Function at 0x30005f70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x3026b2cc], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
je 0x30006032
cmp dword [0x3026eca4], 6
jne 0x30005fa2
cmp dword [0x3026eca8], 1
ja 0x30005fa8
jmp 0x30006032
jbe 0x30006032
push str.win32u
call esi
push 0x301f0db0
mov dword [0x30267720], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x3026771c], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], 0x3008f990
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x30005ffb
push str.Syscall_hooks_cannot_be_used_on_32_bit_OS_n
call fcn.3000a0d0
add esp, 4
jmp 0x30006032
push 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x3008f990
push eax
push 0x28
call edi
push eax
call dword [0x3026e5dc]
test eax, eax
js 0x30006024
push dword [0x3026b2cc]
push str.Syscall_hook_installed__syscall_logging_level__d
jmp 0x3000602a
push eax
push str.Failed_to_install_syscall_hook__NtSetInformationProcess_returned_0x_x
call fcn.3000a0d0
add esp, 8
cmp dword [0x3026b2d0], 0
je 0x30006060
call fcn.300084d0
test eax, eax
je 0x30006060
cmp dword [0x3026ac80], 0
jne 0x30006060
call fcn.30023410
test eax, eax
jne 0x30006060
push eax
call esi
mov ecx, eax
call fcn.3001b920
cmp dword [0x3026b28c], 0
je 0x300060a6
call fcn.300084d0
test eax, eax
jne 0x3000607f
push str.UnpackerInit:_Failed_to_initialise_debugger._n
call fcn.3000a0d0
add esp, 4
mov ecx, dword [0x30267724]
xor edx, edx
call fcn.30002a90
test eax, eax
je 0x30006099
mov dword [eax + 0x28], 1
jmp 0x300060a6
push str.UnpackerInit:_Error_adding_monitor_image_base_to_tracked_regions._n
call fcn.3000a0d0
add esp, 4
cmp dword [0x3026b294], 0
je 0x300060c4
mov edx, dword [0x30267724]
mov ecx, 0x3026d7dc
push 0
call fcn.3004c320
add esp, 4
push 0
call esi
mov esi, eax
mov ecx, dword [esi + 0x3c]
mov edi, dword [ecx + esi + 0x80]
mov eax, dword [ecx + esi + 0x84]
add edi, esi
add eax, edi
mov dword [ebp - 8], eax
cmp dword [eax], 0x4550
jne 0x30006189
lea eax, [ebp - 4]
push eax
push 0x40
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x30006117
push str.RestoreHeaders:_Failed_to_modify_memory_page_protection_of_NtHeaders
call fcn.3000a0f0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
push 0xf8
push dword [ebp - 8]
add eax, esi
push eax
call fcn.3015c210
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x30006157
push str.RestoreHeaders:_Failed_to_restore_previous_memory_page_protection
call fcn.3000a0f0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x3000617c
push str.RestoreHeaders:_Failed_to_free_memory_for_patched_IAT
call fcn.3000a0f0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.RestoreHeaders:_Restored_original_import_table._n
call fcn.3000a0d0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret