Function at 0x5ef9e6
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push dword [esp]
push dword [esp]
pop eax
push esi
mov esi, esp
push eax
mov eax, 4
add esi, eax
mov eax, dword [esp]
jmp 0x5ef9b3
mov ebx, dword [esp]
push edi
jmp 0x5ef922
xchg dword [esp], edx
mov esp, dword [esp]
shl ebx, 1
jmp 0x5ef9f4
mov dword [esp], edx
sub esp, 4
mov dword [esp], ebp
push esp
pop ebp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x5efa0d
pop edx
shr ebx, 5
xor ebx, 0x3ffff31
sub eax, 0x75bbf08f
sub eax, ebx
push ecx
mov ecx, 0x21de438e
dec ecx
add ecx, 0x53ddad02
add eax, ecx
pop ecx
mov ebx, dword [esp]
add esp, 4
jmp 0x5efa43
mov edi, 0x7fed9b9c
sub edi, 0x56f01629
dec edi
neg edi
sub edi, 0xd7027a8a
add edx, edi
jmp 0x5ef9fb
pop edx
xchg dword [esp], ebp
mov esp, dword [esp]
push edx
mov dword [esp], 0x7baf4be9
mov dword [esp], ebx
push edi
mov dword [esp], 0x4e16b3d0
jmp 0x5ef90b
mov dword [esp], edi
jmp 0x5ef971
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
sub esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], edi
push esp
pop edi
add edi, 4
add edi, 4
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
push ebp
mov ebp, esp
add ebp, 4
jmp 0x5efa48
neg ebx
jmp 0x5efa07
pop edi
add edx, 4
jmp 0x5ef914
push edx
jmp 0x5efa23
mov dword [esp], esp
add dword [esp], 4
pop edx
sub esp, 4
jmp 0x5ef9ab
mov edx, 0x7ff3c561
xor edx, 0x2b3f147a
neg edx
xor edx, 0x4ff9989b
xor edx, 0xbbb7138f
or ebx, edx
jmp 0x5ef942
jmp 0x5efa78
push edx
mov edx, 4
sub ebp, 0x71f776fc
add ebp, edx
push ecx
mov ecx, 0x71f776fc
sub ebp, 0x75fbc873
add ebp, ecx
add ebp, 0x75fbc873
mov ecx, dword [esp]
add esp, 4
jmp 0x5ef98c
mov ecx, ebx
jmp 0x5f0b7f
push 0x3ad1e5db
mov dword [esp], edi
mov edi, esp
jmp 0x5f5612
shr ecx, 7
xor ecx, 0x7bfd454c
push esi
push eax
push 0x5b9d9cf1
pop eax
jmp 0x5f341b
add eax, 0x7dbb967e
add eax, 0x37ff0321
sub eax, ebp
sub eax, 0x37ff0321
sub eax, 0x7dbb967e
push dword [esp]
push dword [esp]
jmp 0x5f133b
pop edx
cmp dword [ebp + 0x122d3637], 0
jne 0x5f1124
cmp dword [ebp + 0x122d36d7], 0
je 0x5f1135
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c8c]
pop ebx
pop eax
sub esp, 4
mov dword [esp], ebp
jmp 0x5f5cb6
xor edi, dword [esp]
xor dword [esp], edi
jmp 0x5f1cc3
add esp, 4
push eax
mov dword [esp], 0x42497987
mov dword [esp], edx
push 0x59330430
mov dword [esp], eax
pop edx
jmp 0x5f28da
add edx, 0x766f6228
sub edx, esi
sub edx, 0x766f6228
pop esi
xchg dword [esp], edx
jmp 0x5f3cc5
add edi, 4
jmp 0x5f1229
neg edx
push eax
mov eax, 0x7db6ca94
jmp 0x5f3f0b
pop ebp
jmp 0x5f1476
sub ecx, 0x3b5cc800
shr ecx, 8
jmp 0x5f3c39
add esp, 4
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
jmp 0x5f29b1
add edx, edi
pop edi
push esi
push edx
push ecx
mov ecx, 0x7b6cb0ce
sub ecx, 0xfbbd1422
mov edx, ecx
pop ecx
and edx, 0x37edb841
push esi
mov esi, 0x5e995980
not esi
xor esi, 0x6de7df9c
jmp 0x5f3dcb
xchg dword [esp], edx
pop esp
cmp dword [ebp + 0x122d3637], 0
jne 0x5f1732
cmp dword [ebp + 0x122d36d7], 0
je 0x5f1741
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x1245bf6c]
pop eax
push 0x291a7e7e
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
push ecx
jmp 0x5f2a46
mov esp, dword [esp]
push 0x7ecf3c7f
mov dword [esp], ebp
mov ebp, 0x6f3be9ca
jmp 0x5f0f4a
xor edi, dword [esp]
pop esp
cmp dword [ebp + 0x122d3637], 0
jne 0x5f1cd9
cmp dword [ebp + 0x122d36d7], 0
je 0x5f1cee
push eax
mov eax, eax
mov eax, 0x7d0
mov dword [ebp + 0x122d25f4], eax
call dword [ebp + 0x122d27d0]
pop eax
push ebp
jmp 0x5f230f
add ecx, 0x12fad5fe
xor ebp, ecx
jmp 0x5f231a
xchg dword [esp], edx
mov esp, dword [esp]
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push ecx
push eax
mov eax, 0x7101
mov dword [esp + 4], eax
pop eax
mov dword [esp], ecx
mov ecx, esp
push ebp
mov ebp, 0x4fbf32ca
jmp 0x5f4256
pop ecx
sub edi, ebp
jmp 0x5f2820
push ebp
push esp
pop ebp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
pop eax
jmp 0x5f3a1a
pop ebp
xchg dword [esp], edi
mov esp, dword [esp]
push 0x5ec707ab
mov dword [esp], esp
add dword [esp], 4
pop dword [esp]
add dword [esp], 4
jmp 0x5f5cbe
mov edx, esp
sub esp, 4
mov dword [esp], ecx
jmp 0x5f546a
push edx
push ebp
mov ebp, esp
add ebp, 4
push ecx
mov ecx, 4
sub ebp, ecx
push dword [esp]
pop ecx
add esp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
mov dword [esp], esi
jmp 0x5f3425
push dword [esp]
pop esi
jmp 0x5f2674
xchg dword [esp], ebx
jmp 0x5f50a0
mov dword [esp], 0x65152cc4
mov dword [esp], eax
mov eax, 0x136f28eb
push edx
mov edx, 0x7fb79994
sub eax, edx
pop edx
shr eax, 8
neg eax
or eax, 0x5fff6845
add eax, 0x978f
sub ecx, 0x74f6fa47
sub ecx, eax
add ecx, 0x74f6fa47
mov eax, dword [esp]
add esp, 4
xchg dword [esp], ecx
mov esp, dword [esp]
mov dword [esp], eax
push edx
push 0x4eda7ac1
mov dword [esp], ecx
mov dword [esp], 0x38d1086
mov edx, dword [esp]
jmp 0x5f5451
push 0x1beefbb4
pop ebx
shl ebx, 3
xor ebx, 0x5f930e6b
push eax
mov eax, 0xbf3b9b60
xor ebx, eax
pop eax
mov esi, ebx
pop ebx
or esi, 0x5f6ed5bd
jmp 0x5f3d4f
push ebp
mov dword [esp], ecx
mov dword [esp], eax
push ebp
push ecx
push 0x69fb7900
pop ecx
jmp 0x5f1361
mov eax, edx
push dword [esp]
push dword [esp]
mov edx, dword [esp]
add esp, 4
add esp, 4
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
jmp 0x5f5964
sub eax, 0x2f65636e
push dword [esp]
mov ebp, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x5f4659
push dword [esp]
jmp 0x5f60ac
sub dword [esp], 0x73fdf5ca
pop eax
push 0x35c02f50
mov dword [esp], ebp
push 0x2f45aa3b
jmp 0x5f5e5a
sub ebp, 0xe1633301
add ecx, ebp
mov ebp, dword [esp]
add esp, 4
add ecx, 4
jmp 0x5f3335
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x122d3637], 0
jne 0x5f3353
cmp dword [ebp + 0x122d36d7], 0
je 0x5f3368
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d25f4], eax
call dword [ebp + 0x122d27d0]
pop eax
push eax
push eax
mov eax, 0x6f3be9ca
jmp 0x5f4816
add ebx, 0xa984702f
mov ecx, ebx
pop ebx
sub ecx, 0x2eb67e8a
shl ecx, 7
shr ecx, 5
sub ecx, 0x2f5f974
add edx, 0x5b7ba99d
add edx, ecx
sub edx, 0x5b7ba99d
pop ecx
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x5f5f63
sub eax, 0xdfd22360
jmp 0x5f3d93
push 0x6e9e7199
mov esi, dword [esp]
jmp 0x5f414e
push eax
mov dword [esp], edi
push esp
pop edi
jmp 0x5f4951
push eax
mov dword [esp], esi
mov esi, 0x324f8c11
jmp 0x5f5e8e
push ecx
inc dword [esp]
mov ecx, dword [esp]
add esp, 4
xchg ecx, edi
not edi
jmp 0x5f3c62
add eax, 0x6e9e7199
jmp 0x5f1111
add esp, 4
jmp 0x5f5c16
push eax
mov eax, 0x5efaef77
or eax, 0x7bf5f5b5
sub eax, 0x6ca8b4f7
xor ecx, eax
pop eax
shr ecx, 8
inc ecx
jmp 0x5f4704
xchg ecx, edi
sub ecx, 0x98fb5d56
add edi, ecx
jmp 0x5f46ac
add ecx, eax
mov eax, dword [esp]
add esp, 4
add ecx, 4
xor ecx, dword [esp]
xor dword [esp], ecx
xor ecx, dword [esp]
pop esp
push dword [esp]
pop edi
add esp, 4
cmp dword [ebp + 0x122d3637], 0
jne 0x5f3ca2
cmp dword [ebp + 0x122d36d7], 0
je 0x5f3cb1
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1d45]
pop eax
push eax
mov dword [esp], 0x6ffb4163
jmp 0x5f5f28
pop esp
mov dword [esp], ebx
mov ebx, 0x7f1f39c1
xor eax, ebx
mov ebx, dword [esp]
jmp 0x5f1245
inc esi
inc esi
sub esi, 0x440a5fa
add ecx, esi
pop esi
sub ecx, esi
sub ecx, 0x7bbf37c7
jmp 0x5f4da1
mov esi, eax
mov eax, dword [esp]
add esp, 4
push esi
push ebx
jmp 0x5f2d46
xor esi, 0x956bc0a3
xor edx, esi
mov esi, dword [esp]
add esp, 4
add edx, 0xffffffff
jmp 0x5f1325
mov edi, dword [esp]
jmp 0x5f3a4d
add edx, eax
pop eax
push edx
pop esi
pop edx
inc esi
jmp 0x5f3f17
add esi, 0x3fefcc00
not esi
xor esi, 0x5fbb7366
dec esi
push eax
mov eax, 0x7f7e20c7
shr eax, 2
dec eax
neg eax
jmp 0x5f4869
mov edx, esp
add edx, 4
add edx, 4
jmp 0x5f226d
add esp, 4
sub dword [esp + 4], esi
jmp 0x5f29a8
sub ebp, 0x5e7f533b
jmp 0x5f43ea
and ebp, 0x3ffec9ac
push esi
mov esi, 0x4fdb9687
sub ebp, esi
mov esi, dword [esp]
add esp, 4
jmp 0x5f3311
push ecx
mov dword [esp], edx
jmp 0x5f2d9f
pop ecx
push ebp
push ecx
mov ecx, 0x51fd3901
jmp 0x5f46f5
dec ecx
push ebp
jmp 0x5f49c0
push ebp
mov ebp, 0x82280e9a
sub ecx, ebp
pop ebp
mov ebp, ecx
pop ecx
sub dword [esp + 4], ebp
jmp 0x5f518b
sub dword [esp + 4], 0x555fae91
add dword [esp + 4], eax
push ebx
mov ebx, 0x555fae91
add dword [esp + 8], ebx
pop ebx
pop eax
push dword [esp]
pop eax
push ebp
mov dword [esp], ecx
jmp 0x5f5067
shl eax, 7
jmp 0x5f5b99
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push ebp
mov ebp, 0x7deb6b3c
add edx, ebp
pop ebp
push edx
xor dword [esp], 0x6f9eec31
pop eax
xor eax, 0x6f9eec31
push dword [esp]
pop edx
push ebx
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
jmp 0x5f171c
mov ebp, 0x6fdea0f9
jmp 0x5f4b4f
push edx
jmp 0x5f4023
xor ecx, ebp
jmp 0x5f5b17
xchg dword [esp], edx
pop esp
mov dword [esp], eax
mov eax, 4
jmp 0x5f3c71
pop esi
add edi, ecx
pop ecx
jmp 0x5f127b
pop eax
add esp, 4
mov dword [ebp + 0x122d1d8f], eax
mov dword [ebp + 0x122d1da8], 0
sub esp, 4
mov dword [esp], ecx
mov ecx, eax
push ecx
push dword [esp]
pop eax
jmp 0x5f4a85
mov ecx, esp
push esi
mov esi, 4
add ecx, esi
jmp 0x5f534e
pop esp
sub esp, 4
mov dword [esp], esi
mov dword [esp], eax
mov dword [esp], 0x79a5c1da
push ebp
mov ebp, 0x77e7d5df
and dword [esp + 4], ebp
pop ebp
add dword [esp], 1
push ebx
mov dword [esp], 0x76a22940
jmp 0x5f58a3
pop ebp
mov edx, dword [esp]
jmp 0x5f375c
mov esi, dword [esp]
add esp, 4
jmp 0x5f5d34
add esp, 4
xor dword [esp + 4], edx
pop edx
push dword [esp]
pop eax
add esp, 4
push 0x620a7329
jmp 0x5f5eb6
push ebx
mov ebx, 0x75ef8cb8
dec ebx
inc ebx
inc ebx
jmp 0x5f339a
push ecx
push 0x5ffb71e1
pop ecx
sub ecx, 0xffffffff
jmp 0x5f57ab
xor dword [esp], 0x7f1f39c1
push dword [esp]
jmp 0x5f5c93
push esi
jmp 0x5f588d
mov esi, 0x573f246b
shl esi, 7
xor esi, 0xa76de6c6
xor ecx, esi
pop esi
jmp 0x5f3958
mov dword [esp], ecx
mov dword [esp], edx
mov edx, 0x216716e0
and dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
sub dword [esp], 0xe013b9b8
mov dword [esp], edx
mov edx, eax
jmp 0x5f2ede
xor ecx, dword [esp]
xor dword [esp], ecx
xor ecx, dword [esp]
pop esp
cmp dword [ebp + 0x122d3637], 0
jne 0x5f5980
cmp dword [ebp + 0x122d36d7], 0
je 0x5f598f
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1d1a]
pop eax
cmp dword [ebp + 0x122d36d7], 0
je 0x5f59a5
push eax
mov eax, 0
call dword [ebp + 0x122d1c52]
pop eax
push eax
jmp 0x5f5732
pop ebp
jmp 0x5f5b2b
not ecx
or ecx, 0x6e7ec526
xor ecx, 0x9900313c
mov ebp, ecx
pop ecx
push ecx
mov ecx, 0x63ebaedc
xor ecx, 0x71bb59e0
add ecx, 0x63b3f2e8
and ecx, 0x6ddf15fb
jmp 0x5f209b
pop edx
push 0xab37772
mov dword [esp], ebp
push 0x71b07d2b
mov dword [esp], ecx
mov ecx, edi
mov ebp, ecx
pop ecx
mov eax, ebp
push dword [esp]
mov ebp, dword [esp]
add esp, 4
push ecx
mov ecx, esp
push edx
jmp 0x5f5e12
add eax, 0xdee011ca
jmp 0x5f5e25
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x363cd9c1
shr ecx, 8
shl ecx, 7
jmp 0x5f0d01
mov eax, dword [esp]
add esp, 4
add esp, 4
jmp 0x5f5de4
mov dword [esp], eax
jmp 0x5f3215
push dword [esp]
jmp 0x5f4f26
add ecx, 4
xchg dword [esp], ecx
jmp 0x5f1765
push edx
push esp
pop edx
jmp 0x5f5e07
push edi
mov edi, 4
jmp 0x5f16ef
mov edx, esp
add edx, 4
sub edx, 4
jmp 0x5f4b56
xor esi, eax
pop eax
jmp 0x5f1264
mov dword [esp], esi
mov dword [esp], ecx
jmp 0x5f5e65
mov dword [esp], eax
mov eax, 0x7ecb3f3e
mov ebp, eax
pop eax
xor ebp, 0x37bed8d1
xchg ebp, eax
add eax, 0xffffffff
xchg ebp, eax
jmp 0x5f38ed
or ebp, esi
pop esi
sub ebp, 1
dec ebp
xor ebp, 0x8821a37
add eax, 0x2f65636e
add eax, 0x7ddd28a9
jmp 0x5f5eaa
add eax, ebp
sub eax, 0x7ddd28a9
jmp 0x5f2f88
mov dword [esp], edi
mov edi, 0x7f7bbee0
shl edi, 4
add edi, 0xbd12286
xor eax, edi
pop edi
push edi
push edx
push edi
push eax
add dword [esp], 0x3eb4fd1
pop edi
sub edi, 0x3eb4fd1
mov edx, edi
pop edi
push edx
pop edi
jmp 0x5f5b5f
sub dword [esp], 0xf869a9a4
mov dword [esp], ecx
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
push edx
jmp 0x5f289a
push eax
push esp
mov eax, dword [esp]
add esp, 4
jmp 0x5f5fc7
push ebp
mov ebp, 4
add eax, ebp
pop ebp
jmp 0x5f5ffa
push edi
jmp 0x5f6081
mov edi, 4
add eax, edi
pop edi
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
mov esp, dword [esp]
sub esp, 4
mov dword [esp], eax
jmp 0x5f30c4
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
push edi
push esp
jmp 0x5f3efb