Function at 0x5ea532
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push dword [esp]
push dword [esp]
mov eax, dword [esp]
jmp 0x5ea394
xchg dword [esp], eax
pop esp
push edi
mov dword [esp], ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
mov esp, dword [esp]
push esi
mov esi, esp
push ebx
mov ebx, 0x3fff319c
jmp 0x5ea3e8
add ebp, 0xea74bd31
jmp 0x5ea418
push esi
mov dword [esp], ebp
mov ebp, 4
add ecx, ebp
pop ebp
xchg dword [esp], ecx
jmp 0x5ea47f
mov ecx, 0x6cb64dde
jmp 0x5ea3f3
push eax
mov eax, esp
add eax, 4
push edi
mov edi, 4
add eax, edi
jmp 0x5ea3dc
mov dword [esp], 0x64ff2587
mov eax, dword [esp]
add esp, 4
jmp 0x5ea3c9
mov dword [esp], edi
push esi
mov esi, 0x6eaf3afc
jmp 0x5ea4c6
push ebx
mov ebx, 0x7d9d8e50
sub ebx, 0x82156d0
xor eax, ebx
jmp 0x5ea3e2
pop edi
jmp 0x5ea33e
pop ebx
jmp 0x5ea41f
shl ebx, 8
dec ebx
not ebx
jmp 0x5ea459
xor ecx, 0x534d465a
sub eax, ecx
pop ecx
sub eax, 0x5ef49925
sub eax, edi
add eax, 0x5ef49925
add eax, 0x3ffb0b84
mov edi, dword [esp]
add esp, 4
jmp 0x5ea4e7
add eax, ebp
jmp 0x5ea443
inc eax
push ebp
mov ebp, 0x6e3f6d00
or ebp, 0x6ee3fe15
not ebp
jmp 0x5ea36b
mov ebx, esp
add ebx, 4
sub ebx, 4
jmp 0x5ea4de
pop ebp
not eax
push 0x49e8a968
mov dword [esp], edi
mov edi, 0x767f2102
inc edi
jmp 0x5ea48d
add ebx, 0xff319c04
add esi, ebx
pop ebx
sub esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
jmp 0x5ea376
mov esp, dword [esp]
jmp 0x5ea487
push edx
jmp 0x5ea4d6
xor edi, 0x3efbd53d
push ebx
mov ebx, 0x3ff107ca
sub ebx, 0x74bf1ff0
and ebx, 0x2f685100
add ebx, 0x5fef2e41
xor ebx, 0x159802dc
add edi, ebx
pop ebx
sub edi, 0xc2c36a31
sub eax, edi
pop edi
xor edi, eax
pop eax
push ecx
jmp 0x5ea38a
mov edi, esi
pop esi
push edi
mov dword [esp], eax
push edx
mov dword [esp], ebx
jmp 0x5ea3a9
mov dword [esp], ebx
jmp 0x5ea433
xchg dword [esp], ebx
pop esp
jmp 0x5ea3bb
push ecx
mov dword [esp], 0x363bd126
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
push edx
jmp 0x5ea631
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
jmp 0x5ea546
mov dword [esp], edi
mov dword [esp], 0x6e4cafd0
jmp 0x5ea56e
neg eax
jmp 0x5ea728
add edi, ebx
jmp 0x5ea5b2
xchg dword [esp], ecx
mov esp, dword [esp]
push ebp
mov ebp, esp
push ecx
mov ecx, 0x7f37314f
sub esp, 4
jmp 0x5ea66c
sub esp, 4
mov dword [esp], ebp
mov dword [esp], 0x5eeff061
jmp 0x5ea59a
mov ecx, 0x7aff7cf7
sub ecx, 0x77bb0400
add ecx, 0x5ff52a47
jmp 0x5ea6f4
mov dword [esp], edx
push 0x3d8cc8da
jmp 0x5ea5f8
push 0x3c84868b
mov dword [esp], eax
push esp
pop eax
add eax, 4
add eax, 4
sub esp, 4
jmp 0x5ea624
add dword [esp], 0xffffffff
jmp 0x5ea5c5
pop ebx
push edi
mov edi, 0x35eecf27
jmp 0x5ea76e
pop ebx
xchg dword [esp], edi
pop esp
push ecx
push esp
pop ecx
add ecx, 4
jmp 0x5ea766
dec dword [esp]
shr dword [esp], 8
dec dword [esp]
xor dword [esp], 0x7897a328
mov dword [esp], edx
jmp 0x5ea7a8
mov ecx, 0x5f7f9223
add dword [esp + 8], ecx
mov ecx, dword [esp]
push edi
mov edi, esp
add edi, 4
jmp 0x5ea67c
mov dword [esp], ebx
push 0x37f576dd
pop ebx
push ebx
mov dword [esp], 0x4083d83c
mov dword [esp], ecx
push esi
mov esi, 0x5f7f9223
mov ecx, esi
pop esi
jmp 0x5ea61a
sub dword [esp + 8], ecx
pop ecx
jmp 0x5ea662
mov dword [esp], eax
push dword [esp + 4]
pop eax
jmp 0x5ea6e5
mov edx, esp
push eax
push 0x6ffe5062
pop eax
shl eax, 3
xor eax, 0x61dfdbba
push ecx
push 0x77f50087
pop ecx
xor ecx, 0x7ff41521
not ecx
jmp 0x5ea6d7
pop edi
mov ecx, ebx
push dword [esp]
pop ebx
jmp 0x5ea57b
add dword [esp + 4], ebx
push ecx
jmp 0x5ea5de
mov dword [esp], edx
mov edx, 0x80c8ceb5
add ecx, edx
pop edx
jmp 0x5ea7b9
add edi, 4
xor edi, dword [esp]
jmp 0x5ea691
sub eax, ecx
jmp 0x5ea6cf
xor dword [esp], edi
xor edi, dword [esp]
pop esp
push dword [esp]
mov ebx, dword [esp]
add esp, 4
add esp, 4
pop edx
push ecx
jmp 0x5ea558
shl ecx, 8
sub esp, 4
mov dword [esp], eax
mov eax, 0x2fb7141c
not eax
add eax, 0x79bfee4c
sub eax, 0x53eebc23
neg eax
jmp 0x5ea51e
pop ecx
add edx, eax
jmp 0x5ea735
add ecx, 1
or ecx, 0x67efc589
jmp 0x5ea6ab
pop dword [esp]
jmp 0x5ea7b1
pop ebx
push ebx
jmp 0x5ea75c
sub ecx, 0x2b3f7098
xor ecx, 0xf447b
sub edx, ecx
pop ecx
jmp 0x5ea7fb
push dword [esp]
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
jmp 0x5ea52c
sub eax, 0xd7dca066
add ecx, eax
pop eax
jmp 0x5ea68a
pop eax
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
push ebx
mov dword [esp], edi
mov edi, esp
jmp 0x5ea74a
push ebx
mov ebx, 4
jmp 0x5ea755
add edi, ebx
jmp 0x5ea6ed
mov ebx, 4
jmp 0x5ea525
sub ecx, 4
jmp 0x5ea77b
add edi, 0x16e1130
add ebx, edi
jmp 0x5ea656
xchg dword [esp], ecx
pop esp
mov dword [esp], ebp
mov dword [esp], 0x37df7101
neg dword [esp]
inc dword [esp]
and dword [esp], 0x69db7091
inc dword [esp]
add dword [esp], 0xe1c9d973
mov dword [esp], ebx
jmp 0x5ea708
push edi
push eax
mov eax, ecx
jmp 0x5ea7c7
pop esp
pop edx
push ebp
jmp 0x5ea50f
add ebp, ecx
pop ecx
add ebp, 4
jmp 0x5ea4fe
mov edi, eax
jmp 0x5ea7ce
pop eax
push edi
jmp 0x5ea7d5
push eax
mov eax, 0x797723e1
sub dword [esp + 4], eax
pop eax
pop edx
add edx, 0x797723e1
pop edi
jmp 0x5ea7ed
push ebx
push edx
sub dword [esp], 0x375ce057
jmp 0x5ea5a6
jmp 0x5eab90
push ebx
jmp 0x5eab96
mov ebx, esp
jmp 0x5eabb2
mov dword [esp], 0x77912b82
mov dword [esp], eax
push dword [esp]
mov ebx, dword [esp]
jmp 0x5eac10
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], ebp
sub esp, 4
mov dword [esp], edx
mov edx, eax
push edx
jmp 0x5eac1c
add edx, 4
xchg dword [esp], edx
pop esp
add eax, 0x6c5da040
mov ebp, dword [esp]
add esp, 4
jmp 0x5eac30
pop esp
add esp, 4
jmp 0x5eac62
xor dword [esp], edi
xor edi, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
sub esp, 4
jmp 0x5eac4a
add esp, 4
add esp, 4
pop eax
jmp 0x5eacee
push dword [esp]
mov ebp, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
jmp 0x5eac39
push edx
mov dword [esp], edi
jmp 0x5eacd8
push edi
mov edi, 4
add ebp, edi
pop edi
xchg dword [esp], ebp
jmp 0x5eabed
mov dword [esp], ebx
sub dword [esp], 0x7f69565a
mov eax, dword [esp]
add esp, 4
jmp 0x5eac8e
mov edx, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
jmp 0x5eac77
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
push 0x6ccb408c
mov dword [esp], ebp
jmp 0x5eacb7
push ecx
push 0x7f69565a
mov ecx, dword [esp]
jmp 0x5eac9c
add esp, 4
sub eax, 0x61dc1b93
add eax, ecx
add eax, 0x61dc1b93
mov ecx, dword [esp]
add esp, 4
push ebp
jmp 0x5eab9d
push eax
mov eax, 0x6c5da040
jmp 0x5eacc2
sub dword [esp + 4], eax
pop eax
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
jmp 0x5eabd3
mov edi, esp
add edi, 4
sub edi, 4
xor edi, dword [esp]
jmp 0x5eabf9
call 0x5eacf3
push dword [esp]
pop eax
push edx
mov dword [esp], ecx
push esp
pop ecx
add ecx, 4
push ebp
push ecx
mov ecx, 0x7e10df4a
jmp 0x5ead8d
pop ebx
jmp 0x5ead87
pop edi
push ebx
jmp 0x5ead9b
sub dword [esp + 4], 0x77ffa132
add dword [esp + 4], eax
add dword [esp + 4], 0x77ffa132
jmp 0x5eae7c
push ebx
jmp 0x5eadcc
mov eax, 0x66469ec6
sub dword [esp + 4], 0x7df71be8
jmp 0x5ead1c
or esi, 0x6eead789
jmp 0x5eaea7
mov ecx, ebx
mov ebp, ecx
mov ecx, dword [esp]
add esp, 4
mov ebx, dword [esp]
add esp, 4
add eax, 0x777f947b
add eax, 0x7f7eeaec
sub eax, ebp
sub eax, 0x7f7eeaec
sub eax, 0x777f947b
pop ebp
jmp 0x5eaeae
push esi
jmp 0x5eadee
shl ecx, 5
push esi
mov esi, 0x573eb788
jmp 0x5eade7
push dword [esp + 4]
pop ebx
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], ecx
push dword [esp + 4]
mov ecx, dword [esp]
add esp, 4
pop dword [esp]
mov esp, dword [esp]
push ebx
mov dword [esp], eax
mov dword [esp], 0x3fb19a84
jmp 0x5eae60
mov ebx, 0x5b972342
neg ebx
shl ebx, 2
dec ebx
shl ebx, 4
sub ebx, 0x9a4754a8
add esi, ebx
jmp 0x5ead0f
sub ecx, esi
jmp 0x5eae08
add dword [esp], 0x79ed559a
mov ebx, dword [esp]
add esp, 4
sub ebx, 0x79ed559a
pop esi
push ecx
jmp 0x5ead58
mov esi, dword [esp]
push ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
and ecx, 0x42346434
sub ecx, 0x7b9d7752
sub ecx, 0x5001a4ed
mov ebp, ecx
jmp 0x5eae37
pop ecx
neg ebp
sub ebp, 0x5fda9b5e
shr ebp, 2
add ebp, 0xf593e7d8
add ecx, ebp
pop ebp
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
push edi
jmp 0x5eae70
neg dword [esp]
xor dword [esp], 0x7f5f28ef
push eax
jmp 0x5ead3b
mov edi, 4
sub ebx, edi
jmp 0x5ead15
add dword [esp + 4], 0x7df71be8
pop eax
mov dword [esp], ebp
sub esp, 4
mov dword [esp], ebx
push esi
push ebx
push 0x79776532
pop ebx
add ebx, 0xe26faccc
mov esi, ebx
pop ebx
jmp 0x5ead4d
neg esi
jmp 0x5ead35
push edi
mov dword [esp], eax
jmp 0x5eb1d2
add edx, 0x7cf6a82e
and edx, 0x7fd93734
push ebp
mov ebp, 0x2d8351b5
neg ebp
neg ebp
jmp 0x5eb19e
add dword [esp + 4], 0x146f2322
add dword [esp + 4], 0x6ffeb020
sub dword [esp + 4], eax
push ebx
mov ebx, 0x6ffeb020
sub dword [esp + 8], ebx
pop ebx
push edx
mov edx, 0x146f2322
sub dword [esp + 8], edx
mov edx, dword [esp]
add esp, 4
jmp 0x5eb080
shl edx, 6
add edx, 0xff19423
jmp 0x5eaeec
push ebp
mov ebp, 0x77bdac7a
sub dword [esp + 4], ebp
pop ebp
mov ebx, dword [esp]
jmp 0x5eb057
add esp, 4
push ecx
jmp 0x5eb1c7
push dword [esp]
jmp 0x5eb139
pop eax
add esp, 4
pop eax
jmp 0x5eb143
sub esp, 4
mov dword [esp], edi
push edx
jmp 0x5eb194
mov edx, 0x7ef7ac81
jmp 0x5eafa6
inc ebp
xor ebp, 0x4278ceb7
or edx, ebp
pop ebp
add edx, 0xf72733c
jmp 0x5eb1b8
mov edi, edx
pop edx
jmp 0x5eb1ee
mov ecx, 0x77af1c48
inc ecx
jmp 0x5eb232
push eax
jmp 0x5eb1e3
mov ecx, dword [esp]
add esp, 4
jmp 0x5eaf6f
push ecx
mov ecx, 0x6fff7484
jmp 0x5eb22b
and edi, 0x6734c9fb
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x8db74cd
xor edi, ecx
pop ecx
add eax, 0x6cf7f599
add eax, edi
sub eax, 0x6cf7f599
mov edi, dword [esp]
add esp, 4
push ebx
jmp 0x5eafc7
mov eax, ecx
jmp 0x5eb1d8