Function at 0x6e22ab
Capabilities:
Check for vm using instruction vpcext
Contain obfuscated stackstrings
Reference the vmware io port

Disassembly:
push dword [esp]
mov eax, dword [esp]
add esp, 4
push 0x4b877e33
mov dword [esp], eax
mov eax, esp
push esi
jmp 0x6de75c
sub esp, 4
mov dword [esp], ebx
jmp 0x6de763
push dword [esp]
pop esi
jmp 0x6de712
add esp, 4
sub eax, edi
jmp 0x6de756
add esi, 4
sub esi, 4
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
mov dword [esp], esi
push edi
mov edi, 0x7ef9b508
mov esi, 0xbceaded6
jmp 0x6de796
pop edi
jmp 0x6de6b5
add edi, 0xa5d766c9
sub eax, edi
jmp 0x6de6ee
push ebp
mov ebp, 0x7ffb642a
and ebp, 0x7f754238
jmp 0x6de7f2
add esp, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
push esi
mov dword [esp], edi
mov edi, 0x37da1778
push eax
jmp 0x6de72f
mov eax, 1
sub edi, eax
pop eax
xchg edi, ecx
not ecx
xor edi, ecx
xor ecx, edi
xor edi, ecx
push 0x7da9e7c2
mov dword [esp], eax
mov eax, 0x6ffe4fef
shl eax, 1
jmp 0x6de6aa
pop edi
jmp 0x6de855
mov esi, esp
jmp 0x6de6c8
mov ebx, 0x57dd7b0c
sub eax, 0x7f7fcd3c
push ebp
mov ebp, 0x3a4fe7c0
add eax, ebp
jmp 0x6de826
sub edi, 0x7c8f8113
add edi, eax
add edi, 0x7c8f8113
push dword [esp]
mov eax, dword [esp]
add esp, 4
jmp 0x6de6be
sub esi, edi
pop edi
push edi
mov edi, 0x7dd94748
xor esi, edi
pop edi
push edx
jmp 0x6de7b3
or ebp, 0x5fe73ca7
jmp 0x6de80f
mov edx, 0x2fa7ce77
xor edx, 0x7ffd9bf9
jmp 0x6de7c3
or edx, 0x53eef812
jmp 0x6de7de
mov ecx, 0x27c78396
add eax, ecx
pop ecx
add eax, esi
push edi
jmp 0x6de701
sub edx, 0x13d68f1c
xor esi, edx
pop edx
jmp 0x6de7ec
push ecx
jmp 0x6de7ce
sub ebp, 0x5fe787ef
inc ebp
jmp 0x6de7a8
or edi, 0x4dfe17ca
xor edi, 0x17ee29c0
jmp 0x6de847
or ebp, 0x7ffea169
push ebx
mov ebx, 0x10dced
xor ebp, ebx
pop ebx
mov edi, ebp
pop ebp
jmp 0x6de7fe
pop ebp
add eax, ebx
sub eax, 0x3a4fe7c0
push ecx
mov ecx, 0x7f7fcd3c
sub eax, 0x7f7f912d
add eax, ecx
add eax, 0x7f7f912d
pop ecx
pop ebx
jmp 0x6de77a
shr edi, 7
sub edi, 0x7ee005ef
jmp 0x6de6f4
mov ecx, ebx
jmp 0x6df95c
push eax
push esp
pop dword [esp]
jmp 0x6e211b
push ebx
mov ebx, 4
mov esi, ebx
mov ebx, dword [esp]
add esp, 4
add ebx, 0x5f9ff234
sub ebx, esi
jmp 0x6e3fa0
add esp, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
jmp 0x6dfc76
sub eax, 4
jmp 0x6e365a
mov dword [esp], ecx
mov dword [esp], 0xb6371d8
jmp 0x6e0900
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
jmp 0x6e172b
push esp
mov ebp, dword [esp]
add esp, 4
jmp 0x6e1c5c
sub ecx, 0x7f4fe85d
add ecx, esi
jmp 0x6e0147
push edx
mov edx, 4
jmp 0x6e0d44
add ecx, 0x7f4fe85d
pop esi
xor eax, ecx
pop ecx
sub esp, 4
mov dword [esp], eax
jmp 0x6e026a
mov dword [esp], edx
mov edx, 0x8fddfefa
push ebx
mov ebx, 0x5dfe0417
neg ebx
jmp 0x6e068d
push esi
mov esi, 0x76bb19e2
and esi, 0x7e6594cb
xor esi, 0x762110c6
add eax, esi
pop esi
push eax
jmp 0x6e357f
sub esp, 4
mov dword [esp], ebp
push 0x4ef7c978
push dword [esp]
jmp 0x6e1a65
add edi, 0x6ffb79c4
push ecx
push eax
jmp 0x6e45f6
push ecx
jmp 0x6e28d4
sub ebx, 0x521673b5
sub edi, ebx
jmp 0x6e4dd2
pop ecx
sub ecx, edi
pop edi
add eax, 0x7f7ddd52
add eax, ecx
sub eax, 0x7f7ddd52
pop ecx
push edi
jmp 0x6e0d80
xchg dword [esp], esi
pop esp
jmp 0x6e4f04
mov esi, 0x4ef7c978
jmp 0x6e0e66
mov ecx, 0x7fffa956
sub dword [esp + 4], ecx
jmp 0x6e1a56
mov dword [esp], eax
push edx
jmp 0x6e0fd5
and edi, ecx
pop ecx
add edi, 0xb2c8bec4
sub esi, 0x6ff9cf12
add esi, edi
add esi, 0x6ff9cf12
mov edi, dword [esp]
add esp, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
jmp 0x6e4cbe
add esi, edx
pop edx
push edi
mov edi, 0x7bbf8101
and edi, 0x5fe78aea
shr edi, 2
jmp 0x6e2b3a
mov edi, esp
jmp 0x6e0e8d
sub ecx, eax
jmp 0x6e1d2f
add eax, 0x5fcc0fab
sub eax, esi
jmp 0x6e4398
push esi
jmp 0x6e0ecc
mov esi, 0x3faf4063
jmp 0x6e15a3
mov dword [esp], ecx
jmp 0x6e08f2
mov dword [esp], eax
mov eax, esp
jmp 0x6e0549
add ecx, 0x4184699f
mov edi, ecx
jmp 0x6e07b7
xchg dword [esp], edx
pop esp
cmp dword [ebp + 0x122d2c02], 0
jne 0x6e1259
cmp dword [ebp + 0x122d2c8e], 0
je 0x6e1268
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d2424]
pop eax
push edi
mov dword [esp], 0x37efbf70
dec dword [esp]
neg dword [esp]
and dword [esp], 0x7c6cabe0
add dword [esp], 0x134a28e7
mov dword [esp], ebp
mov dword [esp], ebx
push 0x695aede1
mov dword [esp], esp
add dword [esp], 4
pop ebx
add ebx, 4
jmp 0x6e42a0
or ecx, ebx
mov ebx, dword [esp]
jmp 0x6e1a29
xor esi, 0x7fffccef
sub esi, 0x40508c88
jmp 0x6e16e2
mov esi, esp
jmp 0x6e3b3b
add edi, esi
pop esi
sub edi, 4
xchg dword [esp], edi
pop esp
jmp 0x6e10a6
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
mov eax, dword [esp]
push esi
mov dword [esp], ebx
mov ebx, esp
jmp 0x6e23fb
add edx, 4
sub edx, 4
xchg dword [esp], edx
jmp 0x6e2299
add esp, 4
sub esp, 4
mov dword [esp], edi
push ecx
push edx
mov dword [esp], 0x3a7ba506
mov ecx, dword [esp]
add esp, 4
jmp 0x6e10f9
pop ecx
jmp 0x6e20e4
pop ebp
add esp, 4
jmp 0x6e22fa
push edi
push edx
mov edx, 0x6bb7f6fa
jmp 0x6e2806
pop eax
and ecx, 0x2bff13a3
push ebp
mov ebp, 0x77b1ee69
sub ebp, 0x14b370bf
xor ecx, ebp
pop ebp
jmp 0x6e2526
push dword [esp]
pop eax
add esp, 4
push ecx
mov ecx, 0x725e0025
shl ecx, 4
shl ecx, 2
push esi
mov dword [esp], 0x6d5e3026
mov dword [esp], ebp
mov ebp, 0x7fdad215
or ecx, ebp
pop ebp
xor ecx, 0x3c8b78ac
push ebx
mov ebx, 0x3bfeb6fa
jmp 0x6e155f
push eax
push ebx
mov dword [esp], 4
pop eax
sub dword [esp + 4], 0x7efaf617
jmp 0x6e24ad
pop esp
mov dword [esp], esp
push esi
mov esi, 4
add dword [esp + 4], esi
pop esi
mov eax, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
jmp 0x6e2bb5
sub dword [esp + 4], 0x78f12186
add dword [esp + 4], ebp
push esi
mov esi, 0x78f12186
add dword [esp + 8], esi
pop esi
jmp 0x6e292d
push 0x7d1e8e65
pop esi
dec esi
push esi
jmp 0x6e4271
or ebx, 0x737e7dd7
sub ebx, 0xfbff7fd3
add edi, ebx
pop ebx
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], esi
jmp 0x6e08a7
push edx
mov edx, 0x640fb0ae
push eax
jmp 0x6e2ca6
add dword [esp + 4], eax
jmp 0x6e24f5
add dword [esp + 4], 0x7efaf617
mov eax, dword [esp]
jmp 0x6dff55
push esi
mov esi, 0x132a8c8b
jmp 0x6dffe5
push edx
xor dword [esp], 0x7fdf21a9
pop edi
jmp 0x6e2a6a
mov ecx, 4
add eax, ecx
pop ecx
sub eax, 4
push eax
push dword [esp + 4]
jmp 0x6e2b20
pop ebp
push dword [esp]
mov eax, dword [esp]
jmp 0x6e3476
xor edi, 0x7fdf21a9
jmp 0x6e4383
add edi, 4
xchg dword [esp], edi
jmp 0x6e4c85
pop eax
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], ebp
push eax
pop ebp
push 0x38a34757
mov dword [esp], ebp
pop eax
jmp 0x6e2c05
shl edi, 5
jmp 0x6e04ed
pop esp
jmp 0x6e0241
push dword [esp]
pop ebp
push 0x2f42812a
mov dword [esp], esi
jmp 0x6e15b4
mov eax, 0xfd63a8c
not eax
sub eax, 0x5fde2215
jmp 0x6e3c9f
add esp, 4
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
mov dword [esp], eax
pop eax
cmp dword [ebp + 0x122d2c02], 0
jne 0x6e3190
cmp dword [ebp + 0x122d2c8e], 0
je 0x6e31a5
push eax
mov eax, eax
mov eax, 0x43d
mov dword [ebp + 0x122d2492], eax
call dword [ebp + 0x122d215c]
pop eax
push 0x19e4a184
jmp 0x6e42b0
add esp, 4
jmp 0x6e3a14
mov eax, esp
add eax, 4
jmp 0x6dfcba
xchg dword [esp], eax
pop esp
mov dword [esp], esi
jmp 0x6e3e6e
add esp, 4
push 0x6e237fa1
mov dword [esp], edi
mov edi, esp
push ebx
mov ebx, 0x6fbd5775
shl ebx, 4
jmp 0x6e23a7
add esi, 4
jmp 0x6e41e2
add ebp, ecx
pop ecx
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
cmp dword [ebp + 0x122d2c02], 0
jne 0x6e3c19
cmp dword [ebp + 0x122d2c8e], 0
je 0x6e3c28
push eax
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1cb7]
pop eax
cmp dword [ebp + 0x122d2c8e], 0
je 0x6e3c3e
push eax
mov eax, 0
call dword [ebp + 0x122d33e1]
pop eax
sub esp, 4
jmp 0x6dff2d
xor eax, 0xed96f9f5
and edx, eax
pop eax
push 0
sub dword [esp], edx
pop edx
and edx, 0x736f5512
sub edx, 0x7fbeb8e6
add edx, 0x573bf5e5
push edi
mov dword [esp], ebx
mov ebx, 0xeadf8215
xor edx, ebx
pop ebx
add ebx, edx
pop edx
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
jmp 0x6e4032
push dword [esp]
pop edx
push edi
mov edi, esp
add edi, 4
jmp 0x6e2b09
push ebx
mov ebx, 0x7ada4eac
add ebx, 0x8525b158
mov esi, ebx
mov ebx, dword [esp]
add esp, 4
sub eax, esi
mov esi, dword [esp]
jmp 0x6e3168
sub ebx, 0x5f9ff234
push dword [esp]
pop esi
jmp 0x6dfb67
pop eax
xor esi, 0xc2b8c608
mov ecx, esi
pop esi
jmp 0x6e4b78
mov esi, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
jmp 0x6e1243
mov esp, dword [esp]
mov dword [ebp + 0x122d3499], eax
mov dword [ebp + 0x122d2413], 0
push esi
mov dword [esp], 0x5d7dda20
mov dword [esp], eax
push edx
mov edx, esp
jmp 0x6e17ea
push ecx
push esi
jmp 0x6e2316
not dword [esp]
pop esi
push eax
jmp 0x6e48a1
push edi
mov dword [esp], 0x26582837
mov dword [esp], esi
jmp 0x6df966
mov dword [esp], esi
push eax
pop esi
push esi
push esi
mov esi, 0x2ffbba00
sub dword [esp + 4], esi
pop esi
pop eax
push edi
push ebx
mov ebx, 0x2ffbba00
mov edi, ebx
pop ebx
add eax, edi
pop edi
mov esi, dword [esp]
jmp 0x6e49c9
pop edx
shl edi, 1
shl edi, 2
shr edi, 7
add edi, 0x6fe781bc
jmp 0x6e477a
sub eax, 0x5fcc0fab
jmp 0x6e401e
push 0x7fdf0e00
mov eax, dword [esp]
add esp, 4
shr eax, 1
add eax, 0x3fcf7a12
mov ecx, eax
pop eax
sub ecx, 0xffc739d1
jmp 0x6e0977
and edi, 0x7f3ac75a
push 0x9d3979f
jmp 0x6e022c
mov eax, 0x74dd9cd1
and eax, 0x3fad3695
and eax, 0x56ff3a53
add eax, 0x2b4a4460
add esi, eax
jmp 0x6e3fce
push esi
push esp
pop esi
jmp 0x6e010c
add esi, ecx
jmp 0x6e4c9f
pop esp
mov eax, dword [esp]
jmp 0x6e503c
pop ecx
jmp 0x6e0874
mov esp, dword [esp]
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], edi
mov edi, eax
jmp 0x6e4cea
mov eax, edi
jmp 0x6e4d7d
mov edi, dword [esp]
push ebp
jmp 0x6dff62
pop ebx
add edi, edx
add edi, 0x4feb8834
pop edx
add ebp, edi
pop edi
sub esp, 4
mov dword [esp], ecx
mov ecx, 0x76ba9f9c
or ecx, 0x571f324c
push ebp
mov ebp, 0x77bfbfd8
sub ecx, ebp
pop ebp
jmp 0x6e3bf8
cmp dword [ebp + 0x122d2c02], 0
jne 0x6e4f16
cmp dword [ebp + 0x122d2c8e], 0
je 0x6e4f27
push eax
push ebx
mov eax, eax
mov eax, 0
call dword [ebp + 0x122d1c97]
pop ebx
pop eax
push eax
mov dword [esp], edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
mov dword [esp], eax
push edx
mov dword [esp], 0x54e2a83e
mov dword [esp], edx
jmp 0x6e4fe9
push eax
mov eax, 0x7e98b28c
mov edx, 0x34248bf
xor edx, eax
pop eax
xor dword [esp + 4], edx
jmp 0x6e3d3d
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push ecx
mov ecx, 0x4293b354
add ecx, 0x19bb24ac
inc ecx
push eax
mov eax, 0xffffffff
jmp 0x6e0dfb