Function at 0x5faa82
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
push ebp
push dword [esp + 4]
jmp 0x5fab94
pop eax
mov dword [esp + 4], edi
pop edi
mov dword [esp], ecx
mov dword [esp], ebp
mov dword [esp], eax
jmp 0x5fabdd
push ebp
mov ebp, 0x7f754bc9
sub dword [esp + 4], ebp
pop ebp
add dword [esp], 1
sub dword [esp], 0xa00a5138
push eax
mov eax, 0x7df9c18b
or eax, 0x3ffe742e
inc eax
xor eax, 0xad1d42db
add dword [esp + 4], eax
pop eax
mov dword [esp], ebp
jmp 0x5fab24
pop esp
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
push eax
mov dword [esp], 0x5ded3b5b
sub dword [esp], 0x573fa26a
sub dword [esp], 0xa72e309f
jmp 0x5fab12
xchg dword [esp], ecx
inc ecx
xchg dword [esp], ecx
neg dword [esp]
neg dword [esp]
jmp 0x5faaac
push ecx
mov dword [esp], 0x5a5019a7
mov dword [esp], edi
push eax
jmp 0x5fab35
mov eax, 0x71903e0
mov edi, eax
jmp 0x5faa98
pop ebp
jmp 0x5fabd5
pop dword [esp]
jmp 0x5faaea
call 0x5fabe2
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ecx
sub esp, 4
jmp 0x5fae79
neg edx
push edi
mov edi, 0x67cb2200
shr edi, 7
jmp 0x5fadae
push edi
jmp 0x5fb235
mov eax, 0x7e79ed28
jmp 0x5fb4ac
and eax, 0x7bff296a
xor eax, 0x5f4c2037
not eax
dec eax
sub eax, 0xae387fe1
and edi, eax
jmp 0x5fb0ae
push esi
push 0x270af013
mov dword [esp], edx
jmp 0x5fac84
add ecx, 0x88244c64
add esi, ecx
pop ecx
xchg dword [esp], esi
pop esp
mov esi, dword [esp]
add esp, 4
push edx
jmp 0x5fb09a
add edx, edi
pop edi
shr edx, 7
jmp 0x5fb4cb
mov edx, 0x4fb50e13
mov esi, 0xbf1bc5de
sub esi, 0x5ff9e39e
jmp 0x5fb133
mov esi, 1
sub edx, esi
pop esi
push esi
jmp 0x5fb50c
push edi
push esp
pop edi
push edx
push edi
mov edi, 0x67efce2e
shl edi, 5
push 0
sub dword [esp], edi
jmp 0x5fad72
sub esp, 4
mov dword [esp], ecx
push ecx
jmp 0x5fae60
pop edi
jmp 0x5fb2ad
xor esi, edi
jmp 0x5fb430
mov ebp, 0x74f44379
jmp 0x5fb03d
push 0
jmp 0x5fb28d
add ebx, edi
jmp 0x5fb024
add esp, 4
push 0x476bc1b3
jmp 0x5fb054
sub ebp, 0x82c98b1f
push ebp
xor dword [esp], 0x7eeea6df
pop esi
xor esi, 0x7eeea6df
mov ebp, dword [esp]
add esp, 4
xor ecx, esi
push dword [esp]
push dword [esp]
mov esi, dword [esp]
push esi
mov esi, esp
jmp 0x5fb2e4
pop edi
xor edi, 0x2fbc7ca7
xor edi, 0x2dba46e3
mov edx, edi
jmp 0x5fb618
mov edi, 0x733f2c08
shl edi, 7
and edi, 0x755c3852
or edi, 0x23fc25cf
jmp 0x5faf0a
add esp, 4
push edx
mov dword [esp], esi
jmp 0x5fac99
not edi
jmp 0x5fae41
push ecx
mov ecx, 0x77dbb3a0
jmp 0x5fac53
mov eax, ebp
mov edi, eax
mov eax, dword [esp]
add esp, 4
pop ebp
xor edi, edx
mov edx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
jmp 0x5fb543
push edx
mov dword [esp], esp
add dword [esp], 4
jmp 0x5fb64e
pop eax
jmp 0x5fb219
pop edi
sub ecx, ebp
pop ebp
sub ebx, ecx
mov ecx, dword [esp]
push ebx
mov ebx, esp
jmp 0x5fac04
push ebp
pop eax
mov edx, eax
pop eax
pop ebp
push eax
jmp 0x5fb535
sub ecx, 0x3e7a46d3
jmp 0x5fb256
push eax
push 4
pop eax
jmp 0x5fb2b8
sub edi, eax
jmp 0x5faead
add edi, 0x9aba84e1
sub edx, edi
pop edi
sub edi, edx
pop edx
push ecx
mov ecx, 0x3fff5cd6
sub edi, ecx
mov ecx, dword [esp]
add esp, 4
jmp 0x5fae3a
mov dword [esp], 0x49219ef8
mov dword [esp], edx
mov dword [esp], edi
mov edi, 0x7dabdb10
mov ecx, edi
jmp 0x5fb05e
mov dword [esp], edx
push esp
pop dword [esp]
add dword [esp], 4
push dword [esp]
mov ecx, dword [esp]
add esp, 4
add esp, 4
jmp 0x5faeca
mov ebx, 0
sub ebx, edi
mov edi, ebx
push dword [esp]
pop ebx
jmp 0x5fb635
add edi, 0x3fff5cd6
add edi, 0x7ff7a9fc
mov eax, dword [esp]
add esp, 4
xchg dword [esp], edi
jmp 0x5fb422
push ebp
mov dword [esp], 0x5f9924b0
shl dword [esp], 7
shr dword [esp], 5
add dword [esp], 0x60459461
jmp 0x5faee6
mov dword [esp], esi
mov esi, 4
add ecx, 0x15efb890
add ecx, esi
sub ecx, 0x15efb890
pop esi
jmp 0x5fb23f
xchg dword [esp], ebx
jmp 0x5fb49d
shl edi, 5
xor edi, 0x86227947
jmp 0x5fb00a
add ebx, 4
sub esp, 4
jmp 0x5fb1c3
mov dword [esp], edi
jmp 0x5fb4fc
mov ebp, 0x77f74a7b
sub dword [esp + 4], ebp
jmp 0x5fb02b
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
sti
push 0x75321159
mov esi, dword [esp]
push 0x1381132b
mov dword [esp], ecx
mov dword [esp], ebx
push esp
pop ebx
push esi
mov esi, 4
sub ebx, 0x7dfffb50
sub ebx, 0x71396876
add ebx, esi
add ebx, 0x71396876
push edi
push ebp
mov ebp, 0x3f7600a3
and ebp, 0x799b0070
add ebp, 0x44edfb30
mov edi, ebp
pop ebp
jmp 0x5fafa8
add ebx, edi
mov edi, dword [esp]
push esi
mov esi, esp
add esi, 4
jmp 0x5fadb5
mov esi, 4
add ebx, esi
pop esi
xchg dword [esp], ebx
pop esp
sub ebx, 0x34ef9f21
add ebx, 0x3f97669e
add ebx, dword [esp]
sub ebx, 0x3f97669e
push eax
jmp 0x5fb6d4
mov edx, edi
pop edi
push 0
sub dword [esp], edx
jmp 0x5fb31e
mov eax, 0x7cbfd9c1
jmp 0x5fb6c5
pop edi
push esi
jmp 0x5fafe3
xor ebp, edi
pop edi
push eax
jmp 0x5fadc0
mov dword [esp], ebx
push esp
pop ebx
jmp 0x5faf18
pop edi
sub ecx, 0x7dabdb0c
add eax, ecx
mov ecx, dword [esp]
push ebx
jmp 0x5faf3f
mov edx, 0x2f9b2b6a
mov eax, edx
pop edx
push eax
jmp 0x5fb01a
sub ebx, 0x4a193d7e
sub ebx, edx
add ebx, 0x4a193d7e
jmp 0x5fb1f2
mov edx, 0x77e639a4
add edx, 0x8819c660
push esi
mov dword [esp], edx
jmp 0x5fb0f7
mov eax, dword [esp]
add esp, 4
not edi
shr edi, 1
push 0x5cb4eb6d
mov dword [esp], ecx
jmp 0x5fac2d
mov ecx, 0x3f3b15e7
jmp 0x5fac0a
push ecx
mov ecx, 0x74db98f0
xor ecx, 0x3f7d7a43
not ecx
dec ecx
jmp 0x5fae17
add edx, 4
jmp 0x5fb448
shr ebp, 6
push ebp
not dword [esp]
jmp 0x5fb305
push ebp
mov ebp, 0x58b955fd
sub esi, ebp
pop ebp
shl esi, 2
jmp 0x5fb313
add esi, edx
add esi, 0x5ff9e39e
pop edx
xor esi, 0x3d9e0b46
xor esi, 0x777e7291
shl esi, 6
sub esi, 0x2fb6f677
push ecx
mov ecx, 0x29eec7ea
and ecx, 0x3fbcd6bd
xor ecx, 0x5b8ffd74
not ecx
xor ecx, 0x1c00cff8
add esi, ecx
pop ecx
push edi
mov edi, 0xe8f7a1
add esi, edi
pop edi
mov ecx, esi
mov esi, dword [esp]
add esp, 4
or ecx, 0x7dfdf025
shl ecx, 7
add ecx, 0xddd7e96
push ebx
mov ebx, 0x2c6fbf1
add ecx, ebx
pop ebx
xor edi, ecx
pop ecx
xor esi, edi
pop edi
push 0x6cee5953
mov dword [esp], edx
mov edx, 0
add edx, ebx
mov ecx, dword [edx]
push dword [esp]
push dword [esp]
push dword [esp]
pop edx
add esp, 4
jmp 0x5fad25
mov dword [esp], esi
push eax
mov eax, 0x1eb36414
mov esi, eax
mov eax, dword [esp]
add esp, 4
or esi, 0x78ff4600
jmp 0x5fb122
mov dword [esp], edx
push ebp
push 0x7aea4d67
pop ebp
push eax
jmp 0x5fae0b
pop edx
sub ebx, eax
add ebx, 0x7fdd1009
pop eax
dec esi
jne 0x5fb1a0
sti
push 0x2a8172c3
mov dword [esp], edi
push edx
mov dword [esp], 0x4fff401a
jmp 0x5fb551
sub esp, 4
mov dword [esp], eax
mov dword [esp], edx
push edi
mov edi, 0x79bf90c4
mov edx, 0x62fccd0
jmp 0x5fac6c
mov edi, 4
jmp 0x5fad1e
push edi
mov edi, 4
sub ecx, 0x7ee7961d
sub ecx, 0x6f9b5362
jmp 0x5fb2f2
mov edx, ecx
pop ecx
add ebx, edx
pop edx
add ebx, edx
sub ebx, 0x75ded678
jmp 0x5fb3b6
neg ebp
shl ebp, 5
xor ebp, 0x7cafe300
push edi
mov edi, 0x3f67affe
not edi
sub edi, 0x7d8d86d3
sub edi, 0x471f60a7
jmp 0x5fb767
sub dword [esp], eax
pop eax
dec eax
xor eax, 0x8217f5f
push edx
mov edx, 0x678a6260
sub edx, 1
shr edx, 2
neg edx
sub edx, 1
jmp 0x5fabf4
add edi, 4
jmp 0x5fb582
sub edi, eax
pop eax
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
pop esp
mov dword [esp], edi
push 0x15bfea2c
jmp 0x5fb1e2
and edx, eax
jmp 0x5fb55b
add esi, 4
add esi, 4
jmp 0x5fb5eb
add ecx, edi
add ecx, 0x6f9b5362
add ecx, 0x7ee7961d
jmp 0x5fb30d
pop ebp
neg ebp
jmp 0x5fad41
pop edi
jmp 0x5fb4bf
push esi
not dword [esp]
pop esi
push edi
jmp 0x5fb418
pop edx
xor edx, 0x6d5f7e53
neg edx
add edx, 0x4885f73a
add esi, 0x5be23cbe
sub esi, edx
sub esi, 0x5be23cbe
mov edx, dword [esp]
add esp, 4
add esi, ebp
push eax
mov eax, 0x59fe1ec6
add eax, 0x3fdf7f76
add eax, 0xc3a217f4
add esi, eax
pop eax
mov ebp, dword [esp]
add esp, 4
sub ecx, esi
jmp 0x5fb473
add edi, edx
mov edx, dword [esp]
add esp, 4
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
push eax
sub esp, 4
mov dword [esp], ecx
jmp 0x5fb0ed
pop edx
xchg dword [esp], ebx
pop esp
push edi
push edx
mov edx, 0x7fcaa29b
sub edx, 0x2fae4d16
dec edx
sub edx, 0x7fefccdf
xor edx, 0x56df8671
shr edx, 8
sub edx, 0x91e1f774
mov edi, edx
pop edx
push eax
mov eax, 0x6e86b808
jmp 0x5fac14
mov edi, 0x7f73f84b
jmp 0x5facf9
mov esp, dword [esp]
mov dword [esp], ebp
mov dword [esp], ecx
jmp 0x5faf29
pop edi
add esi, 0xe66bb81c
add ebx, esi
push dword [esp]
pop esi
add esp, 4
jmp 0x5faf02
xchg dword [esp], edx
pop esp
shr eax, 8
xor eax, 0x3ebaa688
push esi
mov esi, 0x5bff7d8e
push ebp
sub esp, 4
mov dword [esp], eax
mov eax, 0xfef86f12
mov ebp, eax
pop eax
push edx
push edi
jmp 0x5fad86
pop esi
sub ecx, eax
add ecx, 0x5af7eca0
mov eax, dword [esp]
push ebx
jmp 0x5fb51f
pop esp
push edi
mov edi, esp
add edi, 4
jmp 0x5fae2e
sub eax, ecx
mov ecx, dword [esp]
push edx
mov edx, esp
add edx, 4
jmp 0x5fb10b
xchg dword [esp], ecx
mov esp, dword [esp]
sti
jmp 0x5fb6de
push ebx
mov ebx, 0x5f77aa0d
shl ebx, 6
shl ebx, 4
sub ebx, 0x7f28f39e
sub edx, ebx
pop ebx
add edx, 0x6df5bca7
push ebx
mov dword [esp], eax
mov eax, 0x4ffa51f4
shl eax, 8
sub eax, 0x8a5329e5
jmp 0x5fb2dd
mov dword [esp], eax
mov dword [esp], ecx
pop dword [ebx]
sub esp, 4
jmp 0x5fb59f
mov esi, 0x3ff738c7
sub esi, 0xcf9072bd
add edx, esi
pop esi
jmp 0x5fb087
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
push edi
push esp
jmp 0x5faccd
mov dword [esp], ebp
push edi
mov edi, 0x716d7c17
jmp 0x5fad00
xchg dword [esp], ebp
mov esp, dword [esp]
shl edi, 1
jmp 0x5fb563
pop edi
push edi
mov dword [esp], ebx
jmp 0x5fae9b
mov eax, dword [esp]
jmp 0x5fad9f
shl edi, 2
shr edi, 2
jmp 0x5fb5a8
push eax
mov eax, 0x7df7a029
shl eax, 2
jmp 0x5fad14
or eax, 0x57ad89d1
add eax, 0xeee7246c
jmp 0x5fb5fc
mov dword [esp], esi
push ecx
jmp 0x5fb61e
xor edi, 0x10fdc08b
sub ecx, edi
pop edi
push 0x7a779c03
mov dword [esp], esi
push ebp
mov ebp, 0x75a3db30
sub ebp, 0x7dffc63d
jmp 0x5fb5e3
add ebx, 0x67739574
add ebx, eax
sub ebx, 0x67739574
pop eax
push ecx
mov dword [esp], eax
push edx
jmp 0x5fb070
shr ebp, 4
jmp 0x5fb116
xchg dword [esp], esi
mov esp, dword [esp]
add esp, 4
jmp 0x5faca7
sub ebx, eax
pop eax
add ebx, eax
add ebx, 0x6ed6fe43
pop eax
push ebx
mov dword [esp], 0x7ffdb00d
mov dword [esp], eax
jmp 0x5fade4
pop edi
jmp 0x5fb396
mov ecx, 0x2c7956d3
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], eax
push 4
jmp 0x5fadf4
add esp, 4
shl edi, 2
push 0x639ffc38
mov dword [esp], edi
not dword [esp]
jmp 0x5fb67f
pop eax
push ebx
mov ebx, 0x6beb2330
neg ebx
neg ebx
sub esp, 4
mov dword [esp], edi
mov edi, 0x76ee7a8a
add edi, 0xf4fca8a2
sub ebx, edi
pop edi
sub eax, 0x77fc25ab
add eax, ebx
add eax, 0x77fc25ab
pop ebx
jmp 0x5facc1
pop edi
add edi, 0xe84aa6da
push edi
push ebp
jmp 0x5faf31
not eax
not eax
sub eax, 0x3fdd00fb
inc eax
jmp 0x5fb590
mov eax, 0x34ef9f21
jmp 0x5fb5ca
push ecx
jmp 0x5fb73a
mov ecx, 0x33bd3689
add ecx, 0x5def74f7
shr ecx, 7
and ecx, 0x5cdfcc11
push ebp
mov ebp, 0x3f2f4974
jmp 0x5fb759
shl ebp, 2
add ebp, 0x3dfc3f77
jmp 0x5fb269
add ebp, edi
jmp 0x5fadfa