Function at 0xed397c
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
pop eax
add eax, 0xe
mov dword [eax], ecx
jmp 0xecc2c1
jmp 0xecfa96
jmp 0xecfdb3
mov eax, 0
cmp byte [ebp + 0x12452f43], 0
je 0xecfdf7
mov byte [ebp + 0x122d2108], 0x53
mov eax, 0x83d7652c
nop
push eax
nop
push dword [ebp + 0x122d1285]
call dword [ebp + 0x122d27a6]
mov ebx, eax
lea eax, [ebp + 0x12452f83]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x12452f43]
nop
push eax
nop
call ebx
cmp dword [ebp + 0x12452f11], 0
je 0xecfe0e
mov dword [ebp + 0x122d3a93], 1
mov byte [ebp + 0x122d2108], 0x47
mov eax, 0x906d6c8d
nop
push eax
nop
push dword [ebp + 0x122d1285]
call dword [ebp + 0x122d27a6]
call eax
mov edi, eax
cmp byte [edi], 0x22
jne 0xecfe58
inc edi
mov al, 0x22
scasb al, byte es:[edi]
jne 0xecfe39
cmp byte [edi], 0
je 0xed0219
inc edi
cmp byte [edi], 0
je 0xed0219
jmp 0xecfe76
cmp byte [edi], 0
je 0xed0219
cmp byte [edi], 0x20
jne 0xecfe70
inc edi
jmp 0xecfe76
inc edi
jmp 0xecfe58
cmp byte [edi], 0
jne 0xecfe84
jmp 0xed0219
cmp byte [edi], 0x20
jne 0xecfe93
inc edi
jmp 0xecfe84
cmp byte [edi], 0
jne 0xecfea1
jmp 0xed0219
call fcn.00ecfeb0
jmp 0xecfe76
mov eax, 0
test eax, eax
je 0xed0230
mov dword [ebp + 0x122d3c93], 0
cmp byte [ebp + 0x12452f36], 0
je 0xed0247
mov dword [ebp + 0x122d3a93], 1
mov byte [ebp + 0x122d2108], 0x49
mov eax, 0x8c1529e9
nop
push eax
nop
push dword [ebp + 0x122d1285]
call dword [ebp + 0x122d27a6]
mov dword [ebp + 0x122d3ac7], eax
mov byte [ebp + 0x122d2108], 0x49
mov eax, 0xf74ad7ca
nop
push eax
nop
push dword [ebp + 0x122d1285]
call dword [ebp + 0x122d27a6]
mov dword [ebp + 0x1244afe7], eax
cmp dword [ebp + 0x122d00bd], 0
je 0xed0328
mov byte [ebp + 0x122d2108], 0x47
mov eax, 0x83d0b5f3
sub byte [esi - 8], ah
add byte [ebp + 0x122d1285], dh
call dword [ebp + 0x122d27a6]
mov ebx, eax
push 0x10
lea eax, [ebp + 0x1245318b]
push eax
mov dword [esp], eax
lea eax, [ebp + 0x12453183]
push eax
mov dword [esp], eax
call ebx
test eax, eax
je 0xed0328
lea eax, [ebp + 0x1245318b]
nop
push eax
nop
call fcn.00ed01e1
mov dword [ebp + 0x122d3d0b], eax
push 4
push dword [ebp + 0x122d3d0b]
call dword [ebp + 0x122d3ac7]
test eax, eax
jne 0xed031e
mov eax, dword [ebp + 0x122d3d0b]
cmp dword [eax], 0x9a761b13
je 0xed0319
mov dword [ebp + 0x122d3d0b], 0
jmp 0xed0328
mov dword [ebp + 0x122d3d0b], 0
mov ecx, eax
jmp 0xed142f
sub esp, 4
mov dword [esp], ecx
jmp 0xed646e
sub dword [esp + 4], 0x1c39ad94
sub dword [esp + 4], 0x3fde21bb
jmp 0xed48eb
mov edi, dword [esp]
add esp, 4
jmp 0xed1bd6
sub ecx, ebp
jmp 0xed1634
push eax
mov eax, 0x1edffab6
xor eax, 0x3bfc21f7
sub eax, 0x3e7da4c2
not eax
and eax, 0x573f8114
xor eax, 0x5fa575a1
jmp 0xed1ea0
mov ebp, 0x5fbc99d4
sub esi, 0x77ff7b68
add esi, ebp
add esi, 0x77ff7b68
pop ebp
sub esp, 4
mov dword [esp], ecx
mov ecx, esi
push ecx
sub esp, 4
mov dword [esp], edx
mov edx, 0x76efc6f3
xor dword [esp + 4], edx
pop edx
pop eax
push ebx
mov ebx, 0x77e39027
or ebx, 0x575beb86
sub ebx, 0x7796f6f7
sub ebx, 0x5fff6751
jmp 0xed1c8a
pop ebp
add ecx, esi
push edi
push ebp
mov ebp, 0x77ff4a6f
sub ebp, 0x7bf4d4f2
inc ebp
jmp 0xed336b
pop esi
jmp 0xed2e01
push ebx
mov ebx, 0x7bd34b22
sub dword [esp + 8], ebx
pop ebx
sub dword [esp + 4], ecx
jmp 0xed2a1b
mov eax, edx
pop edx
push dword [esp]
pop ebp
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
push esi
jmp 0xed4ba0
pop esp
mov dword [esp], edx
mov dword [esp], eax
push esi
push 0x77ee8e9a
pop esi
push edx
mov edx, 0x7fb9ede9
sub dword [esp + 8], edx
pop edx
add dword [esp + 4], esi
push ecx
mov ecx, 0x7fb9ede9
add dword [esp + 8], ecx
mov ecx, dword [esp]
add esp, 4
push dword [esp]
jmp 0xed50e3
pop ebx
add edi, 0x1bd193e5
mov ecx, edi
jmp 0xed152d
xor eax, ebp
pop ebp
jmp 0xed5ed4
cmp dword [ebp + 0x122d3a6f], 0
jne 0xed18e2
cmp dword [ebp + 0x122d3a93], 0
je 0xed18f1
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d240f]
pop eax
push ebx
mov dword [esp], eax
push 0xa938ea1
mov dword [esp], ecx
sub esp, 4
mov dword [esp], edi
mov edi, 0x5dff7934
dec edi
sub edi, 0xffffffff
xor edi, ebp
xor ebp, edi
xor edi, ebp
jmp 0xed4f80
xor dword [esp + 4], ecx
pop ecx
push dword [esp]
jmp 0xed321d
dec ebx
sub ebx, 0x2975d66b
xor eax, ebx
jmp 0xed1f55
mov dword [esp], 0x47d684e2
mov dword [esp], eax
xor dword [esp], 0x7c47c6bb
pop edi
jmp 0xed3c61
or ebx, eax
pop eax
shl ebx, 2
xor ebx, 0x5bff2d8e
xor ebx, 0x97e67cd0
mov ebp, ebx
mov ebx, dword [esp]
add esp, 4
sub eax, ebp
jmp 0xed2c49
add ecx, edi
pop edi
pop esi
push esi
mov esi, 4
jmp 0xed5c0a
pop ebx
push dword [esp]
pop ecx
add esp, 4
mov esi, dword [esp]
add esp, 4
jmp 0xed18d0
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
jmp 0xed1fb5
mov dword [esp], ebp
mov ebp, esp
jmp 0xed3cd9
mov edi, dword [esp]
jmp 0xed297e
push edi
mov edi, 0x7c9eb923
mov edx, edi
pop edi
mov ecx, edx
jmp 0xed5bd0
push esi
not dword [esp]
pop esi
jmp 0xed66f3
mov dword [esp], edx
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
jmp 0xed62da
mov eax, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], edx
push dword [esp + 4]
pop edx
pop dword [esp]
mov esp, dword [esp]
push 0x1106bbf3
mov dword [esp], eax
mov dword [esp], edi
mov dword [esp], eax
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x16bfb664
jmp 0xed16b1
pop edi
mov ebp, dword [esp]
jmp 0xed2953
mov eax, dword [esp]
push ebp
push esp
mov ebp, dword [esp]
add esp, 4
add ebp, 4
jmp 0xed3339
sub eax, 0x4c3d5a06
add eax, 0x7ff60c69
add eax, esi
sub eax, 0x7ff60c69
add eax, 0x4c3d5a06
jmp 0xed4024
push ecx
mov ecx, esp
jmp 0xed5a57
add esp, 4
jmp 0xed3130
mov ebx, 0x6f5bbcd5
or ebp, ebx
pop ebx
add ebp, 0xff9f3c57
jmp 0xed4327
add esp, 4
jmp 0xed2bdf
mov dword [esp], 0x19c878f8
mov dword [esp], ecx
jmp 0xed5094
add dword [esp + 4], 0x7bd34b22
jmp 0xed407a
xor edx, 0x3cffd8d6
jmp 0xed3d91
mov dword [esp], eax
jmp 0xed5408
cmp dword [ebp + 0x122d3a6f], 0
jne 0xed2bf1
cmp dword [ebp + 0x122d3a93], 0
je 0xed2c06
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d2c6d], eax
call dword [ebp + 0x122d2c72]
pop eax
push 0x3b398bd4
mov dword [esp], edx
push esp
pop edx
add edx, 4
jmp 0xed5604
pop ebp
push 0x587c3aac
mov dword [esp], eax
push esi
push ebx
jmp 0xed30d9
xor ebx, dword [esp]
jmp 0xed2fd6
pop edx
jmp 0xed2912
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
jmp 0xed14eb
mov ebp, edi
jmp 0xed36f7
mov ebx, 0x6e3e1442
jmp 0xed358e
push 0x4c76e0b9
mov dword [esp], ecx
push esi
mov esi, 0xffffffff
push esi
pop ecx
jmp 0xed5262
mov dword [esp], ebx
mov dword [esp], esi
mov dword [esp], edi
push ebp
jmp 0xed1cef
pop eax
jmp 0xed5706
add ebp, 4
xchg dword [esp], ebp
pop esp
push ebp
push ebx
mov ebx, 0x2cf5e7d1
jmp 0xed1567
xor ebp, 0x77f26e86
jmp 0xed53d5
mov ebx, 0xe85506b6
xor esi, ebx
pop ebx
xor edi, esi
pop esi
push 0x34da0a55
mov dword [esp], ebp
jmp 0xed30d2
add ebx, 4
push esi
mov esi, 4
jmp 0xed6b0e
sub ebx, 0xff3efea7
jmp 0xed4320
push edx
mov edx, ebp
jmp 0xed182e
mov dword [esp], ebp
push eax
mov dword [esp], ebx
push 0x7f675fcf
jmp 0xed4a58
pop eax
add eax, 0x6bfa00dd
cmp dword [ebp + 0x122d3a6f], 0
jne 0xed396b
cmp dword [ebp + 0x122d3a93], 0
je 0xed397c
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c9e]
pop ebx
pop eax
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
jmp 0xed1843
xor ecx, dword [esp]
mov esp, dword [esp]
xor eax, 0x4af745a0
push 0x40ceb3ca
mov dword [esp], ebx
mov dword [esp], esi
push edx
mov dword [esp], eax
jmp 0xed601a
push esi
mov esi, 0x6afe3901
xor esi, 0x7ef15732
sub esi, 0x7ffcae26
push ebx
jmp 0xed3421
add ebp, 4
add ebp, 4
jmp 0xed5d61
add edx, 0x3cbf5ce7
add edi, edx
pop edx
sub edi, 4
xchg dword [esp], edi
jmp 0xed4b9a
pop esi
cmp dword [ebp + 0x122d3a6f], 0
jne 0xed4037
cmp dword [ebp + 0x122d3a93], 0
je 0xed4046
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2ca0]
pop eax
cmp dword [ebp + 0x122d3a93], 0
je 0xed405c
push eax
mov eax, 0
call dword [ebp + 0x122d2d5b]
pop eax
push ecx
mov dword [esp], edx
push esi
mov dword [esp], 0x5433bd7
mov dword [esp], ecx
mov dword [esp], 0x7f49c47a
dec dword [esp]
jmp 0xed5ae5
pop ecx
mov eax, dword [esp]
jmp 0xed489e
mov esi, ebx
jmp 0xed5273
mov eax, ebp
pop ebp
and eax, 0x1ff7ff15
add eax, 0xe0e8c6f0
add edx, eax
jmp 0xed226a
mov esp, dword [esp]
mov eax, dword [esp]
push eax
mov eax, esp
jmp 0xed1fa2
push esi
mov esi, esp
push ebx
mov ebx, 4
add esi, ebx
pop ebx
add esi, 4
xchg dword [esp], esi
jmp 0xed583d
sub dword [esp + 4], edx
add dword [esp + 4], 0x3fde21bb
push edi
mov edi, 0x1c39ad94
add dword [esp + 8], edi
pop edi
mov edx, dword [esp]
add esp, 4
jmp 0xed3953
pop ebx
or ebx, 0x1aff787c
inc ebx
or ebx, 0x3a769e02
sub ebx, 0x14059d25
mov ebp, ebx
pop ebx
push edi
mov edi, ebp
push edi
xor dword [esp], 0x6db74864
push dword [esp]
jmp 0xed69ed
pop esp
jmp 0xed31de
mov esi, 4
add ebx, esi
pop esi
add ebx, 4
xchg dword [esp], ebx
jmp 0xed6468
neg ebp
jmp 0xed5290
xor ecx, 0x1a656ece
mov edx, ecx
pop ecx
xor dword [esp + 4], edx
pop edx
mov eax, dword [esp]
jmp 0xed68fa
mov ecx, esp
add ecx, 4
jmp 0xed5140
pop esi
add esp, 4
jmp 0xed28cb
add ecx, 4
xor ecx, dword [esp]
xor dword [esp], ecx
jmp 0xed3bc3
pop esi
add edi, ecx
pop ecx
push ebx
mov ebx, 0x7dfe5f32
add edi, ebx
jmp 0xed1891
pop ebx
xor dword [esp + 4], esi
mov esi, dword [esp]
push 0x42338c04
mov dword [esp], edx
push 0x504fd8a8
mov dword [esp], esp
jmp 0xed546a
push edi
push ebp
jmp 0xed2537
add ebp, 0xbccb0f7b
mov edi, ebp
pop ebp
jmp 0xed1f17
pop edx
mov eax, edx
push dword [esp]
pop edx
jmp 0xed2938
add dword [esp], 4
mov edx, dword [esp]
add esp, 4
push ecx
mov ecx, 0x6bfba45b
jmp 0xed5779
sub edx, 4
push 0x16f47f9b
mov dword [esp], edx
push dword [esp + 4]
pop edx
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
push dword [esp]
pop eax
jmp 0xed653a
add esp, 4
xor eax, 0x3bd079e2
sub esp, 4
mov dword [esp], esi
mov dword [esp], 0x4873ad7d
jmp 0xed5873
inc ecx
and ecx, 0x75d35edd
sub ecx, 0x61d30458
add edx, ecx
pop ecx
push ebp
mov ebp, 4
add edx, ebp
pop ebp
xchg dword [esp], edx
jmp 0xed4397
sub esp, 4
mov dword [esp], ebp
jmp 0xed5fe3
pop esp
push esi
push ebp
mov dword [esp], ecx
mov ecx, 0x1afe359c
jmp 0xed57ab
push esi
mov esi, 4
push ebp
mov ebp, 0x48c32b73
jmp 0xed1553
or edx, 0x7fbe6bc9
jmp 0xed2afc
inc dword [esp]
xchg dword [esp], eax
not eax
xchg dword [esp], eax
sub dword [esp], 0x6b63beee
neg dword [esp]
push ecx
mov ecx, 0x7cf9d969
sub dword [esp + 4], ecx
jmp 0xed6736
pop edx
jmp 0xed6633
add ecx, esi
pop esi
xchg dword [esp], ecx
pop esp
sub esp, 4
mov dword [esp], eax
push eax
mov dword [esp], edx
sub esp, 4
jmp 0xed3933
push ebp
push dword [esp + 4]
mov ebp, dword [esp]
add esp, 4
pop dword [esp]
pop esp
push ebp
mov ebp, 0x6eff159b
jmp 0xed189f
cmp dword [ebp + 0x122d3a6f], 0
jne 0xed5ee6
cmp dword [ebp + 0x122d3a93], 0
je 0xed5ef5
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d5e33]
pop eax
push ecx
mov dword [esp], edx
mov dword [esp], 0x1e15d5c
mov dword [esp], eax
push ebx
jmp 0xed2250
mov ebp, 0x632999f2
xor ecx, ebp
pop ebp
mov esi, ecx
pop ecx
or esi, 0x777f361e
jmp 0xed2133
push ebp
mov dword [esp], 0xc7bde47
mov dword [esp], eax
mov eax, 0x5fbc99d4
sub dword [esp + 4], eax
pop eax
mov esi, dword [esp]
add esp, 4
push ebp
jmp 0xed1588
pop esp
mov dword [esp], ecx
mov ecx, 0x7db7131a
sub ecx, 0x7df74c7e
inc ecx
add ecx, 1
sub ecx, 0xa0e41d7b
jmp 0xed640b
neg ecx
dec ecx
push 0
sub dword [esp], ecx
mov ecx, dword [esp]
add esp, 4
neg ecx
jmp 0xed64a9
pop esp
jmp 0xed20ac
push ecx
jmp 0xed65d1
shr ecx, 1
jmp 0xed5036
push edx
push esp
pop edx
add edx, 4
sub esp, 4
mov dword [esp], eax
push ebp
push 0x3e76445f
pop ebp
push ebx
jmp 0xed296b
mov dword [esp], esp
add dword [esp], 4
pop dword [esp]
push ecx
mov dword [esp], eax
mov dword [esp], 0x79338f65
mov dword [esp], ecx
push esi
mov esi, 0x7c9eb927
sub esp, 4
mov dword [esp], edx
jmp 0xed20df
xor ecx, esi
jmp 0xed664a
mov esi, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
jmp 0xed66a3
pop esp
add dword [esp + 4], 0x6fd62aed
jmp 0xed6a91
inc esi
push edx
mov edx, 0x7a3f2f81
add edx, 0xef015b9d
sub esi, edx
jmp 0xed2fa8
pop ecx
jmp 0xed2bc0
push 0x2ebaa12
mov dword [esp], eax
jmp 0xed29c7
pop edx
add esp, 4
xor edx, 0x6db74864
pop edi
mov ebp, dword [esp]
push ebx
mov ebx, esp
jmp 0xed34df
add dword [esp + 4], ecx
sub dword [esp + 4], 0x6fd62aed
push dword [esp]
pop ecx
add esp, 4
push dword [esp]
pop eax
add esp, 4
mov dword [ebp + 0x122d2d4c], eax
mov dword [ebp + 0x122d25d1], 0
push edi
mov edi, esp
jmp 0xed6b9e
add ebx, esi
jmp 0xed1680
push edx
mov edx, 0x7b7bb571
and edx, 0x67bee6b6
add edx, 0x67ffc049
sub edx, 0x47fb132e
jmp 0xed5ada