Function at 0x30029dc0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 4], ebx
cmp dword [ebx + 0x34], 0
mov dword [ebp - 0x10], 0
jne 0x3002a9bd
xor esi, esi
mov eax, dword [esi + 0x3026f8e0]
test eax, eax
je 0x30029e0d
push eax
push dword [ebx + 4]
call fcn.30169d90
add esp, 8
test eax, eax
je 0x3002a9bd
add esi, 4
cmp esi, 0x200
jb 0x30029de4
xor esi, esi
nop
mov eax, dword [esi + 0x3026fae0]
test eax, eax
je 0x30029e38
push eax
push dword [ebx]
call fcn.30169c15
add esp, 8
test eax, eax
je 0x3002a9bd
add esi, 4
cmp esi, 0x200
jb 0x30029e10
mov esi, dword [ebx + 8]
test esi, esi
jne 0x3002a4ae
mov eax, dword [ebx]
test eax, eax
je 0x3002a9bd
cmp dword [ebx + 4], esi
je 0x3002a9bd
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x3002a9bd
mov edi, dword [ebx + 4]
mov edx, str.RtlDispatchException
mov ecx, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x30029e94
test al, al
je 0x30029e90
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x30029e94
add ecx, 2
add edx, 2
test al, al
jne 0x30029e74
xor eax, eax
jmp 0x30029e99
sbb eax, eax
or eax, 1
test eax, eax
jne 0x30029ed3
push str.KiUserExceptionDispatcher
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor esi, esi
cmp byte [edi], 0xe8
je 0x30029ec4
mov ecx, edi
call fcn.300294e0
add esi, eax
cmp byte [esi + edi], 0xe8
lea ecx, [esi + edi]
jne 0x30029eb4
lea ecx, [esi + edi]
call fcn.30029d70
mov esi, eax
jmp 0x3002a482
mov ecx, str.ConnectEx
mov eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x30029f00
test dl, dl
je 0x30029efc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x30029f00
add eax, 2
add ecx, 2
test dl, dl
jne 0x30029ee0
xor eax, eax
jmp 0x30029f05
sbb eax, eax
or eax, 1
test eax, eax
jne 0x30029f53
lea eax, [ebp - 0x24]
mov edx, 0x302084dc
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.3004e900
add esp, 8
test eax, eax
jne 0x30029f2b
xor esi, esi
jmp 0x3002a482
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
push 0x10
push 0x302084e4
call fcn.3004e880
add esp, 8
test eax, eax
jne 0x30029f4b
xor esi, esi
jmp 0x3002a482
mov esi, dword [eax + 0x10]
jmp 0x3002a482
mov esi, dword [ebx]
mov ecx, str.kernel32
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x30029f86
test dx, dx
je 0x30029f82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x30029f86
add eax, 4
add ecx, 4
test dx, dx
jne 0x30029f60
xor eax, eax
jmp 0x30029f8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x30029ff8
mov ecx, str.MoveFileWithProgressTransactedW
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x30029fb6
test dl, dl
je 0x30029fb2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x30029fb6
add eax, 2
add ecx, 2
test dl, dl
jne 0x30029f96
xor eax, eax
jmp 0x30029fbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x30029ff8
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MoveFileWithProgressW
push edi
call esi
cmp byte [eax + 0x16], 0xe8
lea ecx, [eax + 0x16]
jne 0x30029feb
cmp byte [eax + 0x1c], 0xc2
jne 0x30029feb
call fcn.30029d70
mov esi, eax
jmp 0x3002a482
push dword [ebx + 4]
push edi
call esi
mov esi, eax
jmp 0x3002a482
mov ecx, str.JsEval
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a020
test dl, dl
je 0x3002a01c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a020
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a000
xor eax, eax
jmp 0x3002a025
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a0d6
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.3004e900
add esp, 8
test eax, eax
jne 0x3002a053
xor esi, esi
jmp 0x3002a482
mov esi, dword [ebp - 0x2c]
mov edx, esi
mov edi, dword [ebp - 0x30]
mov ecx, edi
push 0x14
push str.eval_code
call fcn.3004e880
mov edx, eax
add esp, 8
test edx, edx
jne 0x3002a079
xor esi, esi
jmp 0x3002a482
mov eax, edi
lea ecx, [esi - 5]
cmp eax, ecx
jae 0x30029f24
cmp byte [eax], 0x68
jne 0x3002a090
cmp dword [eax + 1], edx
je 0x3002a09c
inc eax
cmp eax, ecx
jb 0x3002a086
xor esi, esi
jmp 0x3002a482
lea esi, [eax - 5]
lea ecx, [eax - 0x1000]
cmp esi, ecx
jbe 0x30029f24
lea ecx, [ecx]
cmp esi, edi
jb 0x30029f24
cmp dword [esi], 0x8b55ff8b
jne 0x3002a0ca
cmp byte [esi + 4], 0xec
je 0x3002a482
dec esi
cmp esi, ecx
ja 0x3002a0b0
xor esi, esi
jmp 0x3002a482
mov ecx, str.COleScript_ParseScriptText
mov eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a100
test dl, dl
je 0x3002a0fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a100
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a0e0
xor eax, eax
jmp 0x3002a105
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a238
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.3004e900
add esp, 8
test eax, eax
jne 0x3002a133
xor esi, esi
jmp 0x3002a482
mov esi, dword [ebp - 0x34]
mov edx, esi
mov edi, dword [ebp - 0x38]
mov ecx, edi
push 0x1a
push str.script_block
call fcn.3004e880
mov edx, eax
add esp, 8
test edx, edx
jne 0x3002a159
xor esi, esi
jmp 0x3002a482
mov ecx, edi
add esi, 0xfffffffb
cmp ecx, esi
jae 0x3002a171
cmp byte [ecx], 0x68
jne 0x3002a16c
cmp dword [ecx + 1], edx
je 0x3002a199
inc ecx
cmp ecx, esi
jb 0x3002a162
mov ecx, edi
cmp ecx, esi
jae 0x30029f24
jmp 0x3002a180
mov al, byte [ecx]
and al, 0xf8
cmp al, 0xb8
jne 0x3002a18d
cmp dword [ecx + 1], edx
je 0x3002a199
inc ecx
cmp ecx, esi
jb 0x3002a180
xor esi, esi
jmp 0x3002a482
lea edx, [ecx - 5]
add ecx, 0xfffff000
cmp edx, ecx
jbe 0x30029f24
lea ebx, [ebx]
cmp edx, edi
jb 0x30029f24
cmp dword [edx], 0x8b55ff8b
jne 0x3002a1c6
cmp byte [edx + 4], 0xec
je 0x3002a1d2
dec edx
cmp edx, ecx
ja 0x3002a1b0
xor esi, esi
jmp 0x3002a482
test edx, edx
je 0x30029f24
mov ecx, edi
cmp ecx, esi
jae 0x30029f24
cmp byte [ecx], 0xe8
jne 0x3002a1f5
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
cmp eax, edx
je 0x3002a201
inc ecx
cmp ecx, esi
jb 0x3002a1e4
xor esi, esi
jmp 0x3002a482
lea esi, [ecx - 5]
add ecx, 0xfffff000
cmp esi, ecx
jbe 0x30029f24
cmp esi, edi
jb 0x30029f24
cmp dword [esi], 0x8b55ff8b
jne 0x3002a22c
cmp byte [esi + 4], 0xec
je 0x3002a482
dec esi
cmp esi, ecx
ja 0x3002a212
xor esi, esi
jmp 0x3002a482
mov ecx, str.CDocument_write
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a260
test dl, dl
je 0x3002a25c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a260
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a240
xor eax, eax
jmp 0x3002a265
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a37b
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.3004e900
add esp, 8
test eax, eax
jne 0x3002a293
xor esi, esi
jmp 0x3002a482
mov ebx, dword [ebp - 0x3c]
mov edx, ebx
mov esi, dword [ebp - 0x14]
mov ecx, esi
push 6
push 0x30208530
call fcn.3004e880
mov edx, eax
add esp, 8
mov dword [ebp - 0x3c], edx
test edx, edx
jne 0x3002a2bf
xor esi, esi
mov ebx, dword [ebp - 4]
jmp 0x3002a482
lea ecx, [ebx - 0xa]
mov dword [ebp - 0x18], esi
cmp esi, ecx
jae 0x3002a2b5
lea ecx, [esi + 0xa]
mov dword [ebp - 0x1c], ecx
lea eax, [ebx - 0xa]
cmp byte [esi], 0x68
jne 0x3002a361
cmp dword [ecx - 9], edx
jne 0x3002a361
cmp byte [ecx - 5], 0xe8
jne 0x3002a361
lea eax, [ecx + 0x76]
mov edi, ecx
cmp ecx, eax
jae 0x3002a35e
cmp word [edi], 0x8c2
jne 0x3002a353
movzx eax, byte [edi + 2]
test al, al
jne 0x3002a353
lea edx, [ecx - 0x8a]
cmp esi, edx
jbe 0x3002a353
lea eax, [ecx - 0xd]
nop
cmp byte [eax + 3], 0xe8
jne 0x3002a345
lea esi, [eax + 8]
add esi, dword [eax + 4]
cmp esi, dword [ebp - 0x14]
jbe 0x3002a345
cmp esi, ebx
jae 0x3002a345
cmp byte [eax], 0xff
jne 0x3002a336
cmp byte [eax + 1], 0x75
jne 0x3002a336
cmp byte [eax + 2], 0x20
jb 0x3002a2b7
mov cl, byte [eax + 2]
and cl, 0xf8
cmp cl, 0x50
je 0x3002a2b7
dec eax
lea ecx, [eax + 3]
cmp ecx, edx
ja 0x3002a310
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
inc edi
lea eax, [ecx + 0x76]
cmp edi, eax
jb 0x3002a2f3
mov edx, dword [ebp - 0x3c]
lea eax, [ebx - 0xa]
inc esi
inc ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
cmp esi, eax
jb 0x3002a2d2
mov ebx, dword [ebp - 4]
xor esi, esi
jmp 0x3002a482
mov eax, str.combase
mov cx, word [esi]
cmp cx, word [eax]
jne 0x3002a3a6
test cx, cx
je 0x3002a3a2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x3002a3a6
add esi, 4
add eax, 4
test cx, cx
jne 0x3002a380
xor eax, eax
jmp 0x3002a3ab
sbb eax, eax
or eax, 1
mov esi, dword [ebp - 8]
test eax, eax
jne 0x3002a3ef
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebx + 4]
mov ecx, esi
mov edi, eax
call fcn.300024c0
mov esi, eax
test esi, esi
je 0x3002a486
cmp esi, edi
je 0x3002a482
push edi
push esi
push dword [ebx + 4]
push str.hook_api:_combase::_s_export_address_0x_p_differs_from_GetProcAddress____0x_p_n
call fcn.30009b40
add esp, 0x10
jmp 0x3002a482
mov edx, edi
mov ecx, esi
call fcn.300024c0
push dword [ebx + 4]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test edi, edi
je 0x3002a482
test esi, esi
je 0x3002a438
cmp esi, edi
je 0x3002a4ae
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.3004c8f0
push dword [ebp - 0x40]
push eax
push esi
push edi
push dword [ebx + 4]
push str.hook_api:_Warning____s_export_address_0x_p_differs_from_GetProcAddress____0x_p___s::0x_x__n
call fcn.30009b40
add esp, 0x18
jmp 0x3002a482
mov eax, dword [ebx]
mov ecx, str.clrjit
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x3002a466
test dx, dx
je 0x3002a462
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x3002a466
add eax, 4
add ecx, 4
test dx, dx
jne 0x3002a440
xor eax, eax
jmp 0x3002a46b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a486
push edi
push dword [ebx + 4]
mov esi, edi
push str.hook_api:_clrjit::_s_export_address_0x_p_obtained_via_GetExportAddress_n
call fcn.30009b40
add esp, 0xc
test esi, esi
jne 0x3002a4ae
cmp dword [ebx + 0x2c], 0
je 0x3002a4a6
cmp dword [ebx + 0x30], 0
je 0x3002a4a6
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.30004280
cmp eax, dword [ebx + 0x2c]
jne 0x3002a4a6
mov esi, dword [ebx + 0x30]
add esi, edi
test esi, esi
je 0x3002a9bd
cmp esi, 0xffbadd11
je 0x3002a9bd
mov eax, 0x2eb
cmp word [esi], ax
jne 0x3002a516
mov eax, dword [esi - 5]
lea ecx, [esi - 5]
mov edx, 0x301ff138
mov edi, 1
cmp eax, dword [edx]
jne 0x3002a4e3
add ecx, 4
mov edi, 0xfffffffd
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x3002a50a
cmp edi, 0xfffffffd
je 0x3002a506
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x3002a50a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x3002a50a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x3002a50a
xor eax, eax
jmp 0x3002a50f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a516
add esi, 4
cmp dword [esi], 0x909005eb
jne 0x3002a52f
cmp word [esi + 4], 0x9090
jne 0x3002a52f
cmp byte [esi + 6], 0x90
jne 0x3002a52f
add esi, 7
cmp byte [esi], 0xeb
jne 0x3002a54a
movsx eax, byte [esi + 1]
mov ecx, 0x25ff
cmp word [eax + esi + 2], cx
jne 0x3002a59b
mov eax, dword [eax + esi + 4]
jmp 0x3002a592
cmp dword [esi], 0x8b55ff8b
jne 0x3002a59b
movzx eax, word [esi + 4]
cmp ax, 0x5dec
jne 0x3002a59b
mov al, byte [esi + 6]
lea ecx, [esi + 6]
cmp al, 0xeb
jne 0x3002a57c
movsx eax, byte [ecx + 1]
mov edx, 0x25ff
cmp word [eax + ecx + 2], dx
jne 0x3002a59b
mov eax, dword [eax + ecx + 4]
jmp 0x3002a592
cmp al, 0xe9
jne 0x3002a59b
call fcn.30029d70
mov ecx, 0x25ff
cmp word [eax], cx
jne 0x3002a59b
mov eax, dword [eax + 2]
mov esi, dword [eax]
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
mov ecx, str.ntdll
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x3002a5c8
test dx, dx
je 0x3002a5c4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x3002a5c8
add eax, 4
add ecx, 4
test dx, dx
jne 0x3002a5a2
xor eax, eax
jmp 0x3002a5cd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002a5dd
cmp byte [esi], 0xb8
jne 0x3002a5dd
mov dword [ebp - 0xc], 0xb
mov eax, dword [ebx + 4]
mov ecx, 0x301ff140
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002a605
test dl, dl
je 0x3002a601
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002a605
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002a5e5
xor ecx, ecx
jmp 0x3002a60a
sbb ecx, ecx
or ecx, 1
mov edx, esi
mov edi, 0x301ff150
mov ebx, 3
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x3002a625
add edx, 4
add edi, 4
or ebx, 0xffffffff
mov al, byte [edx]
cmp al, byte [edi]
jne 0x3002a64c
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x3002a64c
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x3002a64c
cmp ebx, 0xffffffff
je 0x3002a648
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
jne 0x3002a64c
xor edx, edx
jmp 0x3002a651
sbb edx, edx
or edx, 1
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xc]
neg edx
sbb edx, edx
and edx, ecx
cmp dword [esi], 0x90f302eb
jne 0x3002a669
add esi, 4
test edx, edx
jns 0x3002a68a
cmp edx, 0xe
jb 0x3002a68a
push edx
push str.WARNING:_Provided_invalid_hook_type:__d
call fcn.3004f500
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10], 1
jne 0x3002a69f
cmp byte [esi], 0xb8
jne 0x3002a69f
cmp byte [esi + 5], 0xe9
je 0x3002a9bd
mov edi, dword [0x3026d0fc]
xor ecx, ecx
test edi, edi
je 0x3002a6cf
jmp 0x3002a6b0
mov eax, dword [ecx*4 + 0x3024aff0]
cmp esi, eax
je 0x3002a9bd
add eax, 5
cmp esi, eax
je 0x3002a9bd
inc ecx
cmp ecx, edi
jb 0x3002a6b0
cmp edx, 0xd
jne 0x3002a6fe
mov eax, 0xff8b
cmp word [esi], ax
jne 0x3002a6fc
cmp dword [esi - 5], 0xcccccccc
jne 0x3002a6ed
cmp byte [esi - 1], 0xcc
je 0x3002a6fe
cmp dword [esi - 5], 0x90909090
jne 0x3002a6fc
cmp byte [esi - 1], 0x90
je 0x3002a6fe
xor edx, edx
lea edi, [edx + edx*2]
shl edi, 2
lea eax, [ebp - 0x20]
push eax
push 0x40
mov dword [ebp - 0x10], edi
mov ecx, dword [edi + 0x30234fa0]
mov eax, dword [edi + 0x30234f9c]
add eax, ecx
push eax
mov eax, esi
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x3002a99e
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x3002a74d
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
jmp 0x3002a75c
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
push 0x20c
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002a793
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xbf4], ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x3002a793
push eax
popfd
lea eax, [ebp - 8]
push eax
push 0x40
push 0x20c
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
test ebx, ebx
je 0x3002a989
mov edx, dword [edi + 0x30234f9c]
mov ecx, esi
push ebx
call fcn.30029590
add esp, 4
test eax, eax
je 0x3002a986
mov eax, dword [esi]
mov ebx, dword [ebp - 4]
mov ecx, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x3c], eax
cmp dword [ebx + 0x28], 0
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34], eax
je 0x3002a7f5
call fcn.300298a0
jmp 0x3002a7fa
call fcn.300296a0
mov eax, dword [ebx + 0x38]
sub eax, 0xffffff80
push eax
mov eax, dword [edi + 0x30234f98]
push esi
push ebx
call eax
mov ebx, esi
mov dword [ebp - 0x30], eax
sub ebx, dword [edi + 0x30234fa0]
add esp, 0xc
mov edi, dword [0x3026d0fc]
cmp edi, 0x7ff
jne 0x3002a84c
cmp dword [0x3024677c], 0
jne 0x3002a83d
push str.CRITICAL:Reached_maximum_number_of_unhook_detection_entries_
call fcn.3004f500
add esp, 4
mov dword [0x3024677c], 1
jmp 0x3002a92b
xor ecx, ecx
test edi, edi
je 0x3002a87f
jmp 0x3002a860
mov eax, dword [ecx*4 + 0x3024aff0]
cmp ebx, eax
je 0x3002a92b
add eax, 5
cmp ebx, eax
je 0x3002a92b
inc ecx
cmp ecx, edi
jb 0x3002a860
xor edx, edx
test edi, edi
je 0x3002a8a3
jmp 0x3002a890
cmp dword [edx*4 + 0x3024aff0], 0
je 0x3002a976
inc edx
cmp edx, edi
jb 0x3002a890
mov edx, edi
mov eax, dword [ebp - 4]
mov ecx, edx
shl ecx, 5
mov dword [edx*4 + 0x30248ff0], eax
mov eax, dword [ebp - 0x40]
mov dword [edx*4 + 0x302467f0], 0x10
mov dword [ecx + 0x3025cff0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0x3025cff4], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 0x3025cff8], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0x3025cffc], eax
mov eax, dword [ebx]
mov dword [ecx + 0x3024cff0], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 0x3024cff4], eax
mov eax, dword [ebx + 8]
mov dword [ecx + 0x3024cff8], eax
mov eax, dword [ebx + 0xc]
mov dword [edx*4 + 0x3024aff0], ebx
mov dword [ecx + 0x3024cffc], eax
cmp edx, 0x800
jae 0x3002a9c6
mov byte [edx + 0x302487f0], 0
cmp edx, edi
jne 0x3002a92b
inc edi
mov dword [0x3026d0fc], edi
mov ebx, dword [ebp - 0x30]
test ebx, ebx
jne 0x3002a94b
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x3002a941
mov eax, dword [edx + 0x38]
mov dword [ecx], eax
mov dword [edx + 0x34], 1
mov dword [edx + 0xc], esi
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 0x30234fa0]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
mov eax, dword [edi + 0x30234f9c]
sub esi, ecx
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edx*4 + 0x3024aff0], 1
jmp 0x3002a8a5
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.WARNING:Unable_to_place_hook_on__z
call fcn.3004f500
add esp, 8
or ebx, 0xffffffff
jmp 0x3002a94e
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.WARNING:Unable_to_change_protection_for_hook_on__z
call fcn.3004f500
add esp, 8
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.3015f8d3
int3