Function at 0x30029df0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 4], ebx
cmp dword [ebx + 0x34], 0
mov dword [ebp - 0x10], 0
jne 0x3002a9ad
xor esi, esi
mov eax, dword [esi + 0x3026e81c]
test eax, eax
je 0x30029e3d
push eax
push dword [ebx + 4]
call fcn.30168730
add esp, 8
test eax, eax
je 0x3002a9ad
add esi, 4
cmp esi, 0x200
jb 0x30029e14
xor esi, esi
nop
mov eax, dword [esi + 0x3026ea1c]
test eax, eax
je 0x30029e68
push eax
push dword [ebx]
call fcn.301685b5
add esp, 8
test eax, eax
je 0x3002a9ad
add esi, 4
cmp esi, 0x200
jb 0x30029e40
mov esi, dword [ebx + 8]
test esi, esi
jne 0x3002a498
mov eax, dword [ebx]
test eax, eax
je 0x3002a9ad
cmp dword [ebx + 4], esi
je 0x3002a9ad
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x3002a9ad
mov edi, dword [ebx + 4]
mov edx, str.RtlDispatchException
mov ecx, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x30029ec4
test al, al
je 0x30029ec0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x30029ec4
add ecx, 2
add edx, 2
test al, al
jne 0x30029ea4
xor eax, eax
jmp 0x30029ec9
sbb eax, eax
or eax, 1
test eax, eax
jne 0x30029f03
push str.KiUserExceptionDispatcher
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor esi, esi
cmp byte [edi], 0xe8
je 0x30029ef4
mov ecx, edi
call fcn.30029510
add esi, eax
cmp byte [esi + edi], 0xe8
lea ecx, [esi + edi]
jne 0x30029ee4
lea ecx, [esi + edi]
call fcn.30029da0
mov esi, eax
jmp 0x3002a46c
mov ecx, str.ConnectEx
mov eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x30029f30
test dl, dl
je 0x30029f2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x30029f30
add eax, 2
add ecx, 2
test dl, dl
jne 0x30029f10
xor eax, eax
jmp 0x30029f35
sbb eax, eax
or eax, 1
test eax, eax
jne 0x30029f83
lea eax, [ebp - 0x24]
mov edx, 0x30207414
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.3004d210
add esp, 8
test eax, eax
jne 0x30029f5b
xor esi, esi
jmp 0x3002a46c
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
push 0x10
push 0x3020741c
call fcn.3004d190
add esp, 8
test eax, eax
jne 0x30029f7b
xor esi, esi
jmp 0x3002a46c
mov esi, dword [eax + 0x10]
jmp 0x3002a46c
mov esi, dword [ebx]
mov ecx, str.kernel32
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x30029fb6
test dx, dx
je 0x30029fb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x30029fb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x30029f90
xor eax, eax
jmp 0x30029fbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a028
mov ecx, str.MoveFileWithProgressTransactedW
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x30029fe6
test dl, dl
je 0x30029fe2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x30029fe6
add eax, 2
add ecx, 2
test dl, dl
jne 0x30029fc6
xor eax, eax
jmp 0x30029feb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a028
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MoveFileWithProgressW
push edi
call esi
cmp byte [eax + 0x16], 0xe8
lea ecx, [eax + 0x16]
jne 0x3002a01b
cmp byte [eax + 0x1c], 0xc2
jne 0x3002a01b
call fcn.30029da0
mov esi, eax
jmp 0x3002a46c
push dword [ebx + 4]
push edi
call esi
mov esi, eax
jmp 0x3002a46c
mov ecx, str.JsEval
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a050
test dl, dl
je 0x3002a04c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a050
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a030
xor eax, eax
jmp 0x3002a055
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a106
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.3004d210
add esp, 8
test eax, eax
jne 0x3002a083
xor esi, esi
jmp 0x3002a46c
mov esi, dword [ebp - 0x2c]
mov edx, esi
mov edi, dword [ebp - 0x30]
mov ecx, edi
push 0x14
push str.eval_code
call fcn.3004d190
mov edx, eax
add esp, 8
test edx, edx
jne 0x3002a0a9
xor esi, esi
jmp 0x3002a46c
mov eax, edi
lea ecx, [esi - 5]
cmp eax, ecx
jae 0x30029f54
cmp byte [eax], 0x68
jne 0x3002a0c0
cmp dword [eax + 1], edx
je 0x3002a0cc
inc eax
cmp eax, ecx
jb 0x3002a0b6
xor esi, esi
jmp 0x3002a46c
lea esi, [eax - 5]
lea ecx, [eax - 0x1000]
cmp esi, ecx
jbe 0x30029f54
lea ecx, [ecx]
cmp esi, edi
jb 0x30029f54
cmp dword [esi], 0x8b55ff8b
jne 0x3002a0fa
cmp byte [esi + 4], 0xec
je 0x3002a46c
dec esi
cmp esi, ecx
ja 0x3002a0e0
xor esi, esi
jmp 0x3002a46c
mov ecx, str.COleScript_ParseScriptText
mov eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a130
test dl, dl
je 0x3002a12c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a130
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a110
xor eax, eax
jmp 0x3002a135
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a268
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.3004d210
add esp, 8
test eax, eax
jne 0x3002a163
xor esi, esi
jmp 0x3002a46c
mov esi, dword [ebp - 0x34]
mov edx, esi
mov edi, dword [ebp - 0x38]
mov ecx, edi
push 0x1a
push str.script_block
call fcn.3004d190
mov edx, eax
add esp, 8
test edx, edx
jne 0x3002a189
xor esi, esi
jmp 0x3002a46c
mov ecx, edi
add esi, 0xfffffffb
cmp ecx, esi
jae 0x3002a1a1
cmp byte [ecx], 0x68
jne 0x3002a19c
cmp dword [ecx + 1], edx
je 0x3002a1c9
inc ecx
cmp ecx, esi
jb 0x3002a192
mov ecx, edi
cmp ecx, esi
jae 0x30029f54
jmp 0x3002a1b0
mov al, byte [ecx]
and al, 0xf8
cmp al, 0xb8
jne 0x3002a1bd
cmp dword [ecx + 1], edx
je 0x3002a1c9
inc ecx
cmp ecx, esi
jb 0x3002a1b0
xor esi, esi
jmp 0x3002a46c
lea edx, [ecx - 5]
add ecx, 0xfffff000
cmp edx, ecx
jbe 0x30029f54
lea ebx, [ebx]
cmp edx, edi
jb 0x30029f54
cmp dword [edx], 0x8b55ff8b
jne 0x3002a1f6
cmp byte [edx + 4], 0xec
je 0x3002a202
dec edx
cmp edx, ecx
ja 0x3002a1e0
xor esi, esi
jmp 0x3002a46c
test edx, edx
je 0x30029f54
mov ecx, edi
cmp ecx, esi
jae 0x30029f54
cmp byte [ecx], 0xe8
jne 0x3002a225
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
cmp eax, edx
je 0x3002a231
inc ecx
cmp ecx, esi
jb 0x3002a214
xor esi, esi
jmp 0x3002a46c
lea esi, [ecx - 5]
add ecx, 0xfffff000
cmp esi, ecx
jbe 0x30029f54
cmp esi, edi
jb 0x30029f54
cmp dword [esi], 0x8b55ff8b
jne 0x3002a25c
cmp byte [esi + 4], 0xec
je 0x3002a46c
dec esi
cmp esi, ecx
ja 0x3002a242
xor esi, esi
jmp 0x3002a46c
mov ecx, str.CDocument_write
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a290
test dl, dl
je 0x3002a28c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a290
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a270
xor eax, eax
jmp 0x3002a295
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a3ab
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.3004d210
add esp, 8
test eax, eax
jne 0x3002a2c3
xor esi, esi
jmp 0x3002a46c
mov ebx, dword [ebp - 0x3c]
mov edx, ebx
mov esi, dword [ebp - 0x14]
mov ecx, esi
push 6
push 0x30207470
call fcn.3004d190
mov edx, eax
add esp, 8
mov dword [ebp - 0x3c], edx
test edx, edx
jne 0x3002a2ef
xor esi, esi
mov ebx, dword [ebp - 4]
jmp 0x3002a46c
lea ecx, [ebx - 0xa]
mov dword [ebp - 0x18], esi
cmp esi, ecx
jae 0x3002a2e5
lea ecx, [esi + 0xa]
mov dword [ebp - 0x1c], ecx
lea eax, [ebx - 0xa]
cmp byte [esi], 0x68
jne 0x3002a391
cmp dword [ecx - 9], edx
jne 0x3002a391
cmp byte [ecx - 5], 0xe8
jne 0x3002a391
lea eax, [ecx + 0x76]
mov edi, ecx
cmp ecx, eax
jae 0x3002a38e
cmp word [edi], 0x8c2
jne 0x3002a383
movzx eax, byte [edi + 2]
test al, al
jne 0x3002a383
lea edx, [ecx - 0x8a]
cmp esi, edx
jbe 0x3002a383
lea eax, [ecx - 0xd]
nop
cmp byte [eax + 3], 0xe8
jne 0x3002a375
lea esi, [eax + 8]
add esi, dword [eax + 4]
cmp esi, dword [ebp - 0x14]
jbe 0x3002a375
cmp esi, ebx
jae 0x3002a375
cmp byte [eax], 0xff
jne 0x3002a366
cmp byte [eax + 1], 0x75
jne 0x3002a366
cmp byte [eax + 2], 0x20
jb 0x3002a2e7
mov cl, byte [eax + 2]
and cl, 0xf8
cmp cl, 0x50
je 0x3002a2e7
dec eax
lea ecx, [eax + 3]
cmp ecx, edx
ja 0x3002a340
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
inc edi
lea eax, [ecx + 0x76]
cmp edi, eax
jb 0x3002a323
mov edx, dword [ebp - 0x3c]
lea eax, [ebx - 0xa]
inc esi
inc ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
cmp esi, eax
jb 0x3002a302
mov ebx, dword [ebp - 4]
xor esi, esi
jmp 0x3002a46c
mov eax, str.combase
mov cx, word [esi]
cmp cx, word [eax]
jne 0x3002a3d6
test cx, cx
je 0x3002a3d2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x3002a3d6
add esi, 4
add eax, 4
test cx, cx
jne 0x3002a3b0
xor eax, eax
jmp 0x3002a3db
sbb eax, eax
or eax, 1
mov esi, dword [ebp - 8]
test eax, eax
jne 0x3002a414
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebx + 4]
mov ecx, esi
mov edi, eax
call fcn.30002600
mov esi, eax
test esi, esi
je 0x3002a470
cmp esi, edi
je 0x3002a46c
push edi
push esi
push dword [ebx + 4]
push str.hook_api:_combase::_s_export_address_0x_p_differs_from_GetProcAddress____0x_p_n
call fcn.30009b00
add esp, 0x10
jmp 0x3002a46c
mov edx, edi
mov ecx, esi
call fcn.30002600
push dword [ebx + 4]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test edi, edi
je 0x3002a46c
test esi, esi
je 0x3002a459
cmp esi, edi
je 0x3002a498
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.3004b210
push dword [ebp - 0x40]
push eax
push esi
push edi
push dword [ebx + 4]
push str.hook_api:_Warning____s_export_address_0x_p_differs_from_GetProcAddress____0x_p___s::0x_x__n
call fcn.30009b00
add esp, 0x18
jmp 0x3002a46c
push edi
push dword [ebx + 4]
mov esi, edi
push str.hook_api:__s_address_0x_p_obtained_via_GetExportAddress_n
call fcn.30009b00
add esp, 0xc
test esi, esi
jne 0x3002a498
cmp dword [ebx + 0x2c], 0
je 0x3002a490
cmp dword [ebx + 0x30], 0
je 0x3002a490
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.30004200
cmp eax, dword [ebx + 0x2c]
jne 0x3002a490
mov esi, dword [ebx + 0x30]
add esi, edi
test esi, esi
je 0x3002a9ad
cmp esi, 0xffbadd11
je 0x3002a9ad
mov eax, 0x2eb
cmp word [esi], ax
jne 0x3002a500
mov eax, dword [esi - 5]
lea ecx, [esi - 5]
mov edx, 0x301fe258
mov edi, 1
cmp eax, dword [edx]
jne 0x3002a4cd
add ecx, 4
mov edi, 0xfffffffd
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x3002a4f4
cmp edi, 0xfffffffd
je 0x3002a4f0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x3002a4f4
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x3002a4f4
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x3002a4f4
xor eax, eax
jmp 0x3002a4f9
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a500
add esi, 4
cmp dword [esi], 0x909005eb
jne 0x3002a519
cmp word [esi + 4], 0x9090
jne 0x3002a519
cmp byte [esi + 6], 0x90
jne 0x3002a519
add esi, 7
cmp byte [esi], 0xeb
jne 0x3002a534
movsx eax, byte [esi + 1]
mov ecx, 0x25ff
cmp word [eax + esi + 2], cx
jne 0x3002a585
mov eax, dword [eax + esi + 4]
jmp 0x3002a57c
cmp dword [esi], 0x8b55ff8b
jne 0x3002a585
movzx eax, word [esi + 4]
cmp ax, 0x5dec
jne 0x3002a585
mov al, byte [esi + 6]
lea ecx, [esi + 6]
cmp al, 0xeb
jne 0x3002a566
movsx eax, byte [ecx + 1]
mov edx, 0x25ff
cmp word [eax + ecx + 2], dx
jne 0x3002a585
mov eax, dword [eax + ecx + 4]
jmp 0x3002a57c
cmp al, 0xe9
jne 0x3002a585
call fcn.30029da0
mov ecx, 0x25ff
cmp word [eax], cx
jne 0x3002a585
mov eax, dword [eax + 2]
mov esi, dword [eax]
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
mov ecx, str.ntdll
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x3002a5b6
test dx, dx
je 0x3002a5b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x3002a5b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x3002a590
xor eax, eax
jmp 0x3002a5bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a5cb
cmp byte [esi], 0xb8
jne 0x3002a5cb
mov dword [ebp - 0xc], 0xb
mov eax, dword [ebx + 4]
mov ecx, 0x301fe260
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a5f3
test dl, dl
je 0x3002a5ef
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a5f3
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a5d3
xor ecx, ecx
jmp 0x3002a5f8
sbb ecx, ecx
or ecx, 1
mov edx, esi
mov edi, 0x301fe270
mov ebx, 3
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x3002a613
add edx, 4
add edi, 4
or ebx, 0xffffffff
mov al, byte [edx]
cmp al, byte [edi]
jne 0x3002a63a
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x3002a63a
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x3002a63a
cmp ebx, 0xffffffff
je 0x3002a636
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
jne 0x3002a63a
xor edx, edx
jmp 0x3002a63f
sbb edx, edx
or edx, 1
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xc]
neg edx
sbb edx, edx
and edx, ecx
cmp dword [esi], 0x90f302eb
jne 0x3002a657
add esi, 4
test edx, edx
jns 0x3002a678
cmp edx, 0xe
jb 0x3002a678
push edx
push str.WARNING:_Provided_invalid_hook_type:__d
call fcn.3004de10
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10], 1
jne 0x3002a68d
cmp byte [esi], 0xb8
jne 0x3002a68d
cmp byte [esi + 5], 0xe9
je 0x3002a9ad
mov edi, dword [0x3026c04c]
xor ecx, ecx
test edi, edi
je 0x3002a6bf
lea esp, [esp]
mov eax, dword [ecx*4 + 0x30249f40]
cmp esi, eax
je 0x3002a9ad
add eax, 5
cmp esi, eax
je 0x3002a9ad
inc ecx
cmp ecx, edi
jb 0x3002a6a0
cmp edx, 0xd
jne 0x3002a6ee
mov eax, 0xff8b
cmp word [esi], ax
jne 0x3002a6ec
cmp dword [esi - 5], 0xcccccccc
jne 0x3002a6dd
cmp byte [esi - 1], 0xcc
je 0x3002a6ee
cmp dword [esi - 5], 0x90909090
jne 0x3002a6ec
cmp byte [esi - 1], 0x90
je 0x3002a6ee
xor edx, edx
lea edi, [edx + edx*2]
shl edi, 2
lea eax, [ebp - 0x20]
push eax
push 0x40
mov dword [ebp - 0x10], edi
mov ecx, dword [edi + 0x30233f00]
mov eax, dword [edi + 0x30233efc]
add eax, ecx
push eax
mov eax, esi
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x3002a98e
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x3002a73d
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
jmp 0x3002a74c
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
push 0x20c
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002a783
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xbf4], ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x3002a783
push eax
popfd
lea eax, [ebp - 8]
push eax
push 0x40
push 0x20c
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
test ebx, ebx
je 0x3002a979
mov edx, dword [edi + 0x30233efc]
mov ecx, esi
push ebx
call fcn.300295c0
add esp, 4
test eax, eax
je 0x3002a976
mov eax, dword [esi]
mov ebx, dword [ebp - 4]
mov ecx, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x3c], eax
cmp dword [ebx + 0x28], 0
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34], eax
je 0x3002a7e5
call fcn.300298d0
jmp 0x3002a7ea
call fcn.300296d0
mov eax, dword [ebx + 0x38]
sub eax, 0xffffff80
push eax
mov eax, dword [edi + 0x30233ef8]
push esi
push ebx
call eax
mov ebx, esi
mov dword [ebp - 0x30], eax
sub ebx, dword [edi + 0x30233f00]
add esp, 0xc
mov edi, dword [0x3026c04c]
cmp edi, 0x7ff
jne 0x3002a83c
cmp dword [0x302456cc], 0
jne 0x3002a82d
push str.CRITICAL:Reached_maximum_number_of_unhook_detection_entries_
call fcn.3004de10
add esp, 4
mov dword [0x302456cc], 1
jmp 0x3002a91b
xor ecx, ecx
test edi, edi
je 0x3002a86f
jmp 0x3002a850
mov eax, dword [ecx*4 + 0x30249f40]
cmp ebx, eax
je 0x3002a91b
add eax, 5
cmp ebx, eax
je 0x3002a91b
inc ecx
cmp ecx, edi
jb 0x3002a850
xor edx, edx
test edi, edi
je 0x3002a893
jmp 0x3002a880
cmp dword [edx*4 + 0x30249f40], 0
je 0x3002a966
inc edx
cmp edx, edi
jb 0x3002a880
mov edx, edi
mov eax, dword [ebp - 4]
mov ecx, edx
shl ecx, 5
mov dword [edx*4 + 0x30247f40], eax
mov eax, dword [ebp - 0x40]
mov dword [edx*4 + 0x30245740], 0x10
mov dword [ecx + 0x3025bf40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0x3025bf44], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 0x3025bf48], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0x3025bf4c], eax
mov eax, dword [ebx]
mov dword [ecx + 0x3024bf40], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 0x3024bf44], eax
mov eax, dword [ebx + 8]
mov dword [ecx + 0x3024bf48], eax
mov eax, dword [ebx + 0xc]
mov dword [edx*4 + 0x30249f40], ebx
mov dword [ecx + 0x3024bf4c], eax
cmp edx, 0x800
jae 0x3002a9b6
mov byte [edx + 0x30247740], 0
cmp edx, edi
jne 0x3002a91b
inc edi
mov dword [0x3026c04c], edi
mov ebx, dword [ebp - 0x30]
test ebx, ebx
jne 0x3002a93b
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x3002a931
mov eax, dword [edx + 0x38]
mov dword [ecx], eax
mov dword [edx + 0x34], 1
mov dword [edx + 0xc], esi
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 0x30233f00]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
mov eax, dword [edi + 0x30233efc]
sub esi, ecx
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edx*4 + 0x30249f40], 1
jmp 0x3002a895
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.WARNING:Unable_to_place_hook_on__z
call fcn.3004de10
add esp, 8
or ebx, 0xffffffff
jmp 0x3002a93e
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.WARNING:Unable_to_change_protection_for_hook_on__z
call fcn.3004de10
add esp, 8
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.3015e283
int3