp dword [ebp + 0x122d2b9b], 0
je 0x5f0f0b
push eax
mov eax, 0
call dword [ebp + 0x122d1d08]
pop eax
push ebx
mov dword [esp], ebp
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
add esp, 4
push edi
push edx
mov dword [esp], esp
add dword [esp], 4
pop edi
sub esp, 4
mov dword [esp], esi
push ecx
mov dword [esp], 0x499b397a
mov dword [esp], ebx
mov ebx, 0x6af5af2b
shl ebx, 1
jmp 0x5f0f49
sub ebx, 0x7ebf4576
push edx
push ecx
mov ecx, 0x288d39e8
mov edx, ecx
jmp 0x5f0f5d
pop ecx
add ebx, edx
pop edx
jmp 0x5ed235
mov dword [esp], edx
push ebx
mov dword [esp], eax
push esi
push edx
push 0x7ef78806
jmp 0x5f0f79
pop edx
xor edx, 0x1085678
push edx
xor dword [esp], 0x727d351c
jmp 0x5f0f8d
pop esi
xor esi, 0x727d351c
pop edx
xor dword [esp + 4], esi
mov esi, dword [esp]
jmp 0x5ebf40
mov ecx, eax
pop eax
push edi
mov edi, 0x3623a2bd
or edi, 0x6fb7eb1c
shr edi, 2
and edi, 0x7dd5f9e0
dec edi
shl edi, 3
xor edi, 0xfbfe9df8
add ecx, edi
pop edi
add ecx, 0x695c69c8
sub eax, ecx
jmp 0x5f0fd3
pop ecx
add eax, 0x7ffaa751
sub eax, ebp
push ecx
mov ecx, 0x7ffaa751
sub eax, ecx
jmp 0x5ee3ce
add eax, 0x7e275300
jmp 0x5f0ff2
pop ebp
cmp dword [ebp + 0x122d2b73], 0
jne 0x5f1005
cmp dword [ebp + 0x122d2b9b], 0
je 0x5f1014
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1ee3]
pop eax
sub esp, 4
mov dword [esp], ecx
push eax
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push ebx
mov dword [esp], 0x93bd22f
mov dword [esp], eax
mov eax, esp
add eax, 4
push edx
push eax
mov eax, 0x7ffe2ff2
shl eax, 1
sub esp, 4
mov dword [esp], edx
mov edx, 0x5f7c0164
xor edx, 0x187019d
jmp 0x5ec6d4
shl edi, 5
inc edi
jmp 0x5f1062
sub edi, 0x1d22c507
sub eax, edi
pop edi
push 0
sub dword [esp], eax
mov eax, dword [esp]
add esp, 4
sub eax, 0x840ba5d
mov edx, eax
mov eax, dword [esp]
add esp, 4
jmp 0x5f108e
and edx, 0xfcec922
jmp 0x5eb821
mov esi, 4
add ebx, esi
pop esi
push esi
mov dword [esp], 0x4edade00
mov dword [esp], edx
jmp 0x5f1106
push 4
mov edx, dword [esp]
add esp, 4
sub ebx, edx
mov edx, dword [esp]
add esp, 4
xor ebx, dword [esp]
jmp 0x5eb5f5