Function at 0x300059d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x30270324], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
je 0x30005a92
cmp dword [0x30273904], 6
jne 0x30005a02
cmp dword [0x30273908], 1
ja 0x30005a08
jmp 0x30005a92
jbe 0x30005a92
push str.win32u
call esi
push 0x301f5d48
mov dword [0x3026d3e0], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x3026d3dc], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], 0x30095100
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x30005a5b
push str.Syscall_hooks_cannot_be_used_on_32_bit_OS_n
call fcn.30009b40
add esp, 4
jmp 0x30005a92
push 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x30095100
push eax
push 0x28
call edi
push eax
call dword [0x3027323c]
test eax, eax
js 0x30005a84
push dword [0x30270324]
push str.Syscall_hook_installed__syscall_logging_level__d
jmp 0x30005a8a
push eax
push str.Failed_to_install_syscall_hook__NtSetInformationProcess_returned_0x_x
call fcn.30009b40
add esp, 8
cmp dword [0x30270328], 0
je 0x30005ac0
call fcn.30007f40
test eax, eax
je 0x30005ac0
cmp dword [0x3026fce0], 0
jne 0x30005ac0
call fcn.300228e0
test eax, eax
jne 0x30005ac0
push eax
call esi
mov ecx, eax
call fcn.3001b0c0
cmp dword [0x302702e8], 0
je 0x30005b06
call fcn.30007f40
test eax, eax
jne 0x30005adf
push str.UnpackerInit:_Failed_to_initialise_debugger._n
call fcn.30009b40
add esp, 4
mov ecx, dword [0x3026d3e4]
xor edx, edx
call fcn.30002850
test eax, eax
je 0x30005af9
mov dword [eax + 0x28], 1
jmp 0x30005b06
push str.UnpackerInit:_Error_adding_monitor_image_base_to_tracked_regions._n
call fcn.30009b40
add esp, 4
cmp dword [0x302702f0], 0
je 0x30005b24
mov edx, dword [0x3026d3e4]
mov ecx, 0x30272440
push 0
call fcn.3004af40
add esp, 4
push 0
call esi
mov esi, eax
mov ecx, dword [esi + 0x3c]
mov edi, dword [ecx + esi + 0x80]
mov eax, dword [ecx + esi + 0x84]
add edi, esi
add eax, edi
mov dword [ebp - 8], eax
cmp dword [eax], 0x4550
jne 0x30005be9
lea eax, [ebp - 4]
push eax
push 0x40
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x30005b77
push str.RestoreHeaders:_Failed_to_modify_memory_page_protection_of_NtHeaders
call fcn.30009b60
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
push 0xf8
push dword [ebp - 8]
add eax, esi
push eax
call fcn.301619b0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xf8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x30005bb7
push str.RestoreHeaders:_Failed_to_restore_previous_memory_page_protection
call fcn.30009b60
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x30005bdc
push str.RestoreHeaders:_Failed_to_free_memory_for_patched_IAT
call fcn.30009b60
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.RestoreHeaders:_Restored_original_import_table._n
call fcn.30009b40
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret