Function at 0x5e5497
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
das
test byte [esi], cl
push eax
ficomp dword [ebx]
jns 0x5e0610
scasd eax, dword es:[edi]
test byte [esi], cl
push eax
das
pushfd
push cs
push eax
ficomp dword [ebx]
jns 0x5e061c
das
pushfd
push cs
push eax
imul edi, dword [esp + ebx*8 + 0x164367fd], 0xbb19173c
push edi
mov al, 0x97
xchg edi, eax
cdq
lcall 0x48d9, 0x68dd364d
xor dword [0x96c92ee2], esp
adc esp, eax
mov esp, 0x57036c9d
cmp ch, byte [edi]
les edi, [ebp + ebx*4 + 0x3a57036c]
das
add ch, byte [ebx + edx + 0x6e6b9be9]
cdq
or ch, dh
wait
imul ebp, dword [esi - 0x67], 0xa
out dx, al
push edi
pop ss
sti
mov eax, 0x649b057
cmp al, 0xa3
mov al, byte [0xc434f335]
push cs
outsd dx, dword [esi]
lodsd eax, dword [esi]
out 0xea, eax
push edi
out dx, eax
in al, dx
outsb dx, byte [esi]
cmp eax, 0x4657ea7d
mov eax, dword [esp]
add esp, 4
or eax, 0x7e6f6bba
push ebx
mov ebx, 0xfeaf7015
jmp 0x5e5623
push edi
mov edi, 4
add ebx, 0x5dc7f377
add ebx, edi
push ecx
jmp 0x5e0a69
push 0xc0000000
push dword [ebp + 0x122d399f]
call dword [ebp + 0x122d1f32]
cmp eax, 0xffffffff
jne 0x5e431b
inc dword [ebp + 0x12455046]
cmp dword [ebp + 0x12455046], 2
je 0x5e1241
lea eax, [ebp + 0x10082090]
call eax
lea eax, [ebp + 0x10081b76]
call eax
jmp 0x5e3c41
pop esi
push esi
push edi
mov edi, 0x77bfaa5d
mov esi, 0xb76cc62f
sub esi, edi
pop edi
or dword [esp + 4], esi
jmp 0x5e2e63
pop edx
add esp, 4
cmp dword [ebp + 0x122d3a5f], 0
jne 0x5e0838
cmp dword [ebp + 0x122d3ad3], 0
je 0x5e084d
push eax
mov eax, eax
mov eax, 0x7d9
mov dword [ebp + 0x122d1eb0], eax
call dword [ebp + 0x122d3057]
pop eax
push ebp
mov dword [esp], eax
push eax
jmp 0x5e13e4
pop ebx
add ecx, 0x82b400de
and eax, ecx
jmp 0x5e0d42
jmp 0x5e5f8f
add edx, 0x7edf9d00
sub edx, ecx
sub edx, 0x7edf9d00
mov ecx, dword [esp]
add esp, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
jmp 0x5e3d85
push eax
mov dword [esp], ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
jmp 0x5e386a
mov ebp, dword [esp]
push edi
mov edi, esp
add edi, 4
jmp 0x5e0a4f
push ecx
mov ecx, 4
sub eax, ecx
pop ecx
xchg dword [esp], eax
pop esp
jmp 0x5e20bf
add edi, 4
xchg dword [esp], edi
jmp 0x5e414d
mov ecx, 0x7db7cf00
inc ecx
jmp 0x5e0aa5
shl ecx, 2
not ecx
dec ecx
xor ecx, 0x54e7308d
sub ebx, ecx
jmp 0x5e1d87
mov ebx, edx
push dword [esp]
jmp 0x5e1c28
push 0
jmp 0x5e06be
add esp, 4
push dword [esp]
pop eax
add esp, 4
push 0x107d862e
mov dword [esp], esi
mov esi, 0x6e7ff67d
sub eax, 0x76965149
add eax, esi
add eax, 0x76965149
pop esi
jmp 0x5e21e9
pop ecx
cmp eax, 5
jae 0x5e0f84
mov dword [ebp + 0x122d3b83], 1
lea eax, [ebp + 0x1245459c]
jmp 0x5e1d55
pop edx
add eax, edi
mov edi, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
xor eax, 0x7f625c77
xor eax, 0x74c29801
and ecx, eax
jmp 0x5e582d
add ebx, ecx
pop ecx
jmp 0x5e2ae7
xor edi, ebx
jmp 0x5e1d04
push esp
jmp 0x5e2cb7
sub edi, edx
jmp 0x5e0dd3
cmp dword [ebp + 0x122d3b63], 0
je 0x5e1d4f
lea eax, [ebp + 0x124545c7]
jmp 0x5e1d55
add eax, 4
sub eax, 4
jmp 0x5e1ead
mov edi, 0x2f7a182
jmp 0x5e56ef
push dword [ebp + 0x124550a9]
call dword [ebp + 0x122d2026]
mov eax, dword [ebp + 0x122d304e]
jmp 0x5e15be
pop ebx
jmp 0x5e37a4
sub esp, 4
mov dword [esp], edx
mov edx, 0x3fbfd129
push ebp
mov ebp, edx
mov eax, ebp
jmp 0x5e440d
sub dword [esp + 8], ebp
pop ebp
add dword [esp + 4], eax
add dword [esp + 4], 0x73d70aca
mov eax, dword [esp]
jmp 0x5e280c
mov dword [esp], eax
mov eax, 0xf811ef1b
sub dword [esp + 4], eax
jmp 0x5e1fe5
add dword [esp], 4
pop ebp
jmp 0x5e4e7f
lea eax, [ebp + 0x12454c4e]
push eax
push esp
pop eax
add eax, 4
jmp 0x5e1a6c
push ebx
mov ebx, 0x5ffb279a
sub ebx, 0x6bf2cc88
inc ebx
and ebx, 0x7ffa164c
dec ebx
inc ebx
jmp 0x5e2022
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
mov esp, dword [esp]
jmp 0x5e43d5
mov dword [esp], ecx
push esp
jmp 0x5e2b6c
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], edx
jmp 0x5e32be
mov edx, dword [esp]
add esp, 4
jmp 0x5e30fb
pop ebx
add eax, edi
pop edi
jmp 0x5e09a2
lea eax, [ebp + 0x124545a9]
mov dword [ebp + 0x122d399f], eax
cmp dword [ebp + 0x122d3b63], 0
jne 0x5e1d75
cmp dword [ebp + 0x122d38eb], 0
je 0x5e08c3
jmp 0x5e5a1e
pop ecx
pop edi
sub ebx, 4
push edx
mov dword [esp], ebx
push dword [esp + 4]
push dword [esp]
pop ebx
push ecx
mov ecx, esp
add ecx, 4
push eax
mov eax, 0x6eaf682a
jmp 0x5e2a07
push dword [esp]
jmp 0x5e3002
push eax
push dword [esp + 4]
jmp 0x5e5136
mov eax, 0x7fff678c
sub dword [esp + 4], eax
pop eax
pop ebx
add ebx, 0x7fff678c
mov esi, dword [esp]
jmp 0x5e376f
pop eax
push ecx
mov ecx, 0x20523aa0
xor dword [esp + 4], ecx
jmp 0x5e6298
add ebx, 0x8bf7ee04
add ecx, ebx
pop ebx
xchg dword [esp], ecx
mov esp, dword [esp]
jmp 0x5e563d
mov dword [esp], ecx
mov ecx, 0x10
add edx, ecx
jmp 0x5e2b2b
cmp dword [ebp + 0x12454568], 0x6165726f
je 0x5e2270
lea eax, [ebp + 0x124545dc]
push eax
lea eax, [ebp + 0x12454719]
push eax
lea eax, [ebp + 0x1245473a]
push eax
call dword [ebp + 0x122d2f75]
add esp, 0xc
mov byte [ebp + 0x122d1e47], 0x44
push 0x96a3184f
push dword [ebp + 0x122d0a29]
call dword [ebp + 0x122d3037]
mov ebx, eax
lea eax, [ebp + 0x1245473a]
push eax
call ebx
lea eax, [ebp + 0x12454568]
push eax
lea eax, [ebp + 0x124545dc]
push eax
cmp dword [ebp + 0x122d3b63], 0
je 0x5e2259
lea eax, [ebp + 0x12454702]
jmp 0x5e225f
lea eax, [ebp + 0x124546eb]
push eax
lea eax, [ebp + 0x1245473a]
push eax
call dword [ebp + 0x122d2f75]
add esp, 0x10
call dword [ebp + 0x122d5cd8]
sub esp, 4
mov dword [esp], ecx
push 0x69eebdf4
mov dword [esp], eax
push 0x2ec6a8cf
jmp 0x5e068a
mov ebx, 0x177ff7ea
jmp 0x5e0e64
push 0x5f1f8484
mov edi, dword [esp]
add esp, 4
xor edi, 0x5f1f8480
push edx
jmp 0x5e5561
mov dword [esp + 4], ebx
push dword [esp]
push dword [esp]
pop ebx
add esp, 4
add esp, 4
jmp 0x5e2f60
push 0x5a64ae00
jmp 0x5e49d8
mov ebx, ecx
jmp 0x5e474c
add ebx, 0x726d8742
or ebx, 0x3fdf38b8
add ebx, 0x78005f4a
add ebp, ebx
pop ebx
add ebp, ebx
sub ebp, 0x77ffdb46
jmp 0x5e13d6
dec eax
add eax, 0xffffffff
sub eax, 0x68d395cd
add eax, 0xfa242da9
add ecx, eax
jmp 0x5e3b75
and ebx, 0x77aedc7f
jmp 0x5e29b5
push dword [esp]
pop ecx
add esp, 4
xor edx, dword [esp]
xor dword [esp], edx
jmp 0x5e2d06
mov ecx, dword [esp]
add esp, 4
add ecx, 4
jmp 0x5e15d1
pop eax
push edx
mov dword [esp], edi
push 0x7dff174d
pop edi
sub edi, 0x667f1f5f
push ebx
jmp 0x5e246a
xor edx, dword [esp]
pop esp
sub esp, 4
mov dword [esp], edx
mov dword [esp], 0x75fe0785
shl dword [esp], 5
xchg dword [esp], ebx
not ebx
jmp 0x5e08ed
add edx, 0x8eab54a3
jmp 0x5e3733
pop edi
add edx, ecx
pop ecx
push eax
jmp 0x5e0f11
pop esi
shr dword [esp], 6
add dword [esp], 0x43c2fbf2
jmp 0x5e3633
push ecx
push 0x6e7ff67d
jmp 0x5e35c5
mov dword [esp], eax
pop esi
push esi
push eax
jmp 0x5e1f68
lea eax, [ebp + 0x124546eb]
push edi
mov dword [esp], 0x639ef3d5
mov dword [esp], eax
mov dword [esp], ebx
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], esp
add dword [esp], 4
jmp 0x5e5506
pop edx
jmp 0x5e62be
add esp, 4
jmp 0x5e27dc
cmp dword [ebp + 0x122d3a5f], 0
jne 0x5e3145
cmp dword [ebp + 0x122d3ad3], 0
je 0x5e315a
push eax
mov eax, eax
mov eax, 0x7d3
mov dword [ebp + 0x122d1eb0], eax
call dword [ebp + 0x122d3057]
pop eax
push 0x21e4e434
mov dword [esp], eax
push esi
jmp 0x5e2ef4
mov dword [esp], eax
jmp 0x5e56a0
sub dword [esp + 4], esi
pop esi
push 3
jmp 0x5e5699
shr esi, 3
jmp 0x5e53b6
pop ecx
push ebx
jmp 0x5e2916
push ebx
jmp 0x5e57d7
mov dword [esp], eax
mov eax, dword [esp]
add esp, 4
jmp 0x5e3133
mov edi, edx
jmp 0x5e3b6f
add esp, 4
push ebx
lea ebx, [ebp + 0x122d07d5]
mov eax, dword [ebx]
mov dword [ebx], eax
mov eax, dword [ebx + 0x50]
mov dword [ebx + 0x50], eax
lea ebx, [ebp + 0x12455042]
mov eax, dword [ebx]
mov dword [ebx], eax
pop ebx
push 0
lea eax, [ebp + 0x12455042]
push esi
mov dword [esp], ecx
push esp
pop ecx
jmp 0x5e0a74
xchg dword [esp], ebp
mov esp, dword [esp]
mov eax, edx
push dword [esp]
jmp 0x5e081f
push 0x75a0714e
mov dword [esp], esi
jmp 0x5e4879
pop ebp
jmp 0x5e4e79
dec ecx
inc ecx
inc ecx
xor ecx, 0x5eff6770
sub ecx, 0xa89baf26
jmp 0x5e0dfd
pop edx
jmp 0x5e47b9
pop eax
jmp 0x5e4ce0
sub esp, 4
jmp 0x5e62b5
mov esp, dword [esp]
mov dword [esp], eax
call dword [ebp + 0x122d2f75]
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], edx
mov edx, esp
push ecx
push 0x76195a1d
mov dword [esp], edi
jmp 0x5e26fd
mov ebp, dword [esp]
push ebp
push edi
jmp 0x5e4e54
mov esp, dword [esp]
add edx, ebx
pop ebx
push ecx
mov ecx, 0x7dbc2ff0
xor ecx, 0x7dbc2ff4
jmp 0x5e08c8
push ebp
mov dword [esp], edx
push 0x70318801
mov dword [esp], ebp
mov ebp, eax
mov edx, ebp
jmp 0x5e3f91
pop eax
sub eax, 0x3fbfd129
push 0x2b6848b7
mov dword [esp], edi
push esp
mov edi, dword [esp]
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
add edi, 4
push ebp
push esp
pop ebp
push ebx
mov ebx, 0x7cfea207
jmp 0x5e4c4f
push dword [esp]
pop ebp
add esp, 4
pop edx
push ebp
jmp 0x5e463a
push eax
mov eax, 0x7fef705d
not eax
jmp 0x5e5760
mov ebp, 0x73d70aca
jmp 0x5e141c
mov esi, ebx
pop ebx
pop ecx
push esi
push 0x2eaba24f
pop esi
sub dword [esp + 8], 0x73fe27fc
add dword [esp + 8], 0x6cbd0184
sub dword [esp + 8], esi
sub dword [esp + 8], 0x6cbd0184
add dword [esp + 8], 0x73fe27fc
pop esi
push eax
mov eax, 0x7bff9c4c
sub dword [esp + 8], eax
pop eax
add dword [esp + 4], 0x64df1449
jmp 0x5e55a2
xor edi, 0x7edbfbfc
add ebp, edi
pop edi
push ebx
mov ebx, 0x7feb14da
shl ebx, 5
not ebx
dec ebx
sub ebx, 0x29d64ba
push ebx
mov ebx, 0x67eb6e39
add ebx, 0x7beb5357
push ecx
mov ecx, 0x7d6dd41f
jmp 0x5e3ad0
mov esi, 0x77bc1126
xchg esi, edi
not edi
push esi
push edi
jmp 0x5e4ec5
mov dword [esp], edi
mov dword [esp], esi
mov dword [esp], edx
mov edx, esp
jmp 0x5e4b57
add edx, 4
sub esp, 4
jmp 0x5e4e9a
dec ebx
shr ebx, 1
neg ebx
shl ebx, 3
inc ebx
sub ebx, 0xc0577e5
add ebp, ebx
pop ebx
jmp 0x5e4f1b
add dword [esp + 4], esi
add dword [esp + 4], 0x7fc39a2f
sub dword [esp + 4], 0x7defb593
jmp 0x5e07a7
xchg dword [esp], ecx
pop esp
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], esi
mov dword [esp], eax
lea eax, [ebp + 0x1245473a]
push eax
mov eax, esp
jmp 0x5e1164
mov dword [esp], ebx
push esp
pop dword [esp]
jmp 0x5e15b1
push eax
jmp 0x5e5420
push edi
push edx
mov edx, 0x6ffb320d
sub edx, 0x7fca8ab8
jmp 0x5e2d66
mov dword [esp], ebp
mov dword [esp], edi
mov edi, 4
add edx, edi
pop edi
jmp 0x5e168b
pop esi
pop edi
and esi, 0x2deea3c2
dec esi
jmp 0x5e3505
sub ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
push esi
mov esi, 4
push esi
pop eax
mov esi, dword [esp]
add esp, 4
add edi, 0x5fbf64ac
sub edi, eax
sub edi, 0x5fbf64ac
mov eax, dword [esp]
jmp 0x5e4f57
add esp, 4
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
mov dword [esp], eax
push ecx
mov dword [esp], esi
push edx
mov dword [esp], 0x2f3fa051
jmp 0x5e502e
mov dword [esp], eax
push ecx
mov dword [esp], ebx
push edx
mov edx, 0x11774b39
jmp 0x5e0ae7
pop eax
pop dword [esp]
pop esp
mov dword [esp], edx
mov edx, esp
sub esp, 4
mov dword [esp], edi
mov dword [esp], eax
mov dword [esp], ebx
mov ebx, 0x5cfb81c4
add ebx, 1
dec ebx
jmp 0x5e550c
pop edi
jmp 0x5e35d8
add esi, 0xfef7abaa
add dword [esp + 4], 0x7defb593
push edi
jmp 0x5e5586
mov eax, 0x7db95d39
add dword [esp + 8], 0x5a720c47
jmp 0x5e05db
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x5e54b7
mov dword [esp], ebp
push dword [esp + 4]
mov ebp, dword [esp]
add esp, 4
jmp 0x5e54cc
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
cmp dword [ebp + 0x122d3b63], 0
je 0x5e2f7d
lea eax, [ebp + 0x12454702]
jmp 0x5e2f83
pop ebx
jmp 0x5e06a0
push ebp
jmp 0x5e5546
add esp, 4
add dword [esp], 0xf6e14b83
push edi
mov dword [esp], ebx
mov ebx, 0x33ecc151
sub dword [esp + 4], ebx
pop ebx
or dword [esp], 0x419e27b9
jmp 0x5e624b
mov ebp, 0xa3047e40
add ebx, ebp
jmp 0x5e0906
mov edx, edi
mov ecx, edx
pop edx
jmp 0x5e2e43
mov edi, 0x7fc39a2f
jmp 0x5e5590
sub dword [esp + 8], edi
pop edi
jmp 0x5e4c67
sub dword [esp + 4], esi
sub dword [esp + 4], 0x64df1449
add dword [esp + 4], 0x7bff9c4c
add dword [esp + 4], 0x2eaba24f
mov esi, dword [esp]
jmp 0x5e0cad
add eax, ebx
mov ebx, dword [esp]
add esp, 4
mov ecx, eax
pop eax
dec ecx
or ecx, 0x1bf8b1aa
jmp 0x5e56ba
push 0x18d74fb8
mov dword [esp], edx
push esi
push eax
push edx
jmp 0x5e63b0
push 0
jmp 0x5e0b6a
push edi
mov edi, 1
push eax
jmp 0x5e56f7
push eax
mov eax, 0x5f7b1cde
shr eax, 8
push edi
jmp 0x5e1185
shr edi, 2
jmp 0x5e446f
mov eax, 0x7db95d39
sub dword [esp + 8], eax
pop eax
add dword [esp + 4], 0x67ef73fe
sub dword [esp + 4], 0x6efff827
add dword [esp + 4], edi
add dword [esp + 4], 0x6efff827
push ebp
mov ebp, 0x67ef73fe
sub dword [esp + 8], ebp
jmp 0x5e39cd
dec eax
sub eax, 0x49ce845d
jmp 0x5e578c
add edi, eax
pop eax
jmp 0x5e57ca
or eax, edi
jmp 0x5e518e
mov dword [esp], edi
mov edi, 0x67ef84f5
push edx
mov edx, 0x5dbf8800
push 0x429e2240
mov dword [esp], ebx
mov ebx, 0xca326ad2
add edx, ebx
pop ebx
jmp 0x5e0f17
mov eax, dword [esp]
add esp, 4
push ebx
jmp 0x5e5a51
mov ebx, 0x7fec2077
and ecx, ebx
jmp 0x5e08b5
push 0
push ecx
jmp 0x5e5f97
mov dword [esp], esi
mov dword [esp], 0x7acf92b9
dec dword [esp]
xor dword [esp], 0xd00e94e
or dword [esp], 0x7dfe2800
jmp 0x5e61db
add dword [esp], 0x7fd78a00
jmp 0x5e6202
shl dword [esp], 1
xor dword [esp], ecx
xor ecx, dword [esp]
xor dword [esp], ecx
dec ecx
xchg dword [esp], ecx
push edi
mov edi, 0x54ff5c84
and dword [esp + 4], edi
mov edi, dword [esp]
jmp 0x5e5512
push ebp
jmp 0x5e145e
pop ecx
push esi
push edx
push 0x77bd8bf8
pop edx
mov esi, 0xf7bc7d78
sub esi, edx
pop edx
jmp 0x5e33a0
mov dword [esp], edx
push eax
jmp 0x5e1e3d
push ebp
jmp 0x5e1a63
push 0x77fdbc38
mov edx, dword [esp]
add esp, 4
shl edx, 3
neg edx
or edx, 0x1dd7b99c
add edx, 0x1de77b10
mov eax, edx
pop edx
xor eax, 0x6fbd6def
inc eax
shl eax, 3
xor eax, 0xfbae0b88
jmp 0x5e63f0
mov esi, eax
pop eax
add dword [esp + 4], esi
pop esi
jmp 0x5e6405
mov eax, dword [esp]
add esp, 4
jmp 0x5e0600