Function at 0x3002b8f0
Capabilities:
Allocate or change rwx memory
Check os version
Enumerate threads
Execute shellcode via indirect call
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x30215e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc8]
test eax, eax
jne 0x3002b921
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3002b92a
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x4000
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xc0], eax
test ecx, ecx
je 0x3002b963
mov eax, dword [ebp - 0xc8]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3002b963
push eax
popfd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xcc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x3002b9a9
push str.set_hooks:_Failed_to_get_OS_version
call fcn.3000a0f0
add esp, 4
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x3026b2e0], ebx
je 0x3002b9de
mov eax, 0x190
mov dword [0x302697cc], 5
mov ecx, 0x30219e00
jmp 0x3002ba8c
cmp dword [0x3026b2f0], ebx
je 0x3002b9ff
mov eax, 0x14f0
mov dword [0x302697cc], 0x43
mov ecx, 0x3022d540
jmp 0x3002ba8c
cmp dword [0x3026b2f4], ebx
je 0x3002ba0e
mov ecx, 0x3021b390
jmp 0x3002ba7d
cmp dword [0x3026b2f8], ebx
je 0x3002ba2c
mov eax, 0x8750
mov dword [0x302697cc], 0x1b1
mov ecx, 0x30224df0
jmp 0x3002ba8c
cmp dword [0x3026b308], ebx
je 0x3002ba4a
mov eax, 0x1400
mov dword [0x302697cc], 0x40
mov ecx, 0x30219f90
jmp 0x3002ba8c
cmp dword [0x3026b300], ebx
jne 0x3002ba78
cmp dword [0x3026b2fc], ebx
jne 0x3002ba78
cmp dword [0x3026b304], ebx
jne 0x3002ba78
mov eax, 0x9920
mov dword [0x302697cc], 0x1ea
mov ecx, 0x3021b430
jmp 0x3002ba8c
mov ecx, 0x30224d50
mov dword [0x302697cc], 2
mov eax, 0xa0
lea edx, [ebp - 0xdc]
mov dword [0x302697c8], eax
push edx
push 0x40
push eax
push ecx
mov dword [0x302697bc], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xbc], 0x1c
call fcn.3002a140
push 0
push 4
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov esi, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xb0], eax
jne 0x3002bb3f
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xcc]
je 0x3002bb3f
cmp ebx, 0x1000
jae 0x3002bb3f
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [esi + ebx*4], eax
test eax, eax
je 0x3002bb3f
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x3002bb01
xor edi, edi
mov dword [ebp - 0xc4], ebx
cmp dword [0x302697cc], edi
jbe 0x3002bbf2
xor esi, esi
xor ebx, ebx
lea esp, [esp]
cmp dword [ebp - 0x9c], 6
jne 0x3002bb84
cmp dword [ebp - 0x98], 1
ja 0x3002bb86
jmp 0x3002bba9
jbe 0x3002bba9
cmp dword [ebp - 0xd0], 0
jne 0x3002bba9
mov eax, dword [0x302697bc]
push str.NtWaitForSingleObject
push dword [esi + eax + 4]
call fcn.3016475e
add esp, 8
test eax, eax
je 0x3002bbda
mov ecx, dword [0x302697bc]
mov edx, dword [0x3026a860]
lea ecx, [esi + ecx]
call fcn.3002ab50
test eax, eax
jns 0x3002bbd9
mov eax, dword [0x302697bc]
push dword [esi + eax + 4]
push str.set_hooks:_Unable_to_hook__s
call fcn.3000a0d0
add esp, 8
jmp 0x3002bbda
inc ebx
inc edi
add esi, 0x50
cmp edi, dword [0x302697cc]
jb 0x3002bb70
mov dword [ebp - 0xc8], ebx
mov ebx, dword [ebp - 0xc4]
xor esi, esi
test ebx, ebx
jbe 0x3002bc1f
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, edi
mov eax, dword [ebp - 0xc0]
push dword [eax + esi*4]
call edi
mov eax, dword [ebp - 0xc0]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jb 0x3002bc00
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3002bc33
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3002bc3c
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0xc0]
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002bc69
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
test esi, esi
je 0x3002bc69
push esi
popfd
mov eax, dword [0x3026e5c8]
test eax, eax
je 0x3002bc87
push 0x302697c4
push 0
push 0x30023460
push 0
call eax
jmp 0x3002bd22
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x301e2b38
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, str..text
mov ecx, eax
call fcn.3004fdd0
add esp, 8
test eax, eax
je 0x3002bd22
mov edx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd8]
add edx, 0xffffffe2
cmp ecx, edx
jae 0x3002bd22
add ecx, 0xa
lea esp, [esp]
cmp byte [ecx - 0xa], 0xb8
jne 0x3002bcfe
cmp byte [ecx - 5], 0xa3
jne 0x3002bcfe
cmp byte [ecx], 0xa3
jne 0x3002bcfe
cmp byte [ecx + 5], 0xb8
jne 0x3002bcfe
cmp byte [ecx + 0xa], 0xa3
jne 0x3002bcfe
cmp byte [ecx + 0xf], 0xa3
jne 0x3002bcfe
mov edi, dword [ecx + 6]
lea eax, [edi + 8]
cmp dword [ecx - 9], eax
jne 0x3002bd08
inc ecx
lea eax, [ecx - 0xa]
cmp eax, edx
jb 0x3002bcd0
jmp 0x3002bd22
mov esi, dword [edi]
mov edx, 0x10
lea ecx, [edx - 0xf]
call fcn.300011a0
mov dword [eax], esi
mov dword [eax + 8], 0x30023460
mov dword [edi], eax
push dword [ebp - 0xc8]
push str.Hooked__d_functions_n
call fcn.3000a0d0
add esp, 8
call fcn.3002a140
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [eax], 0
pop ebx
call fcn.30159c2d
mov esp, ebp
pop ebp
ret