Function at 0x105983c
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
mov eax, dword [esp]
push 0x48b1c245
mov dword [esp], edi
mov dword [esp], ecx
push esp
jmp 0x1058fde
push edx
mov edx, 0x6dffb7ab
sub edx, 0x7f7d9412
jmp 0x10590d8
add ecx, 0x3fbb2266
jmp 0x10590b7
pop edx
push ecx
jmp 0x1059058
or edi, edx
pop edx
add edi, 1
xor edi, 0x7daffeb2
sub ecx, 0x3fbb2266
add ecx, edi
jmp 0x1058f64
add ecx, edi
jmp 0x105901f
dec ebx
sub ebx, 0x40dee98e
jmp 0x1059079
add edx, 0x7bffcf8f
pop edi
push esi
mov esi, 0x9100fa3d
xor edx, esi
pop esi
sub eax, edx
push dword [esp]
jmp 0x1058f6f
mov edx, edi
pop edi
sub edx, 0x6ff5b397
xor edx, 0x7449e31c
jmp 0x1058f76
shr ebx, 7
and ebx, 0x4fdf8513
jmp 0x1058f96
pop ecx
add ecx, 4
sub esp, 4
mov dword [esp], edi
push edx
mov dword [esp], ebx
push eax
push esi
mov esi, 0x77ff11f6
xor esi, 0xc08d901
mov eax, esi
jmp 0x1059084
push ecx
mov ecx, ebx
jmp 0x1059092
push edi
mov edi, 0x4fea58d0
xor edi, 0x3a31e264
jmp 0x1058fbc
add ecx, 0x3df35401
push dword [esp]
pop edi
add esp, 4
xor ecx, dword [esp]
xor dword [esp], ecx
xor ecx, dword [esp]
mov esp, dword [esp]
jmp 0x1058f53
xchg edx, ebx
shr edx, 3
push edi
mov edi, 0x6fffbccc
sub edx, 0x7bffcf8f
sub edx, edi
jmp 0x1058fa2
mov ecx, esp
add ecx, 4
push 0x7b09ddd0
jmp 0x105906a
mov dword [esp], edi
mov edi, 0x7c8bdab6
dec edi
push edx
jmp 0x105900e
xor eax, ebx
pop ebx
mov ebx, eax
pop eax
jmp 0x1059006
pop esi
or eax, 0x7eee006a
shr eax, 1
jmp 0x10590ee
mov edi, ecx
jmp 0x10590cb
not dword [esp]
pop eax
push esi
mov dword [esp], ebx
mov ebx, 0x7df71664
sub ebx, 0x67c7b066
or ebx, 0x6fbfc831
jmp 0x1058fd0
mov edi, dword [esp]
add esp, 4
xchg dword [esp], ecx
mov esp, dword [esp]
jmp 0x105910c
pop ecx
pop ebx
sub ecx, 0x3df35401
jmp 0x1058f8f
add edx, 0x78f6bff9
push eax
mov dword [esp], 0
sub dword [esp], edx
jmp 0x10590f4
push eax
jmp 0x1059099
mov edx, dword [esp]
add esp, 4
add edx, 0xdb58ccd6
shl edx, 6
xchg edx, ebx
neg ebx
jmp 0x1059040
sub esp, 4
mov dword [esp], edx
push eax
push ebp
mov dword [esp], eax
jmp 0x10591f1
push ecx
mov ecx, 4
add ebx, ecx
jmp 0x10591e1
mov ebp, 4
jmp 0x10591fb
sub esp, 4
mov dword [esp], esi
push esp
pop esi
add esi, 4
push ebp
mov ebp, 4
sub esi, ebp
mov ebp, dword [esp]
add esp, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebp
jmp 0x1059358
dec edx
sub edx, 0x8177b22e
mov ecx, edx
pop edx
add ecx, 0x5dff8edb
add ecx, 1
not ecx
not ecx
push esi
mov esi, 0x6effb827
and esi, 0x7a6fc94
xor esi, 0x5bbab267
sub ecx, esi
jmp 0x10592e4
push edx
push esp
jmp 0x10592b3
mov ebx, 0x4fe78a2b
and ebx, 0x73df39df
sub ebx, 0x43c70807
add edx, ebx
jmp 0x1059204
mov edx, eax
mov eax, dword [esp]
add esp, 4
mov ebp, edx
pop edx
add edx, ebp
pop ebp
xchg dword [esp], edx
pop esp
push ecx
mov dword [esp], ebx
mov dword [esp], eax
mov dword [esp], ebp
push 0x119ca65c
mov dword [esp], edx
mov edx, 0x6e202bae
jmp 0x10593a5
pop ecx
add ebx, 4
xchg dword [esp], ebx
pop esp
jmp 0x105922a
mov eax, 0x7fdfc978
jmp 0x105921e
add eax, ebp
pop ebp
push eax
jmp 0x10592a4
pop ebx
push ebp
push edx
jmp 0x10592de
pop eax
pop dword [esp]
mov esp, dword [esp]
add esp, 4
jmp 0x10593c3
add dword [esp + 4], eax
pop eax
pop edx
push eax
jmp 0x1059315
push 0x2dd8986
mov dword [esp], eax
mov eax, esp
add eax, 4
jmp 0x1059254
mov eax, 4
jmp 0x10591b0
mov esi, ebx
push 0x7e6942cb
jmp 0x1059270
push ebp
jmp 0x1059129
pop esp
push 0x7ffc01e6
mov dword [esp], esi
mov esi, esp
push ecx
mov ecx, 4
jmp 0x1059368
mov dword [esp], esi
mov ebx, dword [esp]
add esp, 4
mov esi, dword [esp]
sub esp, 4
mov dword [esp], edx
mov edx, esp
push eax
push esi
mov esi, 4
mov eax, esi
pop esi
sub edx, 0x5df5f320
add edx, 0x7e5bcb00
add edx, eax
jmp 0x10592b9
push dword [esp + 4]
jmp 0x105920c
dec edx
jmp 0x105915e
pop edx
jmp 0x10592cc
sub edx, 0x7e5bcb00
jmp 0x10592d2
add esp, 4
jmp 0x1059191
push ebx
jmp 0x1059198
add edx, 0x5df5f320
pop eax
jmp 0x1059133
push eax
jmp 0x105923e
pop esi
add edx, 0x397b0300
sub edx, ecx
sub edx, 0x397b0300
mov ecx, dword [esp]
add esp, 4
push edx
push dword [esp]
pop eax
add esp, 4
jmp 0x105930c
push dword [esp]
pop edx
jmp 0x1059342
mov dword [esp], ecx
push edx
mov edx, 0x7fb9e400
push eax
mov eax, 0x577e10c6
shr eax, 1
add eax, 0xf43cc29e
xor edx, eax
mov eax, dword [esp]
add esp, 4
or edx, 0x73f70396
shr edx, 8
jmp 0x10592ad
add esp, 4
push ecx
mov dword [esp], 0x6bf625e7
mov dword [esp], esi
jmp 0x1059248
mov ebp, 4
add edx, ebp
pop ebp
xchg dword [esp], edx
jmp 0x105925a
add esi, 0x7effed66
add esi, ecx
sub esi, 0x7effed66
mov ecx, dword [esp]
add esp, 4
push ecx
mov ecx, 4
sub esi, 0x317fe856
sub esi, ecx
add esi, 0x317fe856
pop ecx
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], ecx
push dword [esp]
mov ecx, dword [esp]
jmp 0x10592c4
mov dword [esp + 4], edx
pop edx
mov dword [esp], edx
jmp 0x10593b2
push dword [esp]
push dword [esp]
mov edx, dword [esp]
push ebx
mov ebx, esp
jmp 0x105911c
jmp 0x105975c
push ebp
push eax
push edx
mov edx, 0x7fce4101
sub dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
pop ebp
jmp 0x10597e1
push 0x18556947
jmp 0x10598b8
push esi
mov dword [esp], edx
sub esp, 4
mov dword [esp], eax
jmp 0x1059856
mov esi, ecx
mov ecx, dword [esp]
add esp, 4
push 0x1f96ddd5
jmp 0x10597d1
push ebx
push esi
mov esi, 0x7befac31
xor dword [esp + 4], esi
pop esi
mov ecx, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], esi
push 0x42ee28a2
pop esi
jmp 0x105981a
mov dword [esp], esi
sub dword [esp], 0x7cbe2a20
pop eax
jmp 0x1059781
add ebp, 0x7fce4101
push 0x2afce6ac
mov dword [esp], esi
push ecx
jmp 0x10597fe
pop eax
add esi, edx
pop edx
jmp 0x1059822
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ebp
pop ecx
jmp 0x1059793
push edx
push eax
push ebx
jmp 0x1059875
push edx
mov edx, 0x39018490
xor esi, edx
jmp 0x10598a3
pop ebp
push ebp
mov dword [esp], ecx
jmp 0x10597a8
mov ebx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
push ecx
mov ecx, 4
add ebp, ecx
pop ecx
xor ebp, dword [esp]
jmp 0x10598c0
mov eax, 0x7ff70b63
mov edx, 0xbbe8a9e4
add edx, eax
mov eax, dword [esp]
add esp, 4
not edx
shr edx, 8
shl edx, 1
jmp 0x105988c
push 0x31fda5fc
pop ebx
inc ebx
xor ebx, 0xce025a02
mov eax, ebx
pop ebx
mov edx, eax
jmp 0x10597f5
add edx, 0x1f6b6ee7
add edx, 0x5bca7aa5
add eax, edx
pop edx
push dword [esp]
jmp 0x10598ac
pop edx
xor ecx, esi
pop esi
jmp 0x1059777
pop esi
add esp, 4
jmp 0x105982f
mov dword [esp], ecx
jmp 0x1059839
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
mov ecx, dword [esp]
add esp, 4
jmp 0x10598d2
jmp 0x10598d7
call 0x10598dc
push dword [esp]
mov eax, dword [esp]
add esp, 4
push ebx
push 0x330512dd
jmp 0x1059952
sub eax, ecx
pop ecx
jmp 0x1059a3f
add ebx, 0x1fff0e38
pop eax
jmp 0x105999f
mov esi, eax
pop eax
jmp 0x10599f2
shr ecx, 3
or ecx, 0x7ddb07a6
add ecx, 0x8000000e
add ebx, ecx
mov ecx, dword [esp]
jmp 0x1059996
mov ebx, 0x7bdf2a3e
xor ebx, 0x7bdf2a3a
add ecx, ebx
pop ebx
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
push ebx
mov dword [esp], eax
mov eax, 4
sub ebx, 0x1fff0e38
add ebx, eax
jmp 0x10598f8
mov dword [esp], esp
add dword [esp], 4
pop ebx
push ecx
push eax
push 0x3b71afb0
mov eax, dword [esp]
jmp 0x10599da
and ecx, 0x7f8a6737
sub ecx, 0x77796c8b
jmp 0x105997a
or ecx, 0x7f679620
jmp 0x105990c
mov ebx, dword [esp]
add esp, 4
add ebx, 4
jmp 0x10599c7
push ecx
push esp
pop ecx
push ebx
jmp 0x1059925
push 0x4568a87
mov dword [esp], ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
push eax
mov dword [esp], ecx
push 0x3b9cc4df
mov dword [esp], esi
push eax
mov eax, 0x2fc
jmp 0x1059904
add ebx, 4
xchg dword [esp], ebx
mov esp, dword [esp]
push 0x2b95c4ac
jmp 0x1059a1b
add esp, 4
add eax, 0x3b61c2b1
mov ecx, eax
mov eax, dword [esp]
add esp, 4
jmp 0x1059969
push 0xf47463b
mov dword [esp], esi
mov ecx, dword [esp]
add esp, 4
push dword [esp]
mov esi, dword [esp]
push ebx
jmp 0x1059a0c
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
jmp 0x1059985
mov dword [esp], ecx
mov ecx, esp
push 0x11824452
mov dword [esp], eax
mov eax, 4
add ecx, eax
pop eax
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0x10598f0
push 0x46811112
mov dword [esp], edi
jmp 0x1059c58
sub esp, 4
mov dword [esp], eax
mov eax, 0x7ffc3f91
jmp 0x1059bee
push dword [esp + 4]
pop edi
pop dword [esp]
jmp 0x1059b39
push dword [esp]
mov edi, dword [esp]
add esp, 4
add esp, 4
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
jmp 0x1059d3f
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
jmp 0x1059b0c
xor ecx, dword [esp]
xor dword [esp], ecx
xor ecx, dword [esp]
pop esp
push esi
push ebp
jmp 0x1059b92
push edi
push dword [esp]
pop esi
add esp, 4
mov edi, dword [esp]
jmp 0x1059af8
pop esp
mov dword [esp], eax
push esi
mov dword [esp], 0x11593add
jmp 0x1059bf4
sub esp, 4
mov dword [esp], ebx
mov dword [esp], 0x1eea6a7c
shl dword [esp], 5
xor dword [esp], 0xa2bb33c4
jmp 0x1059c06
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
jmp 0x1059a4c
mov ebp, 0x3fdc979c
add dword [esp + 4], 0x7eef3b5a
push esi
mov esi, 0x56900fe1
sub dword [esp + 8], esi
jmp 0x1059bba
pop esi
add dword [esp + 4], ebp
add dword [esp + 4], 0x56900fe1
sub dword [esp + 4], 0x7eef3b5a
pop ebp
push dword [esp]
pop ebx
jmp 0x1059c65
push ecx
mov dword [esp], ebx
pop edi
jmp 0x1059b1d
dec eax
jmp 0x1059c6d
mov dword [esp], edi
push 0x316fb5e9
pop edi
xor dword [esp + 4], edi
jmp 0x1059ad8
dec dword [esp]
add dword [esp], 0x7fe7e2a3
push ecx
mov ecx, 0x3fe8f836
and dword [esp + 4], ecx
jmp 0x1059c26
push esi
push edi
jmp 0x1059be4
pop ecx
shl dword [esp], 2
push edi
push ebx
mov ebx, 0x6f674fd9
or ebx, 0x77f6756f
shl ebx, 2
xor ebx, 0x9126686e
mov edi, 0x7defb8c1
neg edi
neg edi
sub edi, 0xf98e887e
add edi, ebx
pop ebx
jmp 0x1059cec
mov edi, esp
add edi, 4
jmp 0x1059a94
push ecx
mov ecx, esp
jmp 0x1059ca7
shr eax, 3
sub eax, 0x3edd1aed
jmp 0x1059c7a
push edi
mov edi, 0xd1226d01
xor eax, edi
jmp 0x1059cdd
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x1059cd1
sub ebx, 0x3fdc979c
pop esi
jmp 0x1059b4a
pop edi
sub edi, eax
mov eax, dword [esp]
add esp, 4
push edi
jmp 0x1059aa4
add dword [esp + 4], 0x7ffb431d
sub dword [esp + 4], edi
sub dword [esp + 4], 0x7ffb431d
pop edi
neg dword [esp]
push edi
push ebp
mov ebp, 0x7ed0ee99
mov edi, 0xa92768ab
add edi, ebp
push dword [esp]
pop ebp
jmp 0x1059b67
push edx
mov edx, 4
add edi, edx
pop edx
xchg dword [esp], edi
mov esp, dword [esp]
jmp 0x1059d53
xor eax, 0x316fb5e9
jmp 0x1059c1f