Function at 0x30023af0
Capabilities:
Accept command line arguments
Access peb ldr_data
Create thread
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x3021be88]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
pushfd
mov eax, dword fs:[0x18]
pop ecx
mov dword [esp + 0x20], ecx
test eax, eax
jne 0x30023b2f
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
jmp 0x30023b40
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
cmp dword [ebp + 0xc], 1
jne 0x300243b2
push str.KiUserExceptionDispatcher
push 0x301e7978
mov dword [esp + 0x3c], 0x80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov edi, eax
xor esi, esi
cmp byte [edi], 0xe8
je 0x30023b86
mov ecx, edi
call fcn.300294e0
add esi, eax
cmp byte [esi + edi], 0xe8
lea ecx, [esi + edi]
jne 0x30023b76
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xe9
je 0x30023bc4
cmp al, 0xe8
je 0x30023bc4
cmp al, 0xf
jne 0x30023ba9
mov al, byte [ecx + 1]
add al, 0x80
cmp al, 0xf
ja 0x30023ba9
mov eax, dword [ecx + 2]
add ecx, 6
jmp 0x30023bca
push 0x254
push str.d:workcapecapemoncapemon16hooking_32.c
push 0x301fefa0
call fcn.3016c8c9
add esp, 0xc
xor ecx, ecx
jmp 0x30023bcc
mov eax, dword [ecx + 1]
add ecx, 5
add ecx, eax
cmp dword [ecx], 0x25ffff8b
je 0x300243f6
mov eax, 0x25ff
cmp word [ecx], ax
je 0x300243f6
cmp word [ecx], 0xff8b
jne 0x30023bf7
cmp byte [ecx + 2], 0xe9
je 0x300243f6
cmp byte [ecx], 0xe9
je 0x300243f6
mov eax, 0xf9eb
cmp word [ecx], ax
je 0x300243f6
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x301e7978
mov dword [0x3026d3e4], esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x50]
mov dword [0x3026d3ec], eax
call edi
push 0x30272460
mov dword [0x3026d3d8], eax
mov dword [0x30272460], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x301e7978
call edi
mov edi, eax
test edi, edi
je 0x30023d5d
push str.NtDelayExecution
push edi
call ebx
push str.NtQuerySystemInformation
push edi
mov dword [0x30246774], eax
call ebx
push str.NtQueryInformationProcess
push edi
mov dword [0x30246770], eax
call ebx
push str.NtSetInformationProcess
push edi
mov dword [0x302466f4], eax
call ebx
push str.NtQueryInformationThread
push edi
mov dword [0x3027323c], eax
call ebx
push str.NtQueryObject
push edi
mov dword [0x30246600], eax
call ebx
push str.NtQueryKey
push edi
mov dword [0x30246604], eax
call ebx
push str.NtQueryAttributesFile
push edi
mov dword [0x302466f0], eax
call ebx
push str.NtAllocateVirtualMemory
push edi
mov dword [0x302465f8], eax
call ebx
push str.NtProtectVirtualMemory
push edi
mov dword [0x30273234], eax
call ebx
push str.NtFreeVirtualMemory
push edi
mov dword [0x30273218], eax
call ebx
push str.LdrRegisterDllNotification
push edi
mov dword [0x30273238], eax
call ebx
push str.SystemFunction036
push str.advapi32
mov dword [0x30273228], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
push str.NtMapViewOfSection
push edi
mov dword [0x30246768], eax
call ebx
push str.RtlEqualUnicodeString
push edi
mov dword [0x30273214], eax
call ebx
push str.NtUnmapViewOfSection
push edi
mov dword [0x302465fc], eax
call ebx
push str.RtlAdjustPrivilege
push edi
mov dword [0x30273210], eax
call ebx
push str.RtlNtStatusToDosError
push edi
mov dword [0x3027321c], eax
call ebx
push str.RtlCompareMemory
push edi
mov dword [0x30273240], eax
call ebx
mov dword [0x3026d3f0], eax
push 0
push 0x400000
push 0
mov dword [fcn.301698df], 0x300239d0
mov dword [fcn.3016f85c], 0x30023a30
mov dword [fcn.301698c4], 0x30023a90
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x301fe82c
push 0x301fe83c
mov dword [0x30272510], eax
mov dword [0x302724f4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
test edi, edi
je 0x30023dc2
push 0x302724f4
call ebx
push eax
call edi
call fcn.3004df80
mov dword [0x3026e7d4], 0
mov dword [0x3026e7d8], 0
call fcn.30023830
call fcn.30023660
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [0x30270314], 0
mov dword [0x30272500], eax
je 0x30023e10
call fcn.30005bf0
push str.Standalone_mode_initialised._n
call fcn.30009b40
add esp, 4
jmp 0x300243da
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x3026d740
call edi
push 0x3026d760
call edi
call fcn.30021dc0
test eax, eax
je 0x300243f6
mov ecx, 0x3026ef5c
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30023e40
sub ecx, edx
sar ecx, 1
je 0x30023e75
push ecx
push 0x3026ef5c
push dword [0x30272508]
call fcn.3016b3a4
add esp, 0xc
test eax, eax
jne 0x30023e75
cmp dword [0x3026f890], eax
je 0x300243f6
cmp dword [0x3026f8bc], 0
je 0x30023ead
push fcn.30023160
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push fcn.30023160
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 3
push 0
call fcn.3016c14a
add esp, 8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x30023f0f
nop
cmp dword [edx + 0x18], esi
je 0x30023ecd
mov edx, dword [edx]
cmp edx, eax
jne 0x30023ec0
jmp 0x30023f0f
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
push str.GETPIDS:
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.3004f7c0
mov edx, dword [esp + 0x40]
add esp, 0xc
shr edx, 2
test edx, edx
je 0x30023f4c
mov eax, dword [0x3024639c]
lea esi, [esp + 0x60]
mov ecx, edx
lea edi, [eax*4 + 0x302463a0]
add eax, edx
rep movsd dword es:[edi], dword [esi]
mov dword [0x3024639c], eax
lea eax, [esp + 0x10]
push eax
push 0x18
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x30023fbc
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 1
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x30023fb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x30023fb2
mov ecx, dword [esp + 0x18]
call fcn.30001150
mov esi, eax
test esi, esi
je 0x30023fb2
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push esi
push 1
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x30024002
mov ecx, esi
call fcn.300011f0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push str.REGISTRYUSER_
mov edi, eax
call esi
add edi, eax
mov dword [0x30273224], edi
lea ecx, [edi*2 + 2]
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30024010
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30024019
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
jmp 0x30023fbe
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push ecx
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x30024042
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30024042
push ebx
popfd
mov ecx, 8
mov dword [0x30273220], eax
mov esi, str.REGISTRYUSER_
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x1c]
mov esi, edx
jmp 0x30024060
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x30024060
mov edi, dword [0x30273220]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x30024076
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x30270338], 0
jne 0x300240c3
cmp dword [0x3026f8bc], 0
jne 0x300240b9
cmp dword [0x30270314], 0
jne 0x300240b9
xor ecx, ecx
jmp 0x300240be
mov ecx, 1
call fcn.3004ac50
mov esi, dword [0x3026f890]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x3c]
mov dword [0x30246184], eax
mov eax, dword [esp + 0x38]
mov dword [0x30246180], eax
test esi, esi
jne 0x3002410e
cmp dword [0x302350a0], esi
je 0x3002410e
cmp dword [0x3026f8b4], 1
jge 0x3002410e
push str.INFO:Disabling_sleep_skipping.
call fcn.3004f500
add esp, 4
mov dword [0x302350a0], esi
mov eax, dword [0x3026f89c]
mov ecx, 0x2710
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3026d3c4
push 0
mul ecx
push 0
add dword [0x3026e7a8], eax
push 0x3004faa0
adc dword [0x3026e7ac], edx
push 0
push 0
call edi
push 0x3026d3c8
push 0
push 0
push 0x3004fdf0
push 0
push 0
mov dword [0x302467ec], eax
call edi
cmp dword [0x302467ec], 0
mov dword [0x3026d100], eax
je 0x3002416b
test eax, eax
jne 0x30024178
push str.CRITICAL:Error_initializing_unhook_detection_threads_
call fcn.3004f500
add esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
movzx eax, word [esi + 0x2e]
mov word [0x3026d0ea], ax
movzx eax, word [esi + 0x2c]
mov word [0x3026d0e8], ax
movzx ecx, word [esi + 0x2e]
pushfd
mov eax, dword fs:[0x18]
pop dword [esp + 0x2c]
test eax, eax
jne 0x300241b8
or ebx, 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x300241c5
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x14], eax
push ecx
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [esp + 0x30], eax
test ecx, ecx
je 0x300241fa
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0xbf4], edx
test eax, eax
je 0x300241fa
push eax
popfd
movzx eax, word [0x3026d0e8]
mov ecx, dword [esp + 0x30]
push eax
mov dword [0x3026d0ec], ecx
push dword [esi + 0x30]
push ecx
call fcn.301619b0
movzx eax, word [esi + 0x26]
add esp, 0xc
mov word [0x3026d0f6], ax
movzx eax, word [esi + 0x24]
mov word [0x3026d0f4], ax
movzx ecx, word [esi + 0x26]
pushfd
mov eax, dword fs:[0x18]
pop dword [esp + 0x30]
test eax, eax
jne 0x3002424c
or ebx, 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x30024259
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x14], eax
push ecx
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [esp + 0x2c], eax
test ecx, ecx
je 0x3002428e
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0xbf4], edx
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x3002428e
push ecx
popfd
mov dword [0x3026d0f8], eax
movzx eax, word [0x3026d0f4]
push eax
push dword [esi + 0x28]
push dword [esp + 0x34]
call fcn.301619b0
add esp, 0xc
push 0x3026d3d4
push 0
push 0
push 0x3004fff0
push 0
push 0
call edi
mov dword [0x3026d0e0], eax
test eax, eax
jne 0x300242d4
push str.CRITICAL:Error_initializing_procname_watch_thread_
call fcn.3004f500
add esp, 4
push 1
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x3026f78c
lea eax, [esp + 0x50]
mov dword [esp + 0x44], 0xc
push 0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push 0
push eax
mov dword [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x3026d3cc
push 0
push 0
push 0x3004fe70
push 0
push 0
mov dword [0x3026d3c0], eax
call edi
cmp dword [0x3026d3c0], 0
mov dword [0x3026d0f0], eax
je 0x30024349
test eax, eax
jne 0x30024356
push str.CRITICAL:Error_initializing_terminate_event_thread_
call fcn.3004f500
add esp, 4
push 0x3026e7e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.30005bf0
call fcn.3004c580
call fcn.3002ab30
call fcn.300059d0
cmp dword [0x3026f898], 0
jne 0x30024391
mov eax, dword fs:[0x30]
cmp dword [eax + 0x64], 1
jne 0x30024391
mov dword [eax + 0x64], 2
cmp dword [0x30270338], 0
jne 0x300243ae
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.LOADED:_d
call fcn.3004f500
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword fs:[0x18]
mov byte [0x3027245c], 1
test eax, eax
je 0x300243da
mov edx, dword [esp + 0x24]
mov dword [eax + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xbf4], edx
test ecx, ecx
je 0x300243da
push ecx
popfd
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002441b
mov edx, dword [esp + 0x24]
mov dword [eax + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xbf4], edx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x3002441b
push eax
popfd
mov ecx, dword [esp + 0xe4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret 0xc