Function at 0x96ff11
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
mov eax, dword [esp]
push 0x4687a081
mov dword [esp], esi
mov esi, esp
jmp 0x96fd39
xor edx, 0xb17592f
add eax, edx
pop edx
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
jmp 0x96fdde
pop esp
mov dword [esp], ebx
mov dword [esp], eax
mov dword [esp], edi
jmp 0x96fd31
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
sub eax, edx
push edi
mov edi, 0x7f391639
shl edi, 7
xchg edi, esi
not esi
jmp 0x96fd12
pop esp
mov dword [esp], eax
push 0x2926ea3b
push esp
pop dword [esp]
add dword [esp], 4
jmp 0x96fd50
pop ebx
sub esi, ecx
pop ecx
xchg dword [esp], esi
jmp 0x96fcbd
pop edi
neg edi
xor edi, 0xee714c73
sub eax, edi
pop edi
mov edx, dword [esp]
push eax
jmp 0x96fd80
pop edx
xchg dword [esp], eax
mov esp, dword [esp]
push esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
jmp 0x96fc8e
xchg edi, esi
not edi
push 0
jmp 0x96fda6
add eax, edx
sub eax, 0x3fb6ac05
add eax, 0x36bc3cf4
jmp 0x96fcf4
mov dword [esp], edx
jmp 0x96fd5e
add esi, 4
push ebp
mov dword [esp], ecx
push ebx
mov ebx, 4
mov ecx, ebx
jmp 0x96fcd3
pop eax
add eax, 4
push ebp
push esp
pop ebp
jmp 0x96fdae
mov edx, 0x2e0
push edx
mov edx, 0x72fa50f3
add eax, 0x2fb4ed9e
add eax, edx
sub eax, 0x2fb4ed9e
mov edx, dword [esp]
push eax
mov eax, esp
jmp 0x96fc9d
mov eax, esp
add eax, 4
push edx
mov edx, 0x56fef6f7
and edx, 0x77df662a
push eax
mov eax, 0x4bc70cf7
jmp 0x96fd9e
sub edx, eax
pop eax
jmp 0x96fc74
sub dword [esp], edi
jmp 0x96fcdf
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], edx
push 4
mov edx, dword [esp]
add esp, 4
sub eax, 0x36bc3cf4
add eax, 0x3fb6ac05
jmp 0x96fd20
push ecx
mov dword [esp], eax
push esi
mov dword [esp], edx
jmp 0x96ff3c
mov dword [esp], ebp
mov dword [esp], ebx
mov dword [esp], ecx
push ecx
mov dword [esp], edx
mov edx, 0x7dfee9e1
jmp 0x96ff09
pop ecx
pop dword [esp]
mov esp, dword [esp]
push esi
mov esi, esp
jmp 0x970044
mov dword [esp], esi
mov dword [esp], edi
push esp
pop dword [esp]
push ebx
mov ebx, 4
add dword [esp + 4], ebx
pop ebx
pop ecx
add ecx, 4
add ecx, 4
push ecx
push dword [esp + 4]
jmp 0x96fe02
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
jmp 0x96ff20
add eax, edx
mov edx, dword [esp]
jmp 0x970019
mov dword [esp], edx
mov edx, 0x6e7bbefc
xor edx, 0x3584496c
sub edx, 0x73df9be5
not edx
push ecx
mov ecx, 1
add edx, ecx
pop ecx
add edx, 0xffffffff
push edi
push eax
mov dword [esp], esi
jmp 0x96feef
push edx
mov edx, esp
add edx, 4
push ebx
mov ebx, 4
add edx, ebx
pop ebx
xchg dword [esp], edx
jmp 0x96ffd6
mov dword [esp], ebp
not dword [esp]
mov ebp, dword [esp]
add esp, 4
and ebp, 0x706be472
dec ebp
push eax
mov eax, 0x5defe18b
xor ebp, eax
pop eax
jmp 0x96ffef
pop esp
push dword [esp]
pop ecx
jmp 0x96fe86
mov ebx, 0x56bfc92d
or eax, ebx
pop ebx
push ebp
mov ebp, 1
add eax, ebp
pop ebp
dec eax
add eax, 0x57ff74c7
add eax, 0x3000ac10
jmp 0x96ffcf
mov esi, 0x596f61cb
mov edi, 0x24b80830
xor edi, esi
pop esi
xor edi, 0xe4366a55
sub edx, edi
jmp 0x96ffc9
xor dword [esp + 4], edx
push dword [esp]
pop edx
push ebp
mov ebp, esp
push eax
mov eax, 0x37ffd600
push ebx
jmp 0x96fece
mov esp, dword [esp]
push ebx
mov dword [esp], 0x10b8a275
mov dword [esp], ebp
mov dword [esp], ebx
push dword [esp]
push dword [esp]
jmp 0x97001f
mov dword [esp], 0x76e48b2b
dec dword [esp]
and dword [esp], 0x3bf508ea
add dword [esp], 0x36d0acd6
mov dword [esp], ebp
mov ebp, 0x7dfea0a6
sub dword [esp + 4], ebp
pop ebp
jmp 0x9700ad
mov dword [esp], ebx
mov dword [esp], ecx
mov ecx, 0x1fdaa197
add ecx, 0x5f553475
dec ecx
shr ecx, 2
add ecx, 0x600d8d7e
mov eax, ecx
pop ecx
xor dword [esp + 4], eax
pop eax
mov edx, dword [esp]
add esp, 4
push 0x407fb578
mov dword [esp], ebx
push ebp
mov dword [esp], 0x18c609d8
mov dword [esp], edi
jmp 0x970057
mov ebx, edi
jmp 0x9700e6
and eax, 0x7f7953f8
or eax, 0x4d3c4999
xor eax, 0x283b258
xor ecx, eax
pop eax
push edx
jmp 0x970002
pop edi
jmp 0x96fe50
add ebp, eax
jmp 0x96ffe2
pop esp
push eax
mov eax, 0x7fdf5b3a
jmp 0x96ffb1
pop eax
push edi
mov edi, 0x7fd621ca
push ecx
jmp 0x97000d
or ebx, ebp
pop ebp
xor ebx, 0x22674fb
xor edx, ebx
mov ebx, dword [esp]
jmp 0x9700cb
push eax
push 0x5ab7a32c
jmp 0x96ff66
mov ecx, 0x6f7e7d45
inc ecx
dec ecx
jmp 0x970026
push ecx
jmp 0x96fe3a
pop ebx
push ecx
jmp 0x97003a
inc ecx
or ecx, 0x1dbd0cf1
sub ecx, 0x600624fe
xor edi, ecx
jmp 0x97006b
push 0x61cdaa56
jmp 0x96fe11
add esi, 4
push ebp
mov ebp, 4
add esi, ebp
jmp 0x970074
mov edi, 0x7df78a4a
push esi
jmp 0x970097
pop edi
xchg dword [esp], ebp
jmp 0x96fec4
pop ecx
dec edi
neg edi
jmp 0x97008a
pop ebp
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
jmp 0x970083
pop esp
push ecx
jmp 0x96fdeb
xor edi, 0x9fd086ca
add ebp, edi
jmp 0x970062
mov esi, 0x3dd58f01
inc esi
shl esi, 1
or esi, 0x7ef98a0a
not esi
jmp 0x9700b8
pop eax
push 0x7a259401
jmp 0x96fe5a
xor esi, 0xf57a7de7
add edi, esi
jmp 0x9700c5
pop esi
jmp 0x9700d6
add esp, 4
jmp 0x9700f8
inc edi
inc edi
push eax
mov eax, 0x72691131
add edi, eax
pop eax
jmp 0x96ffaa
mov edi, dword [esp]
add esp, 4
push ebp
mov ebp, 0x7afb7c00
push ecx
jmp 0x96fea0
jmp 0x97050a
push ecx
mov dword [esp], edx
mov dword [esp], eax
push dword [esp]
pop eax
push esi
jmp 0x970641
add eax, ecx
mov ecx, dword [esp]
add esp, 4
jmp 0x97065c
pop ebx
add esp, 4
push ebx
mov dword [esp], ecx
mov ecx, 0x5eb66378
jmp 0x970667
push ebx
jmp 0x9705e3
mov ecx, 0x52f52ee3
not ecx
shr ecx, 8
push edx
mov edx, 0x747fb62b
and ecx, edx
jmp 0x97056c
mov dword [esp], eax
jmp 0x970565
push esp
pop eax
jmp 0x9705c5
pop edx
neg ecx
push esi
mov esi, 0x7ff7bf0c
inc esi
sub esi, 0x1f970566
neg esi
add esi, 0xcc3e2c13
or ecx, esi
pop esi
add ecx, 0x27bfe0b5
sub ebx, ecx
pop ecx
jmp 0x970595
add ecx, ebx
pop ebx
sub ebx, ecx
push dword [esp]
pop ecx
push 0x1bb5c998
jmp 0x97055d
mov edi, 4
mov ebx, edi
pop edi
add eax, ebx
push dword [esp]
pop ebx
push 0x64e7384
mov dword [esp], ebx
mov ebx, esp
jmp 0x97060f
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
jmp 0x97067a
add dword [esp + 4], ecx
pop ecx
push dword [esp]
jmp 0x97052b
mov ebx, 0x2fff40b6
push esi
mov esi, 0x37f723f8
or ebx, esi
pop esi
or ebx, 0x3acfac83
xor ebx, 0x4db19d67
sub ebx, 0x76ef4200
push esi
mov dword [esp], ebx
mov dword [esp], ecx
jmp 0x970546
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
push ecx
push ecx
mov dword [esp], 4
pop ecx
jmp 0x97051b
push 0x62dc67a8
mov dword [esp], ebx
push ecx
mov ecx, 0x37bcdb10
jmp 0x9705d6
mov dword [esp], eax
mov eax, esp
push ecx
mov dword [esp], 0x3ef8397a
mov dword [esp], ebx
jmp 0x970656
push edi
jmp 0x9705a8
xchg dword [esp], eax
mov esp, dword [esp]
jmp 0x97062e
inc ecx
inc ecx
and ecx, 0x27fd19dc
xor ecx, 0x65498a74
jmp 0x970540
call 0x97067f
mov eax, dword [esp]
sub esp, 4
mov dword [esp], ebx
jmp 0x9706e2
and edi, 0x15e61496
sub edi, 0x9888fd78
jmp 0x9706d2
mov dword [esp], edx
jmp 0x9706a6
mov edx, 0x79e7f1b2
push edx
not dword [esp]
pop edx
sub edx, 0x1b592de5
add ebx, edx
pop edx
add ecx, ebx
pop ebx
add ecx, 1
push eax
mov eax, 0x1d2532fb
add ecx, eax
pop eax
sub eax, ecx
jmp 0x9706dc
mov ebx, edi
mov edi, dword [esp]
jmp 0x9707c4
pop ecx
jmp 0x9707d2
push esp
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edi
push esp
pop edi
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x970739
xor ebp, 0x7eff6d00
pop edx
neg ebp
shl ebp, 4
xor ebp, 0xc38abadc
mov ebx, ebp
pop ebp
push edx
mov edx, 0x37296bbb
sub ebx, edx
pop edx
shr ebx, 7
push eax
mov eax, esp
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
jmp 0x97069e
add ebx, 4
push eax
mov dword [esp], 0x37a16fdd
mov dword [esp], ebp
push edi
mov dword [esp], ecx
push ebp
push eax
mov dword [esp], 0x1ffd8121
pop ebp
mov ecx, 0x1ffd8125
xor ecx, ebp
pop ebp
jmp 0x970765
mov ebp, ecx
pop ecx
jmp 0x97078e
pop ebx
push ebp
mov dword [esp], ebx
push ebp
push edx
mov edx, 0x76beab3e
push 0x2c4d0b21
mov dword [esp], edx
xor dword [esp], 0x7eff6d00
pop ebp
jmp 0x970704
add ebx, 0x53ffc581
add ebx, 0x2eded981
add ebx, ebp
sub ebx, 0x2eded981
sub ebx, 0x53ffc581
pop ebp
xchg dword [esp], ebx
jmp 0x9707b1
mov esp, dword [esp]
push ecx
push ebx
push esi
mov dword [esp], edi
mov edi, 0x7a75ca72
jmp 0x97068d
add esp, 4
push edi
mov edi, ebx
mov ecx, edi
pop edi
jmp 0x97076d
push eax
push ebx
jmp 0x970ac4
mov ebp, 0x6dff8b00
jmp 0x97085a
add eax, 4
jmp 0x970a87
add edi, 4
jmp 0x97088c
mov dword [esp], 0x6dc75e37
mov dword [esp], eax
mov eax, esp
sub esp, 4
mov dword [esp], edx
mov edx, 0x795e4803
push edi
mov edi, 0x7d34df9f
and edx, edi
pop edi
neg edx
shl edx, 1
push edx
neg dword [esp]
pop edx
push esi
mov esi, 0x767ed54e
add esi, 0xdd7c5120
jmp 0x970833
add edx, esi
pop esi
push ebx
jmp 0x97086a
sub edi, edx
pop edx
push 0x6ae1735b
mov dword [esp], edx
mov edx, 0x3101b72
jmp 0x970979
push esi
mov esi, 0x13047553
mov ebx, esi
pop esi
xor ebx, ebp
jmp 0x970957
mov ebx, 0x4623b670
sub edx, ebx
pop ebx
jmp 0x970ab1
pop edx
pop dword [esp]
mov esp, dword [esp]
push ebp
mov ebp, 0x7cef113a
sub ebx, ebp
pop ebp
jmp 0x9709b3
push eax
mov eax, 4
sub edi, eax
pop eax
xchg dword [esp], edi
jmp 0x9709d5
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
push eax
mov eax, esp
jmp 0x9707e3
add ebp, edi
pop edi
push eax
mov eax, 0x7fe3fb5a
sub dword [esp + 8], eax
pop eax
add dword [esp + 4], ebp
push ecx
mov ecx, 0x7fe3fb5a
add dword [esp + 8], ecx
pop ecx
jmp 0x970a09
pop esp
mov dword [esp], ebx
jmp 0x9709cd
add esp, 4
push edx
push esp
pop edx
push esi
mov esi, 4
add edx, esi
pop esi
add edx, 4
push edx
push dword [esp + 4]
jmp 0x970877
pop ebp
add dword [esp + 4], ebx
pop ebx
pop eax
push 0x21a7b969
mov dword [esp], edi
push eax
mov eax, 0x7697e6a2
mov edi, 0xf593e4f5
sub edi, eax
pop eax
jmp 0x970a9c
xor edi, edx
pop edx
add dword [esp + 4], edi
pop edi
push dword [esp]
mov ebx, dword [esp]
jmp 0x97091c
sub ebx, 4
xor ebx, dword [esp]
jmp 0x9708f3
push ebp
push edi
mov edi, 0x22f99392
mov ebp, 0x4ae446bd
jmp 0x9708c8
push 0x209b2189
mov dword [esp], ebp
mov dword [esp], 0x72bf9ac0
jmp 0x9709a2
push esi
jmp 0x970a36
push edi
mov edi, esp
jmp 0x9707ed
pop esp
mov dword [esp], edi
push edx
mov edx, 0x7ffb9ae4
mov edi, 0xfffaa52c
jmp 0x97083c
mov ebp, dword [esp]
add esp, 4
add dword [esp], 0x8cedff92
mov dword [esp], ebp
mov dword [esp], ecx
push dword [esp]
mov ecx, dword [esp]
push ebx
jmp 0x970a51
mov dword [esp], eax
push esp
pop eax
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
push ebx
mov ebx, esp
jmp 0x970ab9
mov ebx, esp
jmp 0x970a58
add ebx, 4
add ebx, 4
jmp 0x970a7e
xchg dword [esp], ebx
pop esp
jmp 0x9709c7
sub eax, 4
xchg dword [esp], eax
jmp 0x9708ea
mov dword [esp], esi
jmp 0x9707f8
add eax, 0x6fdf0a6f
sub eax, edi
sub eax, 0x6fdf0a6f
mov edi, dword [esp]
push ebp
jmp 0x970a94
add eax, edx
pop edx
jmp 0x9708a7
add ebx, 4
jmp 0x97098c
push ebp
jmp 0x9707d9