Function at 0x60370a
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
pop edi
add dword [esp + 4], edx
jmp 0x600bb5
pop esi
sub eax, 0x5fbddcee
sub eax, edx
add eax, 0x5fbddcee
mov edx, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], esi
mov esi, eax
push eax
mov eax, esp
push edx
mov edx, 0x6ffe7b2b
jmp 0x60212c
pop ebp
xchg dword [esp], esi
mov esp, dword [esp]
push edi
jmp 0x60386a
pop dword [esp]
pop esp
mov dword [esp], edi
mov dword [esp], edx
jmp 0x6049ed
cmp dword [ebp + 0x122d3a31], 0
jne 0x6003a3
cmp dword [ebp + 0x122d3c51], 0
je 0x6003b2
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1ed7]
pop eax
cmp dword [ebp + 0x122d3c51], 0
je 0x6003c8
push eax
mov eax, 0
call dword [ebp + 0x122d2f3d]
pop eax
push ebx
push esi
mov dword [esp], esp
add dword [esp], 4
pop ebx
add ebx, 4
push eax
mov eax, 0x7cb71c6d
jmp 0x6028e2
pop eax
add ebp, 0x7ffea9a0
jmp 0x601a48
pop eax
add esp, 4
push ebx
mov ebx, 0x7ef5d544
dec ebx
sub ebx, 0x63f7a086
xor ebx, 0x7febfe50
add ebx, 0x37dfb5fe
inc ebx
sub ebx, 0x5dc3f49a
xor eax, ebx
pop ebx
push dword [esp]
pop esi
sub esp, 4
mov dword [esp], ebp
jmp 0x603831
mov esi, 0x6f6bbf89
jmp 0x600ae0
mov dword [esp], edx
push eax
mov eax, 0x7bf8c2df
jmp 0x600eb3
push esi
jmp 0x604aae
shl ecx, 8
add ecx, 0xc033d552
mov eax, ecx
pop ecx
xor dword [esp + 4], eax
pop eax
jmp 0x602919
add edx, 0x76f74d53
add edx, 0x7479d3c
not edx
jmp 0x603505
push dword [esp + 4]
mov ebp, dword [esp]
jmp 0x60354f
add edx, esi
jmp 0x600060
xor dword [esp], 0x795f5845
jmp 0x6046cb
pop edx
pop eax
push ecx
mov dword [esp], edx
mov edx, 0x77dfe598
inc edx
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
mov dword [esp], esi
mov esi, 0x767ae004
xor edx, esi
push dword [esp]
pop esi
add esp, 4
and edx, 0x7a373c9
jmp 0x600721
push esi
mov esi, 0x7fbf4538
sub edi, 0x77fa8c09
sub edi, esi
add edi, 0x77fa8c09
pop esi
jmp 0x604fcd
mov edx, 0xe16c0eb
jmp 0x602d72
sub ecx, 0xd7f94443
jmp 0x6029d0
add esi, ebp
sub esi, 0x7bd7dc00
add esi, 0x7fd512ec
jmp 0x60016c
push ebp
mov ebp, 0x63e2f4b7
mov dword [esp + 4], ebp
mov ebp, dword [esp]
add esp, 4
mov dword [esp], esi
push 0x3754ddc1
mov dword [esp], eax
pop esi
push esi
jmp 0x6051a4
push 0x2cc62e2e
mov dword [esp], ebx
mov ebx, 0x37d6f9ea
add ebx, 0x48186b21
xor ebp, ebx
mov ebx, dword [esp]
add esp, 4
push eax
mov eax, ebp
mov ecx, eax
pop eax
mov ebp, dword [esp]
add esp, 4
add ebp, ecx
push dword [esp]
pop ecx
add esp, 4
sub ebp, 4
sub esp, 4
mov dword [esp], ebp
jmp 0x6007e7
pop esi
pop ebx
xor ecx, 0x7f2e8c0f
add ecx, 0xffffffff
add ecx, 0x753f0fc2
add ecx, 0x7f5f0ca3
sub ecx, 0xf4b72d72
mov ebp, ecx
mov ecx, dword [esp]
add esp, 4
jmp 0x604933
mov dword [esp], esi
push esp
pop esi
add esi, 4
jmp 0x601c92
mov eax, dword [esp]
jmp 0x604318
push ebp
mov ebp, 0xa841c26e
add eax, ebp
mov ebp, dword [esp]
add esp, 4
add edi, 0x6ffff6d7
add edi, eax
sub edi, 0x6ffff6d7
jmp 0x602b54
mov edi, dword [esp]
add esp, 4
push eax
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x2fb781da
dec ecx
jmp 0x600ff6
xor eax, edx
mov edx, dword [esp]
add esp, 4
sub ebx, eax
mov eax, dword [esp]
add esp, 4
xor ebx, dword [esp]
xor dword [esp], ebx
jmp 0x604c86
mov dword [esp], esp
push edi
mov edi, 4
jmp 0x602cd8
mov esp, dword [esp]
cmp dword [ebp + 0x122d3a31], 0
jne 0x601870
cmp dword [ebp + 0x122d3c51], 0
je 0x60187f
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1ff8]
pop eax
sub esp, 4
mov dword [esp], ebx
jmp 0x604c6d
xor edx, 0x5cbdc333
shr edx, 8
not edx
shl edx, 3
jmp 0x6033d0
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], eax
jmp 0x601a0a
sub esp, 4
jmp 0x602b69
push dword [esp]
push dword [esp]
pop eax
add esp, 4
push ebp
mov ebp, esp
jmp 0x601d6b
pop edi
push eax
jmp 0x603012
sub esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
mov dword [esp], eax
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], esi
mov esi, esp
push edx
push esi
push edx
jmp 0x602c1c
mov ecx, dword [esp]
push edx
mov edx, esp
jmp 0x60410b
pop edi
mov eax, dword [esp]
jmp 0x601dbe
add ebp, 4
jmp 0x602fb3
push edx
mov edx, 0xe3ff0a1
mov edi, 0x88ce7f01
xor edi, edx
pop edx
sub edi, eax
pop eax
sub dword [esp + 4], edi
jmp 0x601d1f
sub esp, 4
mov dword [esp], ebp
mov dword [esp], 0x344fd01a
mov dword [esp], esi
mov esi, esp
jmp 0x603445
xor ebx, 0x1fd5f607
dec ebx
xor ebx, 0x198743b8
jmp 0x6029e0
cmp dword [ebp + 0x122d3a31], 0
jne 0x601fef
cmp dword [ebp + 0x122d3c51], 0
je 0x602004
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d1e0e], eax
call dword [ebp + 0x122d2f1c]
pop eax
push ecx
jmp 0x604844
pop ebx
sub ebx, 0x5efd614d
pop esi
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x6fdedd27
add eax, ecx
jmp 0x601cf0
mov esi, dword [esp]
add esp, 4
push dword [esp]
pop edx
add esp, 4
jmp 0x601fdd
add edx, 0x79f7f833
dec edx
dec edx
add edx, 0x7dde5600
jmp 0x6032df
add eax, 0x8348e397
jmp 0x602c44
push dword [esp]
jmp 0x600500
push eax
mov eax, 0x134e8511
add ebp, eax
jmp 0x600476
mov eax, ecx
mov ecx, dword [esp]
add esp, 4
jmp 0x6013da
push esi
mov esi, ebx
mov ecx, esi
jmp 0x6012fb
mov dword [esp], eax
jmp 0x60171d
mov dword [esp], 0x7deb7da4
jmp 0x603215
sub ebx, eax
pop eax
xchg dword [esp], ebx
mov esp, dword [esp]
jmp 0x6031df
sub dword [esp + 4], 0x7f5fcf50
add dword [esp + 4], edi
add dword [esp + 4], 0x7f5fcf50
jmp 0x60335f
xor edx, eax
pop eax
jmp 0x601895
add ebp, 4
xchg dword [esp], ebp
pop esp
cmp dword [ebp + 0x122d3a31], 0
jne 0x602fcf
cmp dword [ebp + 0x122d3c51], 0
je 0x602fe4
push eax
mov eax, eax
mov eax, 0x7d0
mov dword [ebp + 0x122d1e0e], eax
call dword [ebp + 0x122d2f1c]
pop eax
sub esp, 4
jmp 0x603c1d
mov dword [esp], edi
mov edi, 0x5d6fb4a0
sub edi, 1
shl edi, 1
dec edi
sub edi, 0xbadf6939
add ebp, edi
push dword [esp]
jmp 0x60352e
push dword [esp]
pop edi
push ebp
mov ebp, esp
push eax
mov eax, 4
add ebp, eax
pop eax
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
pop ebp
mov dword [esp + 4], edi
jmp 0x60505b
mov dword [esp], eax
push dword [esp]
pop eax
push ecx
jmp 0x6019eb
not dword [esp]
add dword [esp], 0x7efdf69e
add dword [esp], 0x613c40a2
inc dword [esp]
jmp 0x604cc3
pop edx
sub esi, 0x2ff277ab
pop edi
push ebp
push ecx
push ebx
push 0x796528a1
pop ebx
jmp 0x601f00
push edi
mov edi, 0x4ccacd75
add edi, 0x5fff19cd
jmp 0x6044b6
pop edi
mov ecx, dword [esp]
push eax
mov eax, esp
push ebx
mov ebx, 4
jmp 0x603458
push esp
pop esi
add esi, 4
sub esi, 4
push esi
push dword [esp + 4]
mov esi, dword [esp]
jmp 0x6049ad
sub esp, 4
mov dword [esp], edi
mov edi, 0x6abe1ea8
not edi
add edi, 0xe3c75dfa
add edx, edi
pop edi
push esi
mov esi, 0x3fff90d9
add eax, esi
jmp 0x6036c6
push ebx
mov ebx, 4
add esi, ebx
mov ebx, dword [esp]
add esp, 4
jmp 0x6048c9
add eax, ebx
pop ebx
push esi
mov esi, 0x37f90c39
neg esi
inc esi
sub esi, 0xc806f3c4
add eax, esi
pop esi
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push 0x61ceff36
mov dword [esp], ecx
mov dword [esp], eax
sub esp, 4
mov dword [esp], ebx
mov dword [esp], edi
mov edi, 0x77bea141
add dword [esp + 4], 0x7f3f7316
add dword [esp + 4], edi
push edx
mov edx, 0x7f3f7316
sub dword [esp + 8], edx
pop edx
pop edi
jmp 0x6037fe
and edx, 0x7d6e0c77
push esi
jmp 0x6005b6
pop edi
add esp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
jmp 0x60185b
add esp, 4
pop dword [esp]
jmp 0x6040af
pop esi
jmp 0x600391
pop esi
sub eax, edx
sub eax, 0x3fff90d9
mov edx, dword [esp]
add esp, 4
cmp dword [ebp + 0x122d3a31], 0
jne 0x6036e9
cmp dword [ebp + 0x122d3c51], 0
je 0x6036fa
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2dce]
pop ebx
pop eax
push edx
mov dword [esp], 0x205aa2ac
mov dword [esp], edi
jmp 0x603c47
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
jmp 0x602024
push dword [esp]
jmp 0x604769
push esp
pop ebp
push edx
mov edx, 0x6f6e443c
sub edx, 0x6f6e4438
add ebp, edx
pop edx
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
mov byte [ebp + 0x122d2e6e], 0x47
push 0x93c8f7c1
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
push edi
push esp
jmp 0x6014a3
mov edi, 0x3fdb6fba
add eax, edi
pop edi
mov byte [ebp + 0x122d2e6e], 0x53
push 0x99395f90
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2e59], eax
mov byte [ebp + 0x122d2e6e], 0x57
push 0x90045206
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d38cf], eax
mov byte [ebp + 0x122d2e6e], 0x43
push 0xbc907028
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d1f77], eax
mov byte [ebp + 0x122d2e6e], 0x4c
push 0xd9da1ce9
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x1245cde4], eax
mov byte [ebp + 0x122d2e6e], 0x46
push 0xbade0614
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d387f], eax
mov byte [ebp + 0x122d2e6e], 0x44
push 0xbb738e55
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2e34], eax
mov byte [ebp + 0x122d2e6e], 0x47
push 0x8a0fb5e2
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d393d], eax
mov byte [ebp + 0x122d2e6e], 0x47
push 0x83d0b5f3
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d3034], eax
mov byte [ebp + 0x122d2e6e], 0x77
push 0xf397a8a3
push dword [ebp + 0x122d306b]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2c50], eax
mov byte [ebp + 0x122d2e6e], 0x47
push 0x8728faf6
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2e92], eax
mov byte [ebp + 0x122d2e6e], 0x43
push 0xbc8e6efc
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d1df3], eax
mov byte [ebp + 0x122d2e6e], 0x45
push 0x8e726969
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2dbc], eax
mov byte [ebp + 0x122d2e6e], 0x44
push 0xb8f2ec64
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2099], eax
push 0xcee4e7b8
push dword [ebp + 0x122d3546]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d2c69], eax
mov byte [ebp + 0x122d2e6e], 0x43
push 0xc0764aa7
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d5c47], eax
mov byte [ebp + 0x122d2e6e], 0x56
push 0xd41f6d39
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d3bbd], eax
mov byte [ebp + 0x122d2e6e], 0x53
push 0xfcb148d8
push dword [ebp + 0x122d03d1]
call dword [ebp + 0x122d1e09]
mov dword [ebp + 0x122d208c], eax
cmp byte [ebp + 0x12464913], 0
je 0x605093
lea eax, [ebp + 0x124648f5]
sub esp, 4
jmp 0x6049e4
add esp, 4
push ecx
jmp 0x604ff0
mov dword [esp], eax
sub dword [esp], 0x3fdb6fba
push dword [esp]
jmp 0x601338
mov dword [esp], eax
add dword [esp], 0x76de54f2
mov eax, dword [esp]
add esp, 4
push ebp
jmp 0x6047da
mov dword [esp], ebp
push esp
pop ebp
push edx
jmp 0x604d89
pop esp
mov dword [esp], eax
pop eax
push ebx
mov dword [esp], edi
push esp
pop edi
sub esp, 4
mov dword [esp], esi
jmp 0x6040e1
mov esi, 4
jmp 0x6045b0
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
sub eax, ebx
sub eax, 0x6fdedd27
pop ebx
push esi
jmp 0x604b9e
pop ebx
sub esi, eax
pop eax
add esi, 0x7ed69726
add esi, edx
sub esi, 0x7ed69726
add esi, 0x3fdb154a
pop edx
add esi, 4
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
cmp dword [ebp + 0x122d3a31], 0
jne 0x604161
cmp dword [ebp + 0x122d3c51], 0
je 0x604176
push eax
mov eax, eax
mov eax, 0x7d1
mov dword [ebp + 0x122d1e0e], eax
call dword [ebp + 0x122d2f1c]
pop eax
push eax
jmp 0x601263
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x122d3a31], 0
jne 0x6042ea
cmp dword [ebp + 0x122d3c51], 0
je 0x6042f9
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x124599e0]
pop eax
push ebp
push esp
jmp 0x604f62
add esp, 4
push esi
mov esi, esp
push edi
jmp 0x60497a
neg edi
or edi, 0x3e77e066
dec edi
shr edi, 5
xor edi, 0x642f769f
xor edx, edi
pop edi
add eax, edx
pop edx
sub eax, 4
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
mov dword [esp], esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0x76f210df
jmp 0x601d76
add edi, 0x7fbf4538
add edi, esi
jmp 0x600d35
pop edx
xor edx, 0x795f5845
jmp 0x604f34
push dword [esp]
pop eax
add esp, 4
add esp, 4
push 0x651cee1a
jmp 0x6005f2
mov dword [esp], ebx
jmp 0x60060f
push ebp
mov ebp, 0x64d67bf3
mov dword [esp + 4], ebp
jmp 0x604868
pop ebp
mov dword [esp], eax
push edx
sub esp, 4
mov dword [esp], edi
mov edi, 0x6f8bbff0
mov edx, edi
jmp 0x5ffeb7
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
add eax, 0xfff7ec1
jmp 0x603566
sub esi, 0x7fd512ec
add esi, 0x7bd7dc00
jmp 0x601001
mov edi, 4
add esi, 0x2ff277ab
sub esi, 0x7fc78c9e
add esi, edi
push edx
mov edx, 0x7fc78c9e
add esi, edx
jmp 0x6032be
add esp, 4
jmp 0x6002b0
mov dword [esp], eax
push ecx
jmp 0x604b48
mov dword [esp], eax
mov eax, dword [esp]
sub esp, 4
jmp 0x603e18
mov esi, 0x6dff1f91
push eax
mov eax, 0x7ffd6d00
or esi, eax
pop eax
push esi
dec dword [esp]
pop esi
add esi, 0xf6ded562
push eax
mov dword [esp], edx
jmp 0x604ad0
mov edx, esp
add edx, 4
sub edx, 4
jmp 0x604af7
xchg dword [esp], edx
pop esp
mov dword [esp], esi
add dword [esp], 0x5efd614d
jmp 0x60200a
mov dword [esp], edi
push ebp
push esi
mov esi, 0x27d538c5
mov ebp, esi
pop esi
sub ebp, 0xddfc56bd
push ebp
jmp 0x60310f
mov dword [esp], 0x56fb9082
mov dword [esp], eax
mov eax, dword [esp]
sub esp, 4
mov dword [esp], ebp
jmp 0x604be0
mov dword [esp], ebp
mov dword [esp], ecx
mov dword [esp], edx
jmp 0x605067
push esp
mov ebp, dword [esp]
add esp, 4
push edi
mov edi, 0x7d7f3456
not edi
xor edi, 0x8280cbad
sub ebp, 0x7ffea9a0
push ecx
mov ecx, 0x134e8511
sub ebp, ecx
pop ecx
add ebp, edi
jmp 0x60299b
push esp
pop ebx
add ebx, 4
push eax
push edx
mov edx, 0x2f7fd3e0
mov eax, 0x2f7fd3e4
jmp 0x60164d
xor ebx, dword [esp]
mov esp, dword [esp]
mov dword [esp], esi
jmp 0x604ca4
mov dword [esp], 0x2d7283ae
mov dword [esp], edx
push eax
add dword [esp], 0x1bef28ff
pop edx
push ecx
push esi
mov esi, 0x7fff1fec
jmp 0x604d10
inc dword [esp]
add dword [esp], 0x11789f84
pop esi
add esi, 0x9e550dd
jmp 0x605061
mov ecx, 0x9bf00913
jmp 0x604d5d
add ecx, esi
pop esi
sub edx, ecx
pop ecx
push edx
pop eax
push dword [esp]
mov edx, dword [esp]
jmp 0x604d70
add esp, 4
add esp, 4
sub esp, 4
mov dword [esp], esi
jmp 0x603377
mov edx, 0x7abf90db
sub edx, 0x7abf90d7
add ebp, edx
mov edx, dword [esp]
add esp, 4
push 0x7b1fdbcf
mov dword [esp], ebx
push eax
jmp 0x604fbd
pop esi
and edx, 0x1faf8552
and edx, 0x7c6e429b
sub edx, 0x76d7b272
not edx
sub edx, 0x5aabb25b
push eax
jmp 0x605108
pop ebp
push 0x4300d6f8
mov dword [esp], ecx
push ebp
push 0x7fef6510
pop ebp
push esi
mov dword [esp], ecx
mov ecx, 0xffffffff
add ebp, ecx
pop ecx
jmp 0x6012b1
mov eax, 4
mov ebx, eax
pop eax
add ebp, ebx
pop ebx
jmp 0x6042cc
push dword [esp]
pop esi
jmp 0x603b94
mov ecx, 4
sub edi, ecx
mov ecx, dword [esp]
add esp, 4
jmp 0x60197c
pop edi
jmp 0x604bb9
push esi
jmp 0x600b1c
mov dword [esp], eax
mov dword [esp], esi
mov dword [esp], ebx
mov dword [esp], eax
push 1
push 0
push 0
call dword [ebp + 0x122d1f77]
mov dword [ebp + 0x122d2fe0], eax
push 0xffffffffffffffff
push dword [ebp + 0x122d2fe0]
call dword [ebp + 0x122d38cf]
push 0x67a04157
jmp 0x601328
push ebx
mov ebx, 0x6fee8d2f
mov eax, 0xafc9a279
sub eax, ebx
jmp 0x604129
push eax
push ecx
jmp 0x6051ee
push 0x5f75d7d3
pop ecx
sub ecx, 0x7ff6da1c
jmp 0x60070b