Function at 0x3002ab30
Capabilities:
Allocate or change rwx memory
Check os version
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x3021be88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc4]
test eax, eax
jne 0x3002ab61
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3002ab6a
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x4000
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xc0], eax
test ecx, ecx
je 0x3002aba3
mov eax, dword [ebp - 0xc4]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3002aba3
push eax
popfd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x3002abe3
push str.set_hooks:_Failed_to_get_OS_version
call fcn.30009b60
add esp, 4
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x30270338], ebx
je 0x3002ac18
mov eax, 0x190
mov dword [0x3026e82c], 5
mov ecx, 0x3021fe00
jmp 0x3002acc6
cmp dword [0x30270348], ebx
je 0x3002ac39
mov eax, 0x1540
mov dword [0x3026e82c], 0x44
mov ecx, 0x30233130
jmp 0x3002acc6
cmp dword [0x3027034c], ebx
je 0x3002ac48
mov ecx, 0x302213e0
jmp 0x3002acb7
cmp dword [0x30270350], ebx
je 0x3002ac66
mov eax, 0x8660
mov dword [0x3026e82c], 0x1ae
mov ecx, 0x3022aad0
jmp 0x3002acc6
cmp dword [0x30270360], ebx
je 0x3002ac84
mov eax, 0x1450
mov dword [0x3026e82c], 0x41
mov ecx, 0x3021ff90
jmp 0x3002acc6
cmp dword [0x30270358], ebx
jne 0x3002acb2
cmp dword [0x30270354], ebx
jne 0x3002acb2
cmp dword [0x3027035c], ebx
jne 0x3002acb2
mov eax, 0x95b0
mov dword [0x3026e82c], 0x1df
mov ecx, 0x30221480
jmp 0x3002acc6
mov ecx, 0x3022aa30
mov dword [0x3026e82c], 2
mov eax, 0xa0
lea edx, [ebp - 0xd8]
mov dword [0x3026e828], eax
push edx
push 0x40
push eax
push ecx
mov dword [0x3026e81c], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xbc], 0x1c
call fcn.300293b0
push 0
push 4
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov esi, dword [ebp - 0xc0]
jmp 0x3002ad40
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xb0], eax
jne 0x3002ad7e
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xc8]
je 0x3002ad7e
cmp ebx, 0x1000
jae 0x3002ad7e
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [esi + ebx*4], eax
test eax, eax
je 0x3002ad7e
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0xbc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x3002ad40
xor edi, edi
cmp dword [0x3026e82c], edi
jbe 0x3002ae13
xor esi, esi
lea esp, [esp]
cmp dword [ebp - 0x9c], 6
jne 0x3002adb4
cmp dword [ebp - 0x98], 1
ja 0x3002adb6
jmp 0x3002add9
jbe 0x3002add9
cmp dword [ebp - 0xcc], 0
jne 0x3002add9
mov eax, dword [0x3026e81c]
push str.NtWaitForSingleObject
push dword [esi + eax + 4]
call fcn.30169d90
add esp, 8
test eax, eax
je 0x3002ae07
mov ecx, dword [0x3026e81c]
mov edx, dword [0x3026f8c0]
lea ecx, [esi + ecx]
call fcn.30029dc0
test eax, eax
jns 0x3002ae07
mov eax, dword [0x3026e81c]
push dword [esi + eax + 4]
push str.WARNING:Unable_to_hook__z
call fcn.3004f500
add esp, 8
inc edi
add esi, 0x50
cmp edi, dword [0x3026e82c]
jb 0x3002ada0
xor esi, esi
test ebx, ebx
jbe 0x3002ae3f
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov eax, dword [ebp - 0xc0]
push dword [eax + esi*4]
call edi
mov eax, dword [ebp - 0xc0]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jb 0x3002ae20
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3002ae53
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3002ae5c
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push dword [ebp - 0xc0]
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002ae89
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
test esi, esi
je 0x3002ae89
push esi
popfd
mov eax, dword [0x30273228]
test eax, eax
je 0x3002aea7
push 0x3026e824
push 0
push 0x30022930
push 0
call eax
jmp 0x3002af42
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xd4]
push eax
push 0x301e7978
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, str..text
mov ecx, eax
call fcn.3004e900
add esp, 8
test eax, eax
je 0x3002af42
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xd4]
add edx, 0xffffffe2
cmp ecx, edx
jae 0x3002af42
add ecx, 0xa
lea esp, [esp]
cmp byte [ecx - 0xa], 0xb8
jne 0x3002af1e
cmp byte [ecx - 5], 0xa3
jne 0x3002af1e
cmp byte [ecx], 0xa3
jne 0x3002af1e
cmp byte [ecx + 5], 0xb8
jne 0x3002af1e
cmp byte [ecx + 0xa], 0xa3
jne 0x3002af1e
cmp byte [ecx + 0xf], 0xa3
jne 0x3002af1e
mov edi, dword [ecx + 6]
lea eax, [edi + 8]
cmp dword [ecx - 9], eax
jne 0x3002af28
inc ecx
lea eax, [ecx - 0xa]
cmp eax, edx
jb 0x3002aef0
jmp 0x3002af42
mov esi, dword [edi]
mov edx, 0x10
lea ecx, [edx - 0xf]
call fcn.300011a0
mov dword [eax], esi
mov dword [eax + 8], 0x30022930
mov dword [edi], eax
call fcn.300293b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [eax], 0
pop ebx
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret