Function at 0x58ec49
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push dword [esp]
push dword [esp]
pop eax
push edi
push ecx
mov dword [esp], eax
jmp 0x58eb96
push eax
not dword [esp]
pop eax
xchg esi, eax
xor esi, 0x6f653492
inc esi
xor esi, 0x7df7ac0f
xor esi, 0xfd64a547
xor eax, esi
pop esi
push edx
mov edx, 0xffffffff
jmp 0x58eb5d
xor esi, eax
jmp 0x58eb01
pop ecx
push esi
mov esi, 0x7fff183d
jmp 0x58ec00
mov ebp, 4
sub edi, 0x754c0572
jmp 0x58eb6a
xor dword [esp], edi
xor edi, dword [esp]
pop esp
add esp, 4
jmp 0x58ec34
add eax, edx
pop edx
sub eax, 0x3542c92a
jmp 0x58ebcd
add edi, ebp
add edi, 0x754c0572
mov ebp, dword [esp]
push ebx
push esp
mov ebx, dword [esp]
add esp, 4
add ebx, 4
add ebx, 4
jmp 0x58ec60
mov dword [esp], edx
jmp 0x58ec07
mov dword [esp], esp
add dword [esp], 4
mov edi, dword [esp]
jmp 0x58ebdd
add ebp, edi
pop edi
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
push ecx
push ebp
mov ebp, 0x4ff701a9
or ebp, 0x4f62aa66
sub ebp, 0xd0004b4e
mov ecx, ebp
pop ebp
jmp 0x58ebee
mov edx, eax
mov eax, dword [esp]
add esp, 4
sub eax, edx
pop edx
jmp 0x58ec93
push esi
mov esi, esp
add esi, 4
add esi, 4
jmp 0x58ec17
or ecx, 0x2bb5cabd
and ecx, 0x23e8931b
push ebp
jmp 0x58eb8e
xor esi, eax
jmp 0x58ec8c
mov edx, 0x67b7a3be
xor ecx, edx
pop edx
shl ecx, 4
jmp 0x58ec68
xchg dword [esp], esi
pop esp
add edi, 4
sub esp, 4
jmp 0x58ec2c
mov dword [esp], ebp
jmp 0x58eb3b
push edx
push edx
mov dword [esp], eax
mov eax, 0x567f58a9
push ebp
mov ebp, 0x73f3bfa0
add eax, ebp
mov ebp, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
push edx
mov dword [esp], edi
mov edi, 4
jmp 0x58eba5
xor ebx, dword [esp]
jmp 0x58ec7b
sub ecx, 0x3ff4f754
sub ecx, 0x95be20ec
sub eax, ecx
jmp 0x58eb2f
xor dword [esp], ebx
xor ebx, dword [esp]
mov esp, dword [esp]
xor edi, dword [esp]
jmp 0x58eb4b
xor eax, esi
jmp 0x58eb28
mov ecx, ebx
jmp 0x58fd9a
sub esp, 4
mov dword [esp], edx
jmp 0x5902c9
add esp, 4
push 0x68f16987
jmp 0x5920d9
mov dword [esp], esp
push 0x487c43c8
jmp 0x5915d8
add ebp, 0x6fb786c8
add ebp, 0x76de594e
sub ebp, 0x6fadab36
mov ebx, dword [esp]
add esp, 4
jmp 0x592e3e
add ebp, 0xffffffff
add ebp, 0xafde2fa
push edi
jmp 0x590894
add ebp, 0x6fadab36
sub ebp, 0x76de594e
sub ebp, 0x6fb786c8
add ebp, ebx
jmp 0x5905a3
push dword [esp]
pop eax
push edx
mov edx, esp
push ebx
push eax
mov dword [esp], 0x77fa8c66
jmp 0x595469
push eax
push esp
pop eax
add eax, 4
sub esp, 4
mov dword [esp], ebx
jmp 0x592e83
push ebp
mov ebp, 0x7df6f42e
sub ebp, 0xfe42d3f9
jmp 0x590f6d
mov ecx, ebx
mov eax, ecx
pop ecx
pop ebx
add dword [esp + 4], eax
jmp 0x591608
or ecx, 0x6bfb9f38
not ecx
add ecx, 0xe3ef46ca
mov eax, ecx
pop ecx
xor dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
mov eax, dword [esp]
add esp, 4
push edi
mov edi, 0x77ef474a
xor eax, edi
push dword [esp]
pop edi
add esp, 4
cmp dword [ebp + 0x122d2e24], 0
jne 0x590a13
cmp dword [ebp + 0x122d2ca0], 0
je 0x590a22
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c5e]
pop eax
cmp dword [ebp + 0x122d2ca0], 0
je 0x590a38
push eax
mov eax, 0
call dword [ebp + 0x122d2186]
pop eax
push 0x1ec431e8
mov dword [esp], esi
push edx
mov dword [esp], esp
add dword [esp], 4
pop esi
push ecx
mov ecx, 0x5fefe711
push edi
mov edi, 0x7fb5b500
inc edi
xor edi, 0x5a19e4
sub ecx, edi
jmp 0x5951ef
pop eax
add esp, 4
sub esp, 4
mov dword [esp], eax
push edi
mov dword [esp], esp
add dword [esp], 4
pop eax
add eax, 4
add eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
jmp 0x590791
mov edi, ebp
pop ebp
sub ebp, edi
pop edi
add ebp, 0x4efcff1a
mov ecx, ebp
mov ebp, dword [esp]
jmp 0x592199
add eax, 0x28fb9aa7
sub eax, 1
inc eax
sub eax, 0x777f75f3
add eax, 0x7e99539d
mov esi, eax
jmp 0x591fa2
pop edi
jmp 0x593587
push dword [esp]
pop eax
push eax
jmp 0x592aaf
push dword [esp]
jmp 0x59488a
mov dword [esp], ecx
push eax
push esi
mov dword [esp], 0x7f67946b
push dword [esp]
pop eax
add esp, 4
and eax, 0x3f1305c1
shl eax, 6
inc eax
push edi
mov dword [esp], esi
mov esi, 0x6dffe123
push 0
jmp 0x593863
mov eax, esp
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], eax
push dword [esp]
jmp 0x5952d3
mov dword [esp], eax
push 0x58a22d87
jmp 0x592e4b
mov eax, dword [esp]
add esp, 4
push dword [esp]
pop eax
add esp, 4
push edx
mov edx, 0x38b3c8c0
sub eax, edx
pop edx
jmp 0x595272
mov dword [esp], ebx
mov ebx, 0x7febb7d6
jmp 0x5924db
push esp
jmp 0x594ebd
not ebp
push esi
mov esi, 0
jmp 0x591b9e
sub esi, ebp
mov ebp, esi
pop esi
jmp 0x59538c
add eax, ebx
pop ebx
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
push ecx
mov dword [esp], 0x3dbd0e0e
jmp 0x593960
pop eax
or esi, 0x67ed47e2
add esi, 0xffffffff
xchg esi, ebx
jmp 0x5928c9
mov dword [esp], edx
mov edx, esp
jmp 0x592c92
mov edi, 0x4ff062d2
add eax, edi
pop edi
jmp 0x5952cb
add esp, 4
sub dword [esp + 4], ecx
pop ecx
jmp 0x591046
push ecx
push ebp
jmp 0x592e45
push ecx
mov dword [esp], 0x47b099a1
mov dword [esp], edi
mov edi, 0x3ffb5e9b
jmp 0x5931c8
push edi
mov edi, 0x356ef748
add edi, 0xa91d2462
mov ebp, edi
pop edi
jmp 0x590685
not ebx
xchg esi, ebx
push ebx
jmp 0x5939ad
mov eax, 0x2f7954f2
sub esi, eax
pop eax
add esi, ecx
add esi, 0x2f7954f2
jmp 0x595247
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
sub esp, 4
mov dword [esp], ebp
mov dword [esp], ecx
jmp 0x593565
add dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
pop eax
push 0x50ba1380
mov dword [esp], ecx
push esi
push eax
mov eax, 0x3f873b75
jmp 0x590ff4
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x592492
neg ebp
jmp 0x59063f
push ecx
jmp 0x59181b
mov dword [esp], edx
mov edx, 0x2affe7f2
inc edx
shr edx, 3
or edx, 0x6e554da8
push edi
jmp 0x5936c7
mov ebx, 4
jmp 0x591cf9
push eax
push edi
mov dword [esp], 0x5b2b9c16
jmp 0x59143b
add edx, edi
jmp 0x5949e7
add eax, edi
jmp 0x59401c
pop edx
mov eax, dword [esp]
jmp 0x5936ae
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
mov esp, dword [esp]
pop eax
jmp 0x594a4d
mov ecx, 0x7bceee5e
add eax, ecx
jmp 0x5935de
mov eax, edx
jmp 0x594ab8
pop ecx
push ecx
mov dword [esp], 0x60499b81
mov dword [esp], eax
jmp 0x592f13
push eax
mov eax, 0x27afb7e0
push edi
mov edi, 0x7edc816b
sub edi, 0x7676a077
push edx
mov edx, esp
add edx, 4
add edx, 4
jmp 0x59350e
mov edi, 0x7fbb99b4
push esi
mov esi, 0xefa46446
add edi, esi
pop esi
sub edx, edi
jmp 0x591035
sub dword [esp], esi
pop esi
xor esi, 0x2f7720c9
xor eax, esi
jmp 0x5938ed
pop esi
push eax
jmp 0x593f06
mov dword [esp], ecx
mov dword [esp], 0x6492e7d1
mov dword [esp], eax
push dword [esp]
jmp 0x59535a
mov ebx, 0x2efeca5a
sub esi, 0x2f7b86cc
add esi, ebx
add esi, 0x2f7b86cc
pop ebx
sub esi, 0x7fd1c9c7
add esi, 0xf0709043
push esi
sub dword [esp], 0x7f873d39
jmp 0x5947a2
xor dword [esp], 0x6fcff7f8
jmp 0x59478b
push dword [esp]
pop edi
push eax
jmp 0x5918c0
pop ecx
xor ecx, 0x6fcff7f8
pop eax
or ecx, 0x29ff4532
inc ecx
shr ecx, 8
jmp 0x5909ce
pop ecx
add ecx, 0x7f873d39
jmp 0x5912a8
pop esi
add esp, 4
sub eax, 0x4ff062d2
sub eax, ecx
jmp 0x59528e
pop edi
add dword [esp + 8], edx
jmp 0x5932fe
mov dword [ebp + 0x122d24c8], eax
mov dword [ebp + 0x122d1d8e], 0
push edx
mov dword [esp], eax
push eax
mov eax, 0x3ffb5e9b
jmp 0x594d0f
mov edx, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], edx
mov edx, 0x1e0007ab
sub dword [esp + 8], 0x7deb1c34
sub dword [esp + 8], edx
add dword [esp + 8], 0x7deb1c34
pop edx
add dword [esp + 4], eax
push edx
push edi
mov edi, 0x1d7d73bc
mov edx, 0x8293ef
jmp 0x592ffc
push edi
mov edi, 0x5e7699e0
jmp 0x595040
pop eax
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
cmp dword [ebp + 0x122d2e24], 0
jne 0x594edc
cmp dword [ebp + 0x122d2ca0], 0
je 0x594ef1
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d1e37], eax
call dword [ebp + 0x122d3199]
pop eax
push eax
jmp 0x59231f
add dword [esp + 8], 0x37285e0e
add dword [esp + 8], edi
sub dword [esp + 8], 0x37285e0e
pop edi
sub dword [esp + 4], eax
sub dword [esp + 4], 0x5e7699e0
pop eax
jmp 0x5950c3
push dword [esp]
push dword [esp]
mov eax, dword [esp]
jmp 0x5951e4
add esp, 4
jmp 0x58fe16
pop edi
shr ecx, 2
or ecx, 0x73cffcfa
add ecx, 0x84300109
sub esi, 0x5fdb0025
push eax
jmp 0x592925
add esi, 0x5fdb0025
pop ecx
jmp 0x595253
sub esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
push eax
push ebx
mov ebx, 0x38b3c8c0
push ecx
jmp 0x5908b0
push 0x652f7582
mov dword [esp], esi
mov dword [esp], eax
push eax
mov eax, 0x2f9f98f0
jmp 0x592b8a
push edi
jmp 0x592159
add esp, 4
cmp dword [ebp + 0x122d2e24], 0
jne 0x5952b4
cmp dword [ebp + 0x122d2ca0], 0
je 0x5952c5
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d320b]
pop ebx
pop eax
push eax
jmp 0x591570
mov ecx, dword [esp]
jmp 0x59529c
push dword [esp]
push dword [esp]
jmp 0x590b8f
push dword [esp]
pop eax
add esp, 4
push edx
mov dword [esp], edi
push esp
mov edi, dword [esp]
add esp, 4
push ebp
push ecx
mov ecx, 0x7bf7a4d0
mov ebp, ecx
mov ecx, dword [esp]
add esp, 4
shl ebp, 3
jmp 0x591afc
add ebp, 0xffffffff
add ebp, 0x2042d984
sub edi, 0x6eeb9532
add edi, ebp
add edi, 0x6eeb9532
pop ebp
add edi, 4
xchg dword [esp], edi
jmp 0x595410
mov esp, dword [esp]
cmp dword [ebp + 0x122d2e24], 0
jne 0x595425
cmp dword [ebp + 0x122d2ca0], 0
je 0x595434
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2305]
pop eax
push edi
mov dword [esp], ebx
jmp 0x595456
mov dword [esp], ecx
push eax
pop ecx
sub esp, 4
mov dword [esp], ecx
jmp 0x590713
pop ebx
or ebx, 0x75b33314
sub ebx, 0x77fbbf72
add edx, 0x3ff5622e
add edx, ebx
push ecx
jmp 0x593660