Function at 0xea6ae5
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push dword [esp]
push dword [esp]
mov eax, dword [esp]
push eax
push esp
mov eax, dword [esp]
push edx
mov edx, esp
push ecx
mov ecx, 0x68d7b719
sub ecx, 0x68d7b715
add edx, ecx
pop ecx
add edx, 4
jmp 0xea36c2
pop eax
pop dword [esp]
pop esp
push edi
push esp
mov edi, dword [esp]
add esp, 4
push eax
push ecx
mov ecx, 0x7efe8e25
xor ecx, 0x7fdf3887
or ecx, 0x7dff3080
neg ecx
not ecx
jmp 0xea362c
push edx
jmp 0xea36a6
xor ebx, ecx
not ecx
push ebx
push 0x31fe6c13
mov dword [esp], ecx
jmp 0xea3665
push edx
mov edx, 0x7fe75e36
mov ecx, 0x411a4fbb
xor ecx, edx
jmp 0xea3737
pop edx
sub ecx, 0xda057ea4
mov eax, ecx
pop ecx
jmp 0xea36da
pop ebx
jmp 0xea373f
sub eax, 0x33bfe4f6
add eax, 0x5ba778ce
push dword [esp]
jmp 0xea367d
push dword [esp]
pop ecx
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0xea3758
mov edx, 0x7fef9bf3
inc edx
dec edx
neg edx
and edx, 0x7f7705ff
xor edx, 0x3feb31ab
sub ecx, edx
jmp 0xea3656
xchg dword [esp], edx
pop esp
add eax, 4
add eax, 4
push eax
push dword [esp + 4]
jmp 0xea3600
sub esp, 4
mov dword [esp], edx
jmp 0xea3700
add esp, 4
xor ecx, 0x3efd12bf
push ebx
mov ebx, 0x75bf7999
xor ebx, ecx
xor ecx, ebx
jmp 0xea3632
mov edx, 0x2bbb27ec
and eax, edx
mov edx, dword [esp]
add esp, 4
add eax, 0xdc44fdc0
add edi, eax
pop eax
add edi, 4
xchg dword [esp], edi
pop esp
add esp, 4
push edx
mov dword [esp], ecx
jmp 0xea3644
add esp, 4
add eax, 0x33bfe4f6
sub eax, ecx
jmp 0xea366b
mov edx, dword [esp]
jmp 0xea36e8
mov ecx, dword [esp]
add esp, 4
push edx
mov edx, 0x2e990d98
sub ebx, edx
pop edx
sub eax, ebx
mov ebx, dword [esp]
jmp 0xea3728
mov ecx, ebx
jmp 0xea485f
push edi
mov edi, esp
add edi, 4
jmp 0xea73ac
sub edi, 0x32674668
add ebp, edi
jmp 0xeaa62e
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0xea6c95
mov edx, esp
add edx, 4
jmp 0xea4a4d
add ebp, 0x73d5c730
add ebp, edi
sub ebp, 0x73d5c730
jmp 0xea5076
shl esi, 7
add esi, 0x7fec159d
and edx, esi
pop esi
push ebp
jmp 0xea8b09
xor ebp, 0x7ef751e1
not ebp
add ebp, 0xea28c17
xor ecx, ebp
jmp 0xea70fc
pop edi
jmp 0xea6d99
pop edi
push edi
mov edi, 4
add ebp, edi
pop edi
xchg dword [esp], ebp
pop esp
jmp 0xea5837
sub eax, edi
pop edi
pop ecx
jmp 0xea8b2e
shl edi, 4
jmp 0xea5d6e
add eax, 0x37dd6815
sub eax, ecx
push edi
jmp 0xea5c3d
push ecx
mov ecx, 0x6b177a6d
shl ecx, 5
shl ecx, 3
sub esp, 4
mov dword [esp], ebp
mov ebp, 0x799f4623
and ebp, 0x6f5f8a1d
add ebp, 0x69e4f58e
jmp 0xea4e92
mov esi, 4
add edi, esi
push dword [esp]
pop esi
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
add edi, 4
jmp 0xea902e
mov edi, 0x37dd6815
jmp 0xea521a
pop edx
mov ecx, dword [esp]
push edi
mov edi, esp
add edi, 4
jmp 0xeaa778
shl edi, 6
push ebp
mov ebp, 0x1a84bffc
sub edi, ebp
pop ebp
jmp 0xea4bfc
pop ecx
and edi, 0x1dc7e535
push ecx
jmp 0xea64e7
add ebp, 0x680768ca
add eax, ebp
jmp 0xeaa69b
sub esp, 4
mov dword [esp], eax
jmp 0xea61bc
mov eax, esp
jmp 0xea83b5
push ecx
mov ecx, 0x7fb7600a
add dword [esp + 4], 0x71b7ada7
sub dword [esp + 4], ecx
sub dword [esp + 4], 0x71b7ada7
mov ecx, dword [esp]
add esp, 4
push dword [esp]
pop eax
push esi
mov dword [esp], edi
push esp
jmp 0xea4fc6
push ebx
mov ebx, 0x5fbf438b
mov ecx, ebx
pop ebx
and edi, ecx
pop ecx
sub edi, 0x3eff9fd1
jmp 0xea5763
mov dword [esp], edx
mov edx, 0x2dbbc4f2
sub esp, 4
mov dword [esp], esi
mov esi, 0x5bb4c14d
sub edx, esi
jmp 0xea7f48
sub ebp, 0x3fb62d50
pop edi
xor ebp, dword [esp]
xor dword [esp], ebp
jmp 0xea6a8d
xor ebp, dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x122d2fea], 0
jne 0xea6aa5
cmp dword [ebp + 0x122d2ec6], 0
je 0xea6aba
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d3d70], eax
call dword [ebp + 0x122d1d87]
pop eax
push eax
jmp 0xea64b9
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], edi
mov edi, 0x6766017e
jmp 0xea9915
pop edi
cmp dword [ebp + 0x122d2fea], 0
jne 0xea6ca8
cmp dword [ebp + 0x122d2ec6], 0
je 0xea6cb9
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c9b]
pop ebx
pop eax
push eax
mov dword [esp], 0x88a169e
mov dword [esp], eax
jmp 0xea7dc4
push edi
mov dword [esp], ebx
mov dword [esp], esi
jmp 0xea5bcf
pop ebp
jmp 0xea57db
sub edi, 4
jmp 0xeaa555
push ebp
mov ebp, ecx
jmp 0xea8c1b
add edx, ebp
pop ebp
jmp 0xea8008
push 0x6d5fd6c5
mov dword [esp], ebp
jmp fcn.00ea5d38
pop esi
push esi
push 0x3ffc1eb4
pop esi
or esi, 0x3797aac2
dec esi
shr esi, 5
jmp 0xea4dca
xor edx, 0xb0d5d085
add eax, edx
mov edx, dword [esp]
add esp, 4
push ecx
mov ecx, 4
add eax, ecx
pop ecx
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
mov dword [ebp + 0x122d235e], eax
mov dword [ebp + 0x122d1c4c], 0
push ecx
mov dword [esp], ebx
mov dword [esp], 0x5f7f47f7
push ecx
mov ecx, 0x19739440
sub dword [esp + 4], ecx
pop ecx
mov dword [esp], ebp
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
push eax
jmp 0xea6ace
push 0x59af3fd2
jmp 0xea671b
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
push edi
mov dword [esp], edx
jmp 0xea4ad6
mov ebp, 0x5ed2cf7c
jmp 0xea7a81
push edi
sub esp, 4
mov dword [esp], edi
mov dword [esp], eax
pop edi
push 0x64df333a
mov dword [esp], ebx
jmp 0xea8f96
push ebp
add dword [esp], 0x72af52d3
pop esi
sub esi, 0x72af52d3
pop ebp
mov eax, esi
pop esi
push dword [esp]
mov ecx, dword [esp]
push ebx
jmp 0xea8631
mov dword [esp], ecx
push 0x7cee5121
mov dword [esp], ebp
push edi
mov ebp, dword [esp]
add esp, 4
mov ecx, ebp
pop ebp
push esi
jmp 0xea76b6
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
jmp 0xeaa647
mov dword [esp], ebp
jmp 0xeaa7d0
pop esp
push 0x5f860ba7
mov dword [esp], edx
mov edx, ecx
push edx
push eax
mov eax, 0x5fee22e2
add dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
jmp 0xeaa76d
sub edi, 0x34febb12
jmp 0xea4899
mov ecx, 0x76e75241
shl ecx, 7
xor ecx, 0x45ff901
mov edi, ecx
jmp 0xea5e69
mov esi, 0x35794243
and dword [esp + 4], esi
pop esi
jmp 0xeaa706
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], esp
add dword [esp], 4
push dword [esp]
mov eax, dword [esp]
add esp, 4
jmp 0xea6003
pop edi
push edi
mov edi, 4
add ebp, 0x3fb62d50
jmp 0xeaa640
add ebp, edi
jmp 0xea68b3
mov esp, dword [esp]
push ebp
mov ebp, 0x71eb43fa
and ebp, 0x22562680
or ebp, 0x7fbf3c86
add ebp, 0xdec09e81
shr ebp, 2
dec ebp
jmp 0xea5ed2
pop ebp
push eax
mov dword [esp], 0x5fae9171
push esi
jmp 0xeaa1ef
sub dword [esp], 0x99a870ad
xor dword [esp], 0x3290e252
mov dword [esp], ecx
push eax
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push ebx
mov ebx, esp
push edx
mov edx, 4
add ebx, edx
pop edx
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
jmp 0xea98b1
pop eax
sub eax, 0x5fee22e2
jmp 0xea5cfb
add edi, 4
xchg dword [esp], edi
pop esp
cmp dword [ebp + 0x122d2fea], 0
jne 0xeaa794
cmp dword [ebp + 0x122d2ec6], 0
je 0xeaa7a3
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c58]
pop eax
cmp dword [ebp + 0x122d2ec6], 0
je 0xeaa7b9
push eax
mov eax, 0
call dword [ebp + 0x122d2530]
pop eax
push edi
mov dword [esp], eax
add dword [esp], 0x77d788a8
push dword [esp]
pop eax
sub esp, 4
jmp 0xea95f7
push esp
pop ebp
push edi
push ecx
jmp 0xea9cf1