Function at 0x5eaca5
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push dword [esp]
jmp 0x5e87e3
pop eax
sub esp, 4
jmp 0x5e88f4
xchg dword [esp], ebx
jmp 0x5e88da
mov ebx, dword [esp]
add esp, 4
add eax, edi
pop edi
sub eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
mov dword [esp], ecx
push ebp
mov ebp, 0x33d
mov ecx, ebp
pop ebp
add eax, 0x5bf1c2cb
sub eax, ecx
sub eax, 0x5bf1c2cb
push dword [esp]
jmp 0x5e880c
pop eax
push ebx
mov ebx, esp
add ebx, 4
push ecx
sub esp, 4
mov dword [esp], ebx
push esi
push edi
mov dword [esp], 0x73e51b75
pop esi
xor esi, 0x211ade75
mov ebx, esi
pop esi
jmp 0x5e8815
pop ecx
add esp, 4
jmp 0x5e8919
add ebx, 0x737389ba
jmp 0x5e8886
mov esi, 0x7a6814aa
push ebx
mov ebx, 0x7ffb6a4c
and ebx, 0x753b097d
sub ebx, 0xf95c9e51
or esi, ebx
pop ebx
sub esi, 0x77f5f722
and esi, 0x7dbe4371
add esi, 0x69f3c6d0
xor ebx, esi
pop esi
sub ebx, 1
add ebx, 0x1a3f0b55
sub esp, 4
jmp 0x5e8863
mov dword [esp], ebx
pop ecx
mov ebx, dword [esp]
jmp 0x5e88a1
xchg dword [esp], edx
pop esp
sub ebx, 0x3bbe7286
add ebx, ecx
add ebx, 0x3bbe7286
jmp 0x5e88b5
push ecx
mov ecx, 0x3faf89c9
and ebx, ecx
push dword [esp]
pop ecx
add esp, 4
sub ebx, 0x7de7caf7
push esi
jmp 0x5e8820
push edx
push esp
pop edx
add edx, 4
add edx, 4
jmp 0x5e886f
pop ecx
jmp 0x5e87a4
push 0x7dcbffe0
mov ebx, dword [esp]
add esp, 4
xor ebx, 0x7dcbffe4
push ecx
push 0x3fead001
jmp 0x5e88fd
pop esp
push ebp
mov dword [esp], eax
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
jmp 0x5e8798
mov dword [esp], edi
push ebx
jmp 0x5e88bb
mov dword [esp], ebx
sub dword [esp], 0x77feabde
pop ecx
push edx
mov edx, 0x77feabde
add ecx, edx
pop edx
mov edi, ecx
pop ecx
jmp 0x5e87ac
mov ecx, ebx
jmp 0x5e9a20
sub esp, 4
mov dword [esp], eax
mov dword [esp], edx
jmp 0x5e9e79
mov eax, esp
add eax, 4
add eax, 4
jmp 0x5ea444
add esi, 0xebcf917a
jmp 0x5ed432
add esp, 4
push ecx
mov ecx, esp
push ebx
mov ebx, 4
add ecx, ebx
mov ebx, dword [esp]
jmp 0x5eca32
push edx
mov edx, esp
jmp 0x5ed170
mov esp, dword [esp]
cmp dword [ebp + 0x122d2bff], 0
jne 0x5e9e0e
cmp dword [ebp + 0x122d2c5b], 0
je 0x5e9e1d
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d23a4]
pop eax
push eax
push dword [esp]
pop eax
push ebx
mov dword [esp], ecx
push esp
pop ecx
add ecx, 4
sub esp, 4
mov dword [esp], edx
mov edx, 4
push ebp
push ecx
push esi
mov esi, 0x2fed8e96
mov ecx, esi
jmp 0x5ebe8e
push esp
pop dword [esp]
sub esp, 4
mov dword [esp], edx
jmp 0x5ea408
pop eax
add esp, 4
add eax, 0x73fa5b33
cmp dword [ebp + 0x122d2bff], 0
jne 0x5e9f3d
cmp dword [ebp + 0x122d2c5b], 0
je 0x5e9f4c
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1cc8]
pop eax
cmp dword [ebp + 0x122d2c5b], 0
je 0x5e9f62
push eax
mov eax, 0
call dword [ebp + 0x122d1de4]
pop eax
push 0x75fc3400
mov dword [esp], eax
push esi
mov esi, 0x7dbf0300
jmp 0x5ec2b9
sub edx, 0x1cbfdba4
sub edx, 0x5ef5e4c8
add ebx, edx
jmp 0x5ee2b0
shr dword [esp], 1
shr dword [esp], 6
push ebx
jmp 0x5ee82b
sub dword [esp], 0x6fb70321
mov edi, dword [esp]
add esp, 4
add edi, 0x6fb70321
mov ebx, dword [esp]
push eax
jmp 0x5e9b37
shr esi, 3
or esi, 0x7bf36795
or esi, 0x7ec7d291
jmp 0x5e9c14
push ebx
mov dword [esp], esi
mov esi, 4
mov edx, esi
pop esi
add dword [esp + 4], 0x7dffd104
add dword [esp + 4], 0x6ff7952f
add dword [esp + 4], edx
sub dword [esp + 4], 0x6ff7952f
sub dword [esp + 4], 0x7dffd104
pop edx
push dword [esp]
push dword [esp]
jmp 0x5eac9c
xchg dword [esp], eax
pop esp
jmp 0x5ea44d
mov eax, edi
push dword [esp]
pop edi
jmp 0x5ebb66
add esp, 4
jmp 0x5ee232
mov dword [esp], edx
mov edx, 4
add ebx, edx
pop edx
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
cmp dword [ebp + 0x122d2bff], 0
jne 0x5ea6c8
cmp dword [ebp + 0x122d2c5b], 0
je 0x5ea6d7
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d390e]
pop eax
push ebp
push esp
pop ebp
jmp 0x5edb60
pop esi
push 0x59c3bd01
mov dword [esp], ecx
push ebp
mov ebp, 0x77fd81ec
jmp 0x5ea8ef
mov dword [esp], esi
mov esi, esp
add esi, 4
jmp 0x5ec396
mov ecx, 4
add ebp, ecx
pop ecx
jmp 0x5ec442
mov ecx, ebp
pop ebp
and dword [esp + 4], ecx
push dword [esp]
pop ecx
add esp, 4
jmp 0x5ead3c
sub ebx, esi
pop esi
add esi, ebx
mov ebx, dword [esp]
add esp, 4
jmp 0x5ecdf8
mov dword [esp], 0x11b47300
mov dword [esp], esi
xor dword [esp], 0x7eefbc3b
pop eax
jmp 0x5ec0ae
shl ecx, 5
jmp 0x5eb2c7
mov dword [esp], ebx
sub esp, 4
mov dword [esp], esp
push ecx
mov dword [esp], ebp
mov ebp, 4
add dword [esp + 4], ebp
pop ebp
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
jmp 0x5ee762
mov eax, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push eax
mov eax, esp
jmp 0x5eb77e
push ebp
mov dword [esp], esi
mov esi, 0x365ba22d
add esi, 0xffffffff
jmp 0x5ecdcf
mov ecx, 0x6f7f4dd9
mov esi, 0xed79cc06
sub esi, ecx
jmp 0x5eb500
shr ebx, 3
push ecx
mov ecx, 0x2af3865f
jmp 0x5eb506
shl dword [esp], 5
push ecx
mov ecx, 0x77a0a745
sub dword [esp + 4], ecx
mov ecx, dword [esp]
add esp, 4
push ecx
jmp 0x5ebc9f
add dword [esp + 4], ecx
pop ecx
not dword [esp]
push edi
jmp 0x5eaceb
pop esp
jmp 0x5ee9b6
push dword [esp]
jmp 0x5eb51d
shl dword [esp], 1
shr dword [esp], 5
sub esp, 4
jmp 0x5ecc0a
mov ecx, 4
sub ebp, ecx
jmp 0x5ee7ed
push 0x5bff3e12
mov dword [esp], ecx
jmp 0x5ea6a1
not ecx
not ecx
shl ecx, 3
xor ecx, 0x94325f52
sub ebx, ecx
pop ecx
sub ebx, 0x3442f295
xor ebx, 0x609854d4
add edx, ebx
jmp 0x5ece45
pop ecx
jmp 0x5eed5e
or ecx, 0x579b592a
jmp 0x5eac34
pop eax
push edx
jmp 0x5ee270
push edi
jmp 0x5eab61
add eax, 4
add eax, 4
xor eax, dword [esp]
jmp 0x5ec053
add ebp, 4
xchg dword [esp], ebp
jmp 0x5ede62
push edx
jmp 0x5ed216
push edx
push esp
pop edx
add edx, 4
push ebx
push esi
mov esi, 4
mov ebx, esi
pop esi
add edx, ebx
pop ebx
xchg dword [esp], edx
mov esp, dword [esp]
push 0x3bb732ea
mov dword [esp], eax
push 0x2056ea82
mov dword [esp], esi
mov esi, 0x7dedcce1
sub esi, 1
jmp 0x5ec2b3
mov ecx, 0x5eff5d20
xor dword [esp + 4], ecx
mov ecx, dword [esp]
add esp, 4
shr dword [esp], 1
jmp 0x5eaf77
add edx, 4
push ebx
mov ebx, 0x7d9bcc24
jmp 0x5eed85
pop esi
push ecx
pop ebp
pop ecx
jmp 0x5ecf1f
mov eax, 0x848e86a
jmp 0x5ebafe
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
mov dword [ebp + 0x12451ed6], eax
mov dword [ebp + 0x122d207b], 0
push ecx
mov dword [esp], ebx
jmp 0x5ec31e
push ecx
mov ecx, 0x7eefbc3b
xor eax, ecx
pop ecx
push dword [esp]
mov esi, dword [esp]
add esp, 4
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
jmp 0x5ed3d0
push ebx
jmp 0x5ec6c0
mov dword [esp + 4], esi
jmp 0x5ea718
mov dword [esp], 0x79ff6b97
or dword [esp], 0x66bf28ee
push ecx
mov ecx, 0x7cdd44e5
jmp 0x5eae0f
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
push ebx
mov dword [esp], esi
mov dword [esp], 0x4f8ec400
dec dword [esp]
push esi
push ecx
jmp 0x5ead1d
xchg dword [esp], ebp
pop esp
cmp dword [ebp + 0x122d2bff], 0
jne 0x5ec458
cmp dword [ebp + 0x122d2c5b], 0
je 0x5ec46d
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d26d9], eax
call dword [ebp + 0x122d2855]
pop eax
push ebx
jmp 0x5ed315
push ebx
mov dword [esp], eax
jmp 0x5ebeb6
push edi
mov edi, 0x57bff3bf
jmp 0x5ec6b7
push edx
mov edx, esp
jmp 0x5eec8f
mov dword [esp], ecx
jmp 0x5ed48f
sub esi, 0x7fd7a9b2
jmp 0x5ea3f4
sub dword [esp + 4], esi
pop esi
push dword [esp]
jmp 0x5e9f1f
pop ebx
xchg dword [esp], edx
jmp 0x5e9df9
shl ebp, 4
jmp 0x5ec80f
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push edi
mov dword [esp], eax
jmp 0x5eaf09
mov dword [esp], eax
add dword [esp], 0x77f7ca59
pop ebx
sub ebx, 0x77f7ca59
pop eax
xor ebx, edi
jmp 0x5ed30f
pop edi
jmp 0x5ed841
mov dword [esp], eax
mov eax, esp
push ecx
mov ecx, 0x7bfa644c
shr ecx, 7
jmp 0x5edc6e
add ebp, 4
jmp 0x5eda48
mov edi, esi
pop esi
xor dword [esp + 4], edi
jmp 0x5edb72
mov ecx, 0xacef6c37
sub dword [esp + 4], ecx
jmp 0x5edd97
shl ebx, 3
shr ebx, 4
jmp 0x5ee07f
and ecx, 0x7b5ee358
push edi
mov edi, 0x6d790130
jmp 0x5eea2c
push ecx
jmp 0x5ea84e
add ebp, 4
push ecx
jmp 0x5eaf97
pop edi
sub dword [esp], 0x5bb1f9cf
mov dword [esp], esi
mov esi, eax
jmp 0x5eb697
push esp
pop ebp
add ebp, 4
jmp 0x5eb9e8
dec ecx
xor ecx, 0xf7f4c3
add eax, ecx
pop ecx
sub eax, 4
xchg dword [esp], eax
jmp 0x5ede3b
mov ecx, dword [esp]
jmp 0x5ea54d
pop esp
mov dword [esp], edi
push edx
mov dword [esp], ebp
mov dword [esp], 0x66c92d77
mov dword [esp], ebx
mov ebx, eax
push ebx
jmp 0x5ea0c2
pop esp
add esp, 4
push dword [esp]
push dword [esp]
pop edi
add esp, 4
jmp 0x5e9cbd
push edx
mov edx, 0x6bf275e1
shr edx, 4
not edx
or edx, 0x5ffb35ac
add edx, 1
and edx, 0x7bdfde11
push ebx
mov ebx, 0xc30391af
add edx, ebx
pop ebx
add ebx, edx
pop edx
dec ebx
shr ebx, 6
jmp 0x5ee1e7
sub dword [esp + 4], 0x36ff968a
mov esi, dword [esp]
add esp, 4
jmp 0x5ea066
push esi
mov esi, 0x7f7fb100
inc esi
xor esi, 0x74516c9a
jmp 0x5ea91f
mov dword [esp], eax
mov eax, dword [esp]
add esp, 4
push edx
mov dword [esp], 0x23b03fef
mov dword [esp], ebx
push esp
mov ebx, dword [esp]
add esp, 4
push edx
mov edx, 0x7bb5c070
jmp 0x5e9fc4
mov dword [esp], 0x682fdbc4
mov dword [esp], ebp
jmp 0x5eac57
pop edx
sub ebx, 4
jmp 0x5ee36e
xchg dword [esp], ebx
pop esp
mov dword [esp], esi
mov esi, esp
push ecx
mov ecx, 0x4ffbd101
or ecx, 0x74bf43f7
add ecx, 0xdf137009
inc ecx
jmp 0x5ee57d
shr ecx, 5
push ebx
mov ebx, 0x795cd4f7
jmp 0x5ee6a4
dec ebx
shr ebx, 1
xor ebx, 0x34ff2caa
jmp 0x5ee8a0
push edx
mov edx, 4
add ebp, edx
pop edx
xchg dword [esp], ebp
pop esp
add ebx, 4
jmp 0x5eb091
pop ecx
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
jmp 0x5eae49
mov ebx, 0x94200d09
sub dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
mov dword [esp], eax
mov dword [esp], 0x365f1418
shr dword [esp], 8
add dword [esp], 0x26660276
mov dword [esp], eax
mov eax, dword [esp]
push edx
push esp
pop edx
jmp 0x5ebdcd
not ebx
sub ebx, 0x781fb52e
or ecx, ebx
pop ebx
jmp 0x5ee8f8
add ecx, 0xffffffff
jmp 0x5eda0b
mov dword [esp], eax
push dword [esp]
jmp 0x5eec04
sub edi, 0x6fed7949
shr edi, 2
add edi, 0x1fffe29d
shl edi, 1
add edi, 0xbc98f8e8
sub ecx, edi
pop edi
add esi, ecx
mov ecx, dword [esp]
add esp, 4
push eax
mov eax, 0x6175f3bb
shr eax, 2
neg eax
add eax, 0x4dfedfa9
not eax
shr eax, 8
sub eax, 0xca5e99
sub esi, eax
pop eax
xchg dword [esp], esi
pop esp
mov dword [esp], eax
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
cmp dword [ebp + 0x122d2bff], 0
jne 0x5eea94
cmp dword [ebp + 0x122d2c5b], 0
je 0x5eeaa5
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2a87]
pop ebx
pop eax
push 0x5be41373
mov dword [esp], edi
push 0x3412dd9d
mov dword [esp], ebx
mov ebx, eax
push ebx
xor dword [esp], 0x1f7b80ca
pop edi
xor edi, 0x1f7b80ca
mov ebx, dword [esp]
add esp, 4
jmp 0x5eeaf7
push 0x296ad9d4
mov dword [esp], ebp
mov dword [esp], edi
push dword [esp]
push dword [esp]
pop eax
push ebp
jmp 0x5edbe3
push dword [esp]
mov eax, dword [esp]
jmp 0x5e9c9c
add edx, 4
add edx, 4
push edx
push dword [esp + 4]
pop edx
jmp 0x5eeca8
pop dword [esp]
pop esp
jmp 0x5eed4a
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
sub esp, 4
jmp 0x5ea76e
add dword [esp + 4], 0x36ff968a
add dword [esp + 4], esi
jmp 0x5ee0c8
shl ebx, 4
jmp 0x5eedf6
not ebx
jmp 0x5ead2e