Function at 0x5fd748
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
mov eax, dword [esp]
push ecx
mov ecx, esp
push edx
sub esp, 4
jmp 0x5f8081
add ecx, edx
push dword [esp]
pop edx
add esp, 4
push ecx
mov dword [esp], eax
mov eax, 0x7bb67672
xor eax, 0x3dfb9203
jmp 0x5f812e
mov esp, dword [esp]
sub eax, edx
push dword [esp]
pop edx
add esp, 4
jmp 0x5f81b6
mov dword [esp], ebx
push esi
push ebx
mov ebx, 0x5ce94859
xor ebx, 0x7dbeac14
sub ebx, 0xab588786
mov esi, 0x9bfa7fa
add esi, ebx
pop ebx
jmp 0x5f80b2
xor ecx, 0xe175897b
xor edx, ecx
pop ecx
jmp 0x5f804e
mov ebx, esi
pop esi
inc ebx
push eax
mov eax, 0x59feec18
add ebx, eax
pop eax
shl ebx, 8
sub ebx, 0x48a220ff
mov edx, ebx
mov ebx, dword [esp]
add esp, 4
push edi
mov edi, 0x7dbe78f6
not edi
not edi
sub edi, 1
sub edi, 0x7dbe78f4
sub edx, edi
pop edi
push 0x6a54a7c7
jmp 0x5f80f3
mov dword [esp], ecx
mov ecx, 0x6ffba19f
add ecx, 0x56dbe800
neg ecx
shl ecx, 7
jmp 0x5f8128
push esi
mov dword [esp], edi
push esp
pop edi
add edi, 4
push eax
push esi
mov esi, 4
mov eax, esi
pop esi
add edi, eax
jmp 0x5f81a7
dec ecx
jmp 0x5f80a4
and eax, 0x7e7f5cf3
shr eax, 6
neg eax
jmp 0x5f813d
sub eax, 0xfee6caeb
sub ecx, 0x3dbc1b08
add ecx, eax
add ecx, 0x3dbc1b08
jmp 0x5f8155
pop eax
xchg dword [esp], ecx
pop esp
push esi
mov dword [esp], 0x3f5fbdcd
add dword [esp], 1
jmp 0x5f816b
dec dword [esp]
jmp 0x5f8173
push ebp
mov ebp, 0x7fdb5d87
add dword [esp + 4], ebp
pop ebp
inc dword [esp]
dec dword [esp]
xor dword [esp], 0xc2b24834
mov dword [esp], edx
jmp 0x5f8193
push 0x31a
push dword [esp]
push dword [esp]
pop edx
add esp, 4
jmp 0x5f810b
pop eax
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
jmp 0x5f806d
mov ecx, ebx
jmp 0x5f92bd
push eax
jmp 0x5fb4ae
add eax, 4
add eax, 4
xchg dword [esp], eax
jmp 0x5f997e
mov dword [esp], eax
push ecx
jmp 0x5f9487
push edi
push 0x3f5a6f59
pop edi
push edx
push ebx
mov ebx, 0x18ef54fe
mov edx, ebx
pop ebx
add edx, 0xa66bfc36
sub edi, edx
jmp 0x5fc6e8
pop edx
mov ecx, edx
mov edx, dword [esp]
push ebx
push esp
mov ebx, dword [esp]
jmp 0x5fae4b
xor eax, edi
pop edi
cmp dword [ebp + 0x122d3a49], 0
jne 0x5f9598
cmp dword [ebp + 0x122d3ae1], 0
je 0x5f95a7
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2dfe]
pop eax
push eax
push eax
mov dword [esp], ecx
jmp 0x5ff0d1
add ecx, esi
jmp 0x5fb110
sub dword [esp + 4], eax
jmp 0x5fdf9f
xor dword [esp + 4], ecx
pop ecx
jmp 0x5f99bd
push esp
mov eax, dword [esp]
add esp, 4
jmp 0x5fa36e
push ebp
add dword [esp], 0x7cfff8a4
pop edx
sub edx, 0x7cfff8a4
pop ebp
sub edi, edx
pop edx
push edi
push ebp
jmp 0x5fc88e
mov edx, 0x3d7f9c4e
xor edi, edx
pop edx
add ebx, 0x73db40e3
add ebx, edi
sub ebx, 0x73db40e3
mov edi, dword [esp]
jmp 0x5fa565
mov esp, dword [esp]
mov dword [ebp + 0x122d3753], eax
mov dword [ebp + 0x122d36ed], 0
push esi
mov dword [esp], eax
push edi
mov edi, 0x1fff46fb
push edi
jmp 0x5fb132
mov eax, dword [esp]
add esp, 4
sub esp, 4
jmp 0x5fac29
push ecx
mov ecx, 0x7edf3bc3
mov ebp, 0xfe97352f
sub ebp, ecx
pop ecx
sub dword [esp + 4], ebp
pop ebp
inc dword [esp]
shl dword [esp], 4
xchg dword [esp], eax
neg eax
jmp 0x5fc7f3
pop ebx
push 0xf0004ea8
pop ecx
jmp 0x5fa6a4
inc edx
shl edx, 2
neg edx
sub edx, 0x838d38a3
xor eax, edx
push dword [esp]
pop edx
add esp, 4
push ebx
push ecx
mov dword [esp], 0x305b23bc
mov dword [esp], ecx
mov dword [esp], eax
sub dword [esp], 0x7d7fae30
mov ebx, dword [esp]
add esp, 4
push edi
jmp 0x5fc4e5
push edx
push eax
jmp 0x5fa445
mov eax, 0x7cfb72e1
jmp 0x5faf3a
push ecx
push esp
pop ecx
push esi
mov esi, 0xff7b111
or esi, 0x27eb5975
push edi
jmp 0x5fcebc
or edi, 0x6bfbd019
shl edi, 4
neg edi
and edi, 0x773fb1e1
add edi, 0x3fb70920
or esi, edi
pop edi
jmp 0x5fd3d0
add ecx, 0x2b79da52
add ecx, edi
push eax
push ebp
mov ebp, 0x7fe9ab01
mov eax, 0xab638553
sub eax, ebp
mov ebp, dword [esp]
jmp 0x5fa9de
mov ecx, dword [esp]
push ecx
mov ecx, esp
jmp 0x5fe286
xchg dword [esp], eax
pop esp
push 0x3d6c246c
mov dword [esp], esp
add dword [esp], 4
pop dword [esp]
push ebx
mov ebx, 4
add dword [esp + 4], ebx
pop ebx
push dword [esp]
mov eax, dword [esp]
push esi
jmp 0x5fc7d8
add esp, 4
sub ecx, eax
pop eax
pop edi
jmp 0x5f9829
push eax
mov eax, 0x6e3f9474
mov edx, 0x6e3f9478
sub edx, eax
jmp 0x5ff041
mov dword [esp], eax
mov dword [esp], edx
jmp 0x5fae16
add esp, 4
add edi, 4
jmp 0x5fe92a
mov edx, 0x7bddab2c
push ebp
mov ebp, 0x7dde98a5
push edi
mov edi, 0xc7fa7ba
and ebp, edi
mov edi, dword [esp]
add esp, 4
add ebp, 1
xor ebp, 0x197c7cfb
xor edx, ebp
jmp 0x5fb171
add esp, 4
add ebx, 4
jmp 0x5faee0
add ebx, 4
xchg dword [esp], ebx
pop esp
pop edi
xor dword [esp + 4], ecx
pop ecx
pop eax
jmp 0x5fb58d
neg eax
sub eax, 0x37fb18c1
or eax, 0x7be9e236
shl eax, 2
jmp 0x5fb3a9
mov esi, dword [esp]
add esp, 4
push esi
mov esi, 4
add ecx, esi
mov esi, dword [esp]
add esp, 4
xchg dword [esp], ecx
jmp 0x5fd24d
mov edi, 0x7fef8585
sub dword [esp + 8], edi
pop edi
add dword [esp + 4], 0x5ffb4a61
jmp 0x5fb942
add dword [esp], 0x19fc97c6
jmp 0x5fd0c7
mov ebp, dword [esp]
jmp 0x5fc04e
mov edx, 4
jmp 0x5fed85
xor eax, 0xefa7d9fc
mov edx, eax
pop eax
sub eax, 0x68feaaae
push edx
mov edx, 0x5eed1f5e
add eax, edx
jmp 0x5fba38
mov eax, esp
add eax, 4
sub eax, 4
jmp 0x5fa930
add eax, edx
add eax, 0x70bffdd7
push dword [esp]
pop edx
push eax
jmp 0x5fc1e6
push eax
mov eax, esp
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], edx
push 0x3f1cea4d
pop edx
jmp 0x5fa227
xchg dword [esp], ecx
mov esp, dword [esp]
push eax
push edx
mov dword [esp], ecx
push eax
push edx
mov dword [esp], 0x3ff4bf19
jmp 0x5ff0c7
add dword [esp + 4], edi
sub dword [esp + 4], 0x5ffb4a61
add dword [esp + 4], 0x7fef8585
pop edi
push dword [esp]
pop eax
push ecx
mov ecx, esp
push edx
jmp 0x5fd580
pop edx
add eax, edx
sub eax, 0x5eed1f5e
add eax, 0x68feaaae
pop edx
push edx
mov edx, 4
jmp 0x5fce38
push dword [esp]
mov eax, dword [esp]
push esi
push esp
pop esi
push edi
mov dword [esp], edx
mov edx, 0x7fd54242
neg edx
xor edx, 0x802abdba
sub esi, 0x77f606dd
add esi, edx
add esi, 0x77f606dd
mov edx, dword [esp]
add esp, 4
jmp 0x5fdbe7
add esp, 4
xor eax, edx
pop edx
push 0x5af62f14
jmp 0x5fcc31
mov eax, esp
add eax, 4
jmp 0x5fcea1
pop ebp
dec ebp
jmp 0x5fe019
mov edi, 0x7fd7cd9d
inc edi
inc edi
or edi, 0x1fde76e5
xor edi, 0x3fdfcd81
sub esp, 4
mov dword [esp], edx
jmp 0x5f990d
pop edx
push edx
push edi
jmp 0x5f9568
push 0x61b90f38
mov dword [esp], esi
jmp 0x5fd322
xchg dword [esp], eax
push eax
mov eax, 0x9381235b
jmp 0x5f95c5
pop edi
jmp 0x5fc4de
dec eax
jmp 0x5fce42
mov dword [esp], edx
mov dword [esp], 0x6db7fe52
or dword [esp], 0x5dff1a51
shl dword [esp], 4
not dword [esp]
jmp 0x5fb149
mov ebx, dword [esp]
add esp, 4
xor dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
push dword [esp]
pop eax
add esp, 4
jmp 0x5fd97e
sub eax, 0x70bffdd7
jmp 0x5fb534
xchg edx, eax
sub esp, 4
jmp 0x5fe8a7
push ecx
mov ecx, 0x72bffda0
not ecx
shl ecx, 4
and ecx, 0x17ff2a73
jmp 0x5fec5f
add eax, 4
xor eax, dword [esp]
xor dword [esp], eax
jmp 0x5fd65f
mov edi, 0x6fede5e9
jmp 0x5fa645
xchg dword [esp], edx
sub esp, 4
mov dword [esp], edx
xchg dword [esp], edx
push edx
not dword [esp]
jmp 0x5fd380
pop esp
mov eax, ebx
push dword [esp]
pop ebx
add esp, 4
cmp dword [ebp + 0x122d3a49], 0
jne 0x5fd26c
cmp dword [ebp + 0x122d3ae1], 0
je 0x5fd27d
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d26e8]
pop ebx
pop eax
push 0x19306ce0
mov dword [esp], eax
push 0x77fde9a9
mov dword [esp], eax
push ebx
push 0x76c7d68a
jmp 0x5fd5e9
mov eax, ebx
jmp 0x5fccfe
mov dword [esp], 0x330951c1
mov dword [esp], esp
add dword [esp], 4
mov esi, dword [esp]
jmp 0x5fdfd7
pop edx
xchg dword [esp], edx
pop edx
xchg dword [esp], edx
sub dword [esp], 1
jmp 0x5fd73a
mov edx, 0x5fb9f2b0
dec edx
sub edx, 0x38b9f2ab
push ss
lodsb al, byte [esi]
inc ecx
xchg dword [esp], eax
pop esp
mov dword [esp], eax
push dword [esp]
jmp 0x5fde26
sub esi, 0x3ffff9f1
jmp 0x5f95b1
mov edx, 4
add ecx, edx
pop edx
sub esp, 4
mov dword [esp], edx
mov edx, 0x7dff9a00
xor edx, 0x4fbf832a
dec edx
dec edx
jmp 0x5fdffd
pop ebx
xor ebx, 0x7f3f94b5
sub ebx, 0x8b8124f0
jmp 0x5fd298
xor eax, dword [esp]
pop esp
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
push esi
mov dword [esp], 0x6bfbe5e5
and dword [esp], 0x7fdf9d5f
xor dword [esp], 0x557bb071
and dword [esp], 0x4ec4c571
or dword [esp], 0x7f5eb574
add dword [esp], 0xf5acc4ea
jmp 0x5fdc58
push edx
mov edx, 0x80d49e37
xor dword [esp + 4], edx
push dword [esp]
pop edx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x5fdc7b
push ebp
mov ebp, 0x7b6fcda3
jmp 0x5f98a8
push edi
mov edi, 0x74fe7411
push ecx
jmp 0x5fdf4a
add esi, 4
jmp 0x5fdd7b
shr dword [esp], 3
shr dword [esp], 2
push edi
push edx
push esi
mov esi, 0x7079a244
mov edx, esi
pop esi
mov edi, edx
pop edx
xor dword [esp + 4], edi
pop edi
mov dword [esp], eax
jmp 0x5fbe4b
mov dword [esp], edx
mov dword [esp], eax
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
jmp 0x5fe3bd
mov dword [esp], edi
mov edi, esp
push ecx
mov ecx, 4
add edi, ecx
pop ecx
add edi, 4
xchg dword [esp], edi
jmp 0x5fed3e
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
push ecx
push esp
pop ecx
jmp 0x5fe498
mov ecx, dword [esp]
add esp, 4
add esp, 4
push ecx
push ecx
mov ecx, 0x177f5300
add dword [esp + 4], ecx
jmp 0x5fa6c2
mov dword [esp], edx
jmp 0x5fd844
pop eax
pop eax
xor eax, 0x7ebbaa01
push ecx
mov ecx, 0x6df7373b
add ecx, 0x76f33dd7
sub ecx, 0xaa0b17db
sub eax, ecx
pop ecx
push edx
mov edx, 0x2ed6d48e
jmp 0x5feb3d
add esp, 4
add esi, 4
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
mov esp, dword [esp]
push edx
mov dword [esp], eax
mov eax, esp
jmp 0x5f9438
xchg edx, eax
jmp 0x5fc9e6
push edi
push ebp
pop edi
pop ebp
not edi
add edi, 0x46fb7498
sub edi, 0x7feb2e1d
sub edi, 0x4f0a82be
xor eax, edi
push dword [esp]
pop edi
add esp, 4
jmp 0x5fe15c
push ecx
push eax
push esp
pop eax
add eax, 4
push edx
jmp 0x5fd39a
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0x5fea8b
push ecx
mov dword [esp], edi
jmp 0x5fe773
mov esp, dword [esp]
cmp dword [ebp + 0x122d3a49], 0
jne 0x5fe3d2
cmp dword [ebp + 0x122d3ae1], 0
je 0x5fe3e7
push eax
mov eax, eax
mov eax, 0x7d0
mov dword [ebp + 0x122d1d3d], eax
call dword [ebp + 0x122d23ec]
pop eax
push eax
mov eax, esp
add eax, 4
sub eax, 4
jmp 0x5fe8b7
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
cmp dword [ebp + 0x122d3a49], 0
jne 0x5fe4b7
cmp dword [ebp + 0x122d3ae1], 0
je 0x5fe4c6
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d26ee]
pop eax
cmp dword [ebp + 0x122d3ae1], 0
je 0x5fe4dc
push eax
mov eax, 0
call dword [ebp + 0x122d1cb0]
pop eax
push edi
mov dword [esp], 0x52f1b3e2
mov dword [esp], esi
jmp 0x5f9461
push esp
mov edi, dword [esp]
jmp 0x5fadb3
mov dword [esp], ecx
mov ecx, 0x412f9bff
add edx, ecx
pop ecx
jmp 0x5fce6e
add edi, 4
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
cmp dword [ebp + 0x122d3a49], 0
jne 0x5fe949
cmp dword [ebp + 0x122d3ae1], 0
je 0x5fe958
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d34a2]
pop eax
sub esp, 4
mov dword [esp], ebx
push esp
push dword [esp]
pop ebx
push ebx
jmp 0x5fdd3d
pop eax
sub eax, 0x177f5300
push dword [esp]
pop ecx
jmp 0x5fe335
and eax, edx
pop edx
xor eax, 0x68db1474
mov ecx, eax
pop eax
xor dword [esp + 4], ecx
push dword [esp]
pop ecx
add esp, 4
mov eax, dword [esp]
push edi
push 0x11d84ab
mov dword [esp], esp
add dword [esp], 4
pop edi
add edi, 4
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
push edi
mov edi, 0x4e9f0078
jmp 0x5f9583
sub ecx, 0x3f766d46
sub ecx, 0x379ff1b2
add ecx, 0xd685f3aa
sub edx, ecx
mov ecx, dword [esp]
add esp, 4
sub ecx, 0x1dcf1d31
add ecx, edx
add ecx, 0x1dcf1d31
mov edx, dword [esp]
add esp, 4
jmp 0x5fece7
xchg dword [esp], ecx
pop esp
sub eax, 0x1fff46fb
cmp dword [ebp + 0x122d3a49], 0
jne 0x5fed02
cmp dword [ebp + 0x122d3ae1], 0
je 0x5fed17
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d1d3d], eax
call dword [ebp + 0x122d23ec]
pop eax
push edi
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
add esp, 4
push eax
jmp 0x5f984b
pop esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], eax
mov eax, dword [esp]
sub esp, 4
jmp 0x5fed65
mov dword [esp], ecx
push esp
pop ecx
push edx
jmp 0x5fb2f2
add ecx, edx
pop edx
push edx
jmp 0x5faa3c
push dword [esp]
pop eax
add esp, 4
add ecx, edx
jmp 0x5ff0c1
pop edx
jmp 0x5fb77c
shr dword [esp], 7
push ebp
jmp 0x5f9a22
push edi
push ebx
mov ebx, 0x3ffaf563
dec ebx
sub ebx, 0x2bbf6136
add ebx, 1
sub ebx, 0x953c8b5f
jmp 0x5ff0f0
mov edi, ebx
jmp 0x5fa161