Function at 0x3002ab20
Capabilities:
Allocate or change rwx memory
Check os version
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x3021ae88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc4]
test eax, eax
jne 0x3002ab51
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3002ab5a
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x4000
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xc0], eax
test ecx, ecx
je 0x3002ab93
mov eax, dword [ebp - 0xc4]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3002ab93
push eax
popfd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x3002abd3
push str.set_hooks:_Failed_to_get_OS_version
call fcn.30009b20
add esp, 4
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x3026f274], ebx
je 0x3002ac08
mov eax, 0x190
mov dword [0x3026d76c], 5
mov ecx, 0x3021ee00
jmp 0x3002acb6
cmp dword [0x3026f284], ebx
je 0x3002ac29
mov eax, 0x1540
mov dword [0x3026d76c], 0x44
mov ecx, 0x30232090
jmp 0x3002acb6
cmp dword [0x3026f288], ebx
je 0x3002ac38
mov ecx, 0x302203e0
jmp 0x3002aca7
cmp dword [0x3026f28c], ebx
je 0x3002ac56
mov eax, 0x8660
mov dword [0x3026d76c], 0x1ae
mov ecx, 0x30229a30
jmp 0x3002acb6
cmp dword [0x3026f29c], ebx
je 0x3002ac74
mov eax, 0x1450
mov dword [0x3026d76c], 0x41
mov ecx, 0x3021ef90
jmp 0x3002acb6
cmp dword [0x3026f294], ebx
jne 0x3002aca2
cmp dword [0x3026f290], ebx
jne 0x3002aca2
cmp dword [0x3026f298], ebx
jne 0x3002aca2
mov eax, 0x9510
mov dword [0x3026d76c], 0x1dd
mov ecx, 0x30220480
jmp 0x3002acb6
mov ecx, 0x30229990
mov dword [0x3026d76c], 2
mov eax, 0xa0
lea edx, [ebp - 0xd8]
mov dword [0x3026d768], eax
push edx
push 0x40
push eax
push ecx
mov dword [0x3026d75c], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xbc], 0x1c
call fcn.300293e0
push 0
push 4
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov esi, dword [ebp - 0xc0]
jmp 0x3002ad30
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xb0], eax
jne 0x3002ad6e
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xc8]
je 0x3002ad6e
cmp ebx, 0x1000
jae 0x3002ad6e
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [esi + ebx*4], eax
test eax, eax
je 0x3002ad6e
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x3002ad30
xor edi, edi
cmp dword [0x3026d76c], edi
jbe 0x3002ae03
xor esi, esi
lea esp, [esp]
cmp dword [ebp - 0x9c], 6
jne 0x3002ada4
cmp dword [ebp - 0x98], 1
ja 0x3002ada6
jmp 0x3002adc9
jbe 0x3002adc9
cmp dword [ebp - 0xcc], 0
jne 0x3002adc9
mov eax, dword [0x3026d75c]
push str.NtWaitForSingleObject
push dword [esi + eax + 4]
call fcn.30168730
add esp, 8
test eax, eax
je 0x3002adf7
mov ecx, dword [0x3026d75c]
mov edx, dword [0x3026e800]
lea ecx, [esi + ecx]
call fcn.30029df0
test eax, eax
jns 0x3002adf7
mov eax, dword [0x3026d75c]
push dword [esi + eax + 4]
push str.WARNING:Unable_to_hook__z
call fcn.3004de10
add esp, 8
inc edi
add esi, 0x50
cmp edi, dword [0x3026d76c]
jb 0x3002ad90
xor esi, esi
test ebx, ebx
jbe 0x3002ae2f
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov eax, dword [ebp - 0xc0]
push dword [eax + esi*4]
call edi
mov eax, dword [ebp - 0xc0]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jb 0x3002ae10
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3002ae43
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3002ae4c
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0xc0]
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002ae79
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
test esi, esi
je 0x3002ae79
push esi
popfd
mov eax, dword [0x302727c8]
test eax, eax
je 0x3002ae97
push 0x3026d764
push 0
push 0x300229e0
push 0
call eax
jmp 0x3002af32
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xd4]
push eax
push 0x301e6ac8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, str..text
mov ecx, eax
call fcn.3004d210
add esp, 8
test eax, eax
je 0x3002af32
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xd4]
add edx, 0xffffffe2
cmp ecx, edx
jae 0x3002af32
add ecx, 0xa
lea esp, [esp]
cmp byte [ecx - 0xa], 0xb8
jne 0x3002af0e
cmp byte [ecx - 5], 0xa3
jne 0x3002af0e
cmp byte [ecx], 0xa3
jne 0x3002af0e
cmp byte [ecx + 5], 0xb8
jne 0x3002af0e
cmp byte [ecx + 0xa], 0xa3
jne 0x3002af0e
cmp byte [ecx + 0xf], 0xa3
jne 0x3002af0e
mov edi, dword [ecx + 6]
lea eax, [edi + 8]
cmp dword [ecx - 9], eax
jne 0x3002af18
inc ecx
lea eax, [ecx - 0xa]
cmp eax, edx
jb 0x3002aee0
jmp 0x3002af32
mov esi, dword [edi]
mov edx, 0x10
lea ecx, [edx - 0xf]
call fcn.300011a0
mov dword [eax], esi
mov dword [eax + 8], 0x300229e0
mov dword [edi], eax
call fcn.300293e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [eax], 0
pop ebx
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret