Function at 0xf7dfba
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
pop eax
add eax, 0xe
mov dword [eax], ecx
jmp 0xf76ddd
jmp 0xf7a5b2
jmp 0xf7b6b7
push ebx
mov dword [esp], 0x18f6c48d
jmp 0xf7f3eb
mov dword [esp], edi
mov edi, eax
jmp 0xf7dbb5
mov ebx, dword [esp]
add esp, 4
pop edx
xor dword [esp + 4], ebx
pop ebx
mov eax, dword [esp]
jmp 0xf7ced7
push ecx
mov dword [esp], 0x7aa1232d
jmp 0xf7c203
mov edi, dword [esp]
add esp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
jmp 0xf7e5b2
mov esp, dword [esp]
mov dword [esp], eax
jmp 0xf7d0c2
pop eax
jmp 0xf7bc40
dec ebp
not ebp
xchg ebp, eax
not eax
jmp 0xf7d3ae
push ebp
mov ebp, 0x7df7cc00
or esi, ebp
pop ebp
sub esi, 0xe08777c
xor esi, 0x14480521
or eax, esi
mov esi, dword [esp]
add esp, 4
push eax
push edi
pop eax
pop edi
not edi
xor eax, edi
xor edi, eax
xor eax, edi
push ecx
mov ecx, 0x5afbd7df
and eax, ecx
pop ecx
add eax, 0xffffae68
add ebp, 0x7efae9c9
add ebp, eax
jmp 0xf7d089
dec dword [esp]
jmp 0xf7d6e8
push esi
mov esi, 4
add ebx, esi
pop esi
sub ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
mov esp, dword [esp]
jmp 0xf80daa
mov dword [esp], edi
jmp 0xf7ca6e
add dword [esp + 4], ebx
add dword [esp + 4], 0x5ebf6363
add dword [esp + 4], 0x7fef7aad
push dword [esp]
pop ebx
jmp 0xf7d11e
mov ecx, 4
sub edx, ecx
pop ecx
xchg dword [esp], edx
pop esp
mov dword [esp], ecx
mov dword [esp], 0x5b943ab1
mov dword [esp], eax
mov dword [esp], 0x7e33c60e
mov dword [esp], ebp
mov dword [esp], eax
pop eax
jmp 0xf81355
mov edi, 0x79dd48f2
shl edi, 4
inc edi
or edi, 0x73af5cd2
push edx
mov edx, 0x7fbae3f2
add edi, edx
pop edx
jmp 0xf7d8b3
push ecx
jmp 0xf7b72e
mov esi, 0xcf049f12
add ecx, esi
pop esi
sub edi, ecx
jmp 0xf7e910
add dword [esp], 4
mov eax, dword [esp]
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
push eax
mov eax, 0x69e3a441
jmp 0xf7d317
push esi
mov dword [esp], ebp
mov ebp, 0x7fffdf87
xor ebp, 0x130c8c
add esi, 0x5ffe6b76
sub esi, 0x53bfe69e
jmp 0xf7f1ce
push ebx
mov dword [esp], edx
jmp 0xf7cb5b
xor eax, edx
jmp 0xf7f4cd
add esp, 4
push edx
mov dword [esp], edi
push eax
push ebx
mov ebx, 0x1cbfa134
jmp 0xf80dba
add eax, 4
push edx
mov edx, 4
jmp 0xf7e5a7
mov eax, 0x7fcd4d84
and edx, eax
pop eax
and edx, 0x5fef25af
jmp 0xf802e8
sub ebp, 0x7efae9c9
pop eax
sub esp, 4
mov dword [esp], eax
mov eax, 4
add ebp, eax
mov eax, dword [esp]
add esp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
mov dword [ebp + 0x122d25ca], eax
mov dword [ebp + 0x122d3642], 0
push ebx
jmp 0xf80084
push eax
mov dword [esp], ebx
sub esp, 4
jmp 0xf7f5cc
xor edi, eax
mov eax, dword [esp]
jmp 0xf7f61d
add esp, 4
pop eax
sub eax, 0x4fcfdb11
cmp dword [ebp + 0x122d37fa], 0
jne 0xf7d13c
cmp dword [ebp + 0x122d385e], 0
je 0xf7d14d
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c2f]
pop ebx
pop eax
push edi
mov dword [esp], edx
mov dword [esp], esi
push eax
pop esi
push esi
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], eax
mov eax, esp
jmp 0xf7d52e
push esi
jmp 0xf7d5d6
xchg ebp, eax
shl ebp, 2
xor ebp, 0x30a561ad
jmp 0xf7fe8e
mov dword [esp], eax
mov eax, 0x537f4ce2
add dword [esp + 4], eax
pop eax
mov eax, dword [esp]
jmp 0xf7f970
mov dword [esp], edx
mov edx, 0x2cbeb5fe
jmp 0xf7f2ac
add eax, 4
jmp 0xf81391
push ecx
mov ecx, 0xcebe183a
add edi, ecx
jmp 0xf7f65e
mov esi, 0x7ffd7b86
sub esi, 0x7fdfbce8
jmp 0xf7bfa1
not dword [esp]
shl dword [esp], 3
jmp 0xf7f7be
sub edi, 0xffffffff
sub edi, 0xffffffff
neg edi
push ecx
jmp 0xf7dcdc
add eax, edi
pop edi
mov edx, dword [esp]
add esp, 4
push ebp
push eax
pop ebp
push ebp
push 0x3b3ae635
jmp 0xf80c6e
pop eax
push eax
mov eax, 0x5fc78e69
jmp 0xf7d108
sub dword [esp + 4], 0x73ea4f07
jmp 0xf7df92
push ecx
mov ecx, 0x7dffebe8
add ecx, 0x5df7c431
jmp 0xf7dc67
or ecx, 0x7a75c801
not ecx
xor ecx, 0x7b6e61a4
xor ecx, 0x5bf7fccb
push esi
jmp 0xf7cc77
push eax
mov eax, 0x370b2464
jmp 0xf7ff60
push 0x77d75d0a
jmp 0xf7ee6f
sub ebx, 0xffffffff
xor ebx, 0x7ffb516a
add ebx, 0x7e5d9be4
xor ebx, 0x846777af
jmp 0xf7ee37
add esp, 4
jmp 0xf8092d
pop ebp
jmp 0xf7bd49
mov dword [esp], eax
push dword [esp]
pop eax
push ebp
mov ebp, esp
add ebp, 4
push edi
mov edi, 0x7f303a00
sub edi, 1
not edi
jmp 0xf7f179
sub eax, 0xffffffff
push ebp
mov ebp, 0x6ef9c46e
shl ebp, 1
jmp 0xf7be82
pop ebx
push edi
push 0x30ee46ae
jmp 0xf7d406
pop esp
jmp 0xf8142f
sub eax, edx
pop edx
xchg dword [esp], eax
jmp 0xf7bce6
push esi
mov esi, esp
push edx
mov edx, 4
add esi, edx
pop edx
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebx
mov dword [esp], eax
jmp 0xf7f171
mov ebx, 0x77df9017
dec ebx
jmp 0xf7dd20
pop ecx
add esi, edi
pop edi
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
sub eax, 0x537f4ce2
mov edi, dword [esp]
add esp, 4
jmp 0xf7ea7d
mov ecx, eax
pop eax
xor edi, ecx
pop ecx
jmp 0xf7d5b8
push eax
push ecx
jmp 0xf7d51b
mov ebx, 0x368f2b71
xor ebx, 0x5143adbf
xor edi, ebx
jmp 0xf7e47d
add ecx, ebx
jmp 0xf7efe7
pop ebp
push ecx
push ebx
mov ebx, 0x73ea4f07
mov ecx, ebx
pop ebx
add dword [esp + 8], ecx
pop ecx
add dword [esp + 4], ebp
jmp 0xf7d90d
mov esp, dword [esp]
push eax
push ebx
push edx
jmp 0xf81126
pop ebx
xor ebp, ecx
pop ecx
inc ebp
push edi
push edx
jmp 0xf80bb2
mov dword [esp], ebx
jmp 0xf7edd1
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
sub esp, 4
mov dword [esp], ebx
pop eax
push dword [esp]
pop ebx
jmp 0xf7dd69
push dword [esp]
jmp 0xf80265
xor edi, 0xbfdd0a5
sub edi, 0x7bbb536b
xchg edi, eax
not eax
xchg edi, eax
push ebx
push eax
jmp 0xf80500
sub esi, ebp
add esi, 0x53bfe69e
sub esi, 0x5ffe6b76
pop ebp
mov edx, dword [esp]
add esp, 4
add esi, 4
xor esi, dword [esp]
jmp 0xf7f3f3
xor dword [esp], 0x7ff34937
pop ebx
push ebp
mov dword [esp], edi
mov edi, 0x7e4d0d00
xor edi, 0x7acea6da
and edi, 0x6f9d8368
neg edi
sub edi, 0x7b8b3381
xor ebx, edi
jmp 0xf7f802
xor dword [esp + 4], edx
push dword [esp]
pop edx
add esp, 4
pop eax
push eax
mov dword [esp], edx
mov edx, 0x7ffbd4aa
neg edx
xor edx, 0x6fdf0730
dec edx
push 0x38fc6014
jmp 0xf7f6db
mov dword [esp], esp
jmp 0xf7cd73
xor dword [esp], esi
xor esi, dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x122d37fa], 0
jne 0xf7f40e
cmp dword [ebp + 0x122d385e], 0
je 0xf7f41d
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2bb7]
pop eax
push edi
mov dword [esp], 0x539f28e
mov dword [esp], edx
push edx
jmp 0xf7f9c6
pop edx
cmp dword [ebp + 0x122d37fa], 0
jne 0xf7f4e0
cmp dword [ebp + 0x122d385e], 0
je 0xf7f4ef
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2618]
pop eax
cmp dword [ebp + 0x122d385e], 0
je 0xf7f505
push eax
mov eax, 0
call dword [ebp + 0x122d1fed]
pop eax
push ecx
mov dword [esp], edx
mov edx, esp
push eax
jmp 0xf80f65
mov dword [esp], ebp
push edx
mov edx, 0x7df2c4a6
jmp 0xf7fe88
add esp, 4
jmp 0xf7d7b0
pop ecx
xor eax, edi
pop edi
cmp dword [ebp + 0x122d37fa], 0
jne 0xf7f674
cmp dword [ebp + 0x122d385e], 0
je 0xf7f683
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2ae9]
pop eax
push esi
mov dword [esp], 0x7f9f3aa0
inc dword [esp]
not dword [esp]
jmp 0xf7fa9f
mov dword [esp], ebp
jmp 0xf7fbd7
or dword [esp], 0x1ff86950
add dword [esp], 0xf1109128
mov dword [esp], ecx
mov ecx, 0x77d75d0a
sub eax, ecx
jmp 0xf7ff41
pop edi
jmp 0xf80579
push esi
mov esi, esp
push eax
mov eax, esp
add eax, 4
sub eax, 4
jmp 0xf805fa
mov edx, esp
add edx, 4
sub edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
mov dword [esp], eax
pop edx
push eax
mov eax, esp
add eax, 4
push edx
mov edx, 4
sub eax, edx
pop edx
xchg dword [esp], eax
pop esp
mov dword [esp], edx
sub esp, 4
mov dword [esp], edx
mov edx, 0x7fbac3e5
add dword [esp + 4], 0x3a6990f6
sub dword [esp + 4], 0x735d5a67
sub dword [esp + 4], edx
add dword [esp + 4], 0x735d5a67
sub dword [esp + 4], 0x3a6990f6
pop edx
pop eax
push ebx
jmp 0xf7c4ed
shr dword [esp], 3
add dword [esp], 0x3dcff9e6
add dword [esp], 0x6b7ddc31
xor dword [esp], 0xf7e2727c
add dword [esp], 0x37df56ce
add dword [esp], 0xb8f1fbbb
xchg dword [esp], edx
xchg edx, ecx
not ecx
xchg edx, ecx
xchg dword [esp], edx
sub dword [esp], 0x6ac30e27
jmp 0xf7dfb3
push edi
push 0x7edbe199
pop edi
neg edi
jmp 0xf809ef
mov esi, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
push edi
mov edi, 4
add edx, edi
pop edi
push 0x7a553646
mov dword [esp], edx
push dword [esp + 4]
jmp 0xf81437
push eax
jmp 0xf7d064
or eax, ebp
mov ebp, dword [esp]
jmp 0xf80f84
pop ecx
push dword [esp]
pop ebp
push ebx
mov dword [esp], edi
push eax
mov dword [esp], esp
add dword [esp], 4
mov edi, dword [esp]
add esp, 4
jmp 0xf8005c
not eax
sub eax, 0x6a69ca66
not eax
neg eax
shr eax, 2
sub eax, 0xd1bb9ef9
jmp 0xf7ea05
add edi, 4
add edi, 4
jmp 0xf80d21
mov ebx, esp
jmp 0xf7c310
pop eax
push ebp
mov dword [esp], esi
push esp
pop esi
push ecx
jmp 0xf80735
shl edx, 3
sub edx, 0x63f67f01
shl edx, 3
sub edx, 0x7d4de7
mov ebp, edx
pop edx
jmp 0xf80cc5
mov eax, 0x3dbfe532
mov ebx, 0xcd36d9f3
xor ebx, eax
pop eax
sub edi, ebx
pop ebx
add ebp, 0x5d112cc1
add ebp, edi
sub ebp, 0x5d112cc1
jmp 0xf7bc4d
push dword [esp]
pop ebp
push ebx
jmp 0xf7f0d5
xchg dword [esp], eax
jmp 0xf80ca3
mov dword [esp], edx
mov edx, 4
add esi, 0x7fecd30b
add esi, edx
jmp 0xf7cdde
cmp dword [ebp + 0x122d37fa], 0
jne 0xf8093f
cmp dword [ebp + 0x122d385e], 0
je 0xf80954
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d2823], eax
call dword [ebp + 0x122d2bd7]
pop eax
push 0x2484cfab
mov dword [esp], ecx
mov dword [esp], edi
sub esp, 4
mov dword [esp], eax
xor dword [esp], 0x67cc86ce
pop edi
push eax
jmp 0xf7f088
xor edi, 0xfad877cd
mov ebp, edi
pop edi
neg ebp
push ecx
mov ecx, 0x766d3e01
dec ecx
and ecx, 0x7fffabb4
xor ecx, 0x3ff8242f
add ecx, 0x7f777565
add ecx, 0xb40da4f7
push 0x64bcd29e
mov dword [esp], ebx
jmp 0xf7e7fa
mov edx, 0x6f771b3e
and edx, 0x7df7b4c1
shl edx, 5
xchg edx, edi
not edi
jmp 0xf811d1
mov dword [esp], ebp
jmp 0xf7dd16
pop esp
mov dword [esp], edi
push ecx
push 0x17afa79d
pop ecx
sub ecx, 0xa1d7e45d
mov edi, ecx
pop ecx
sub edi, 0x770f05eb
shl edi, 2
jmp 0xf80ed0
push ebp
push eax
mov eax, 0x1677a41e
add dword [esp + 4], eax
pop eax
pop ebx
sub ebx, 0x1677a41e
pop ebp
sub dword [esp + 4], 0x7fef7aad
sub dword [esp + 4], 0x5ebf6363
jmp 0xf7c50f
xchg dword [esp], edi
pop esp
cmp dword [ebp + 0x122d37fa], 0
jne 0xf80d37
cmp dword [ebp + 0x122d385e], 0
je 0xf80d4c
push eax
mov eax, eax
mov eax, 0x7d0
mov dword [ebp + 0x122d2823], eax
call dword [ebp + 0x122d2bd7]
pop eax
push ebp
push esi
jmp 0xf7ce0d
mov dword [esp], ebx
push 0x61605f55
mov dword [esp], ebp
jmp 0xf80dce
mov eax, 0x8e0f588f
sub eax, ebx
pop ebx
add eax, 0xaab767a
mov edi, eax
jmp 0xf7d901
push eax
mov ebp, dword [esp]
add esp, 4
push ebp
jmp 0xf7f233
not edi
add edi, 0x7fdef792
add edi, 0x6eda3762
jmp 0xf7da92
mov eax, 0x75a78ba6
sub eax, 0x6dffe0c1
add eax, 0x7657be67
push esi
mov esi, 0x7e7e06b1
or eax, esi
pop esi
neg eax
jmp 0xf7e040
add esp, 4
push edx
push eax
mov eax, 0x5fbbd74c
mov edx, 0x1b433387
add edx, eax
pop eax
jmp 0xf812b9
push eax
mov eax, 0x5f7ff650
jmp 0xf81445
xchg edx, edi
and edx, 0x5d3fd82c
xor edx, 0x96750ca7
mov edi, edx
pop edx
add ebp, edi
pop edi
xor edx, ebp
mov ebp, dword [esp]
add esp, 4
jmp 0xf7ceaf
shl edx, 2
jmp 0xf812f5
inc edx
neg edx
add edx, 0xb367fe0e
xor eax, edx
pop edx
add edx, eax
pop eax
push ecx
jmp 0xf7c5f7
push edi
jmp 0xf813d2
push edi
mov edi, 4
add eax, 0x74d606ad
add eax, edi
sub eax, 0x74d606ad
jmp 0xf813e4
mov dword [esp], eax
push esp
mov eax, dword [esp]
add esp, 4
jmp 0xf7cfc7
pop edi
xchg dword [esp], eax
jmp 0xf7e525
push dword [esp]
jmp 0xf7fcdc
mov edx, dword [esp]
add esp, 4
pop dword [esp]
jmp 0xf7ef17
sub eax, 0x3fb0b6c5
sub eax, 0x2fed6fe7
shr eax, 3
push ecx
mov ecx, 0x77f63091
and eax, ecx
pop ecx
sub eax, 0xa9119f40
mov edx, eax
pop eax
push 0x4aafb146
mov dword [esp], edx
jmp 0xf7b758