Function at 0x3002ab50
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], edi
cmp dword [ebx + 0x34], edi
jne 0x3002b77c
xor esi, esi
nop
mov eax, dword [esi + 0x3026a880]
test eax, eax
je 0x3002aba9
push eax
push dword [ebx + 4]
call fcn.3016475e
add esp, 8
test eax, eax
je 0x3002b77c
add esi, 4
cmp esi, 0x200
jb 0x3002ab80
xor esi, esi
jmp 0x3002abb0
mov eax, dword [esi + 0x3026aa80]
test eax, eax
je 0x3002abd8
push eax
push dword [ebx]
call fcn.301645e3
add esp, 8
test eax, eax
je 0x3002b77c
add esi, 4
cmp esi, 0x200
jb 0x3002abb0
mov esi, dword [ebx + 8]
test esi, esi
jne 0x3002b24e
mov eax, dword [ebx]
test eax, eax
je 0x3002b77c
cmp dword [ebx + 4], edi
je 0x3002b77c
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x3002b77c
mov edi, dword [ebx + 4]
mov ecx, str.RtlDispatchException
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002ac34
test dl, dl
je 0x3002ac30
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002ac34
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002ac14
xor eax, eax
jmp 0x3002ac39
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002ac73
push str.KiUserExceptionDispatcher
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor esi, esi
cmp byte [edi], 0xe8
je 0x3002ac64
mov ecx, eax
call fcn.3002a270
add esi, eax
cmp byte [esi + edi], 0xe8
lea eax, [esi + edi]
jne 0x3002ac52
lea ecx, [esi + edi]
call fcn.3002ab00
mov esi, eax
jmp 0x3002b222
mov ecx, str.ConnectEx
mov eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002aca0
test dl, dl
je 0x3002ac9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002aca0
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002ac80
xor eax, eax
jmp 0x3002aca5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002acf3
lea eax, [ebp - 0x28]
mov edx, 0x30203804
push eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.3004fdd0
add esp, 8
test eax, eax
jne 0x3002accb
xor esi, esi
jmp 0x3002b222
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
push 0x10
push 0x3020380c
call fcn.3004fd50
add esp, 8
test eax, eax
jne 0x3002aceb
xor esi, esi
jmp 0x3002b222
mov esi, dword [eax + 0x10]
jmp 0x3002b222
mov esi, dword [ebx]
mov ecx, str.kernel32
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x3002ad26
test dx, dx
je 0x3002ad22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x3002ad26
add eax, 4
add ecx, 4
test dx, dx
jne 0x3002ad00
xor eax, eax
jmp 0x3002ad2b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002ad98
mov ecx, str.MoveFileWithProgressTransactedW
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002ad56
test dl, dl
je 0x3002ad52
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002ad56
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002ad36
xor eax, eax
jmp 0x3002ad5b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002ad98
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MoveFileWithProgressW
push edi
call esi
cmp byte [eax + 0x16], 0xe8
lea ecx, [eax + 0x16]
jne 0x3002ad8b
cmp byte [eax + 0x1c], 0xc2
jne 0x3002ad8b
call fcn.3002ab00
mov esi, eax
jmp 0x3002b222
push dword [ebx + 4]
push edi
call esi
mov esi, eax
jmp 0x3002b222
mov ecx, str.JsEval
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002adc0
test dl, dl
je 0x3002adbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002adc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002ada0
xor eax, eax
jmp 0x3002adc5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002ae76
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.3004fdd0
add esp, 8
test eax, eax
jne 0x3002adf3
xor esi, esi
jmp 0x3002b222
mov esi, dword [ebp - 0x30]
mov edx, esi
mov edi, dword [ebp - 0x34]
mov ecx, edi
push 0x14
push str.eval_code
call fcn.3004fd50
mov edx, eax
add esp, 8
test edx, edx
jne 0x3002ae19
xor esi, esi
jmp 0x3002b222
mov eax, edi
lea ecx, [esi - 5]
cmp eax, ecx
jae 0x3002acc4
cmp byte [eax], 0x68
jne 0x3002ae30
cmp dword [eax + 1], edx
je 0x3002ae3c
inc eax
cmp eax, ecx
jb 0x3002ae26
xor esi, esi
jmp 0x3002b222
lea esi, [eax - 5]
lea ecx, [eax - 0x1000]
cmp esi, ecx
jbe 0x3002acc4
lea ecx, [ecx]
cmp esi, edi
jb 0x3002acc4
cmp dword [esi], 0x8b55ff8b
jne 0x3002ae6a
cmp byte [esi + 4], 0xec
je 0x3002b222
dec esi
cmp esi, ecx
ja 0x3002ae50
xor esi, esi
jmp 0x3002b222
mov ecx, str.COleScript_ParseScriptText
mov eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002aea0
test dl, dl
je 0x3002ae9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002aea0
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002ae80
xor eax, eax
jmp 0x3002aea5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002afd8
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.3004fdd0
add esp, 8
test eax, eax
jne 0x3002aed3
xor esi, esi
jmp 0x3002b222
mov esi, dword [ebp - 0x38]
mov edx, esi
mov edi, dword [ebp - 0x3c]
mov ecx, edi
push 0x1a
push str.script_block
call fcn.3004fd50
mov edx, eax
add esp, 8
test edx, edx
jne 0x3002aef9
xor esi, esi
jmp 0x3002b222
mov ecx, edi
add esi, 0xfffffffb
cmp ecx, esi
jae 0x3002af11
cmp byte [ecx], 0x68
jne 0x3002af0c
cmp dword [ecx + 1], edx
je 0x3002af39
inc ecx
cmp ecx, esi
jb 0x3002af02
mov ecx, edi
cmp ecx, esi
jae 0x3002acc4
jmp 0x3002af20
mov al, byte [ecx]
and al, 0xf8
cmp al, 0xb8
jne 0x3002af2d
cmp dword [ecx + 1], edx
je 0x3002af39
inc ecx
cmp ecx, esi
jb 0x3002af20
xor esi, esi
jmp 0x3002b222
lea edx, [ecx - 5]
add ecx, 0xfffff000
cmp edx, ecx
jbe 0x3002acc4
lea ebx, [ebx]
cmp edx, edi
jb 0x3002acc4
cmp dword [edx], 0x8b55ff8b
jne 0x3002af66
cmp byte [edx + 4], 0xec
je 0x3002af72
dec edx
cmp edx, ecx
ja 0x3002af50
xor esi, esi
jmp 0x3002b222
test edx, edx
je 0x3002acc4
mov ecx, edi
cmp ecx, esi
jae 0x3002acc4
cmp byte [ecx], 0xe8
jne 0x3002af95
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
cmp eax, edx
je 0x3002afa1
inc ecx
cmp ecx, esi
jb 0x3002af84
xor esi, esi
jmp 0x3002b222
lea esi, [ecx - 5]
add ecx, 0xfffff000
cmp esi, ecx
jbe 0x3002acc4
cmp esi, edi
jb 0x3002acc4
cmp dword [esi], 0x8b55ff8b
jne 0x3002afcc
cmp byte [esi + 4], 0xec
je 0x3002b222
dec esi
cmp esi, ecx
ja 0x3002afb2
xor esi, esi
jmp 0x3002b222
mov ecx, str.CDocument_write
mov eax, edi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002b000
test dl, dl
je 0x3002affc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002b000
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002afe0
xor eax, eax
jmp 0x3002b005
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002b11b
mov ecx, dword [ebp - 8]
mov edx, str..text
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.3004fdd0
add esp, 8
test eax, eax
jne 0x3002b033
xor esi, esi
jmp 0x3002b222
mov ebx, dword [ebp - 0x40]
mov edx, ebx
mov esi, dword [ebp - 0x18]
mov ecx, esi
push 6
push 0x30203858
call fcn.3004fd50
mov edx, eax
add esp, 8
mov dword [ebp - 0x40], edx
test edx, edx
jne 0x3002b05f
xor esi, esi
mov ebx, dword [ebp - 4]
jmp 0x3002b222
lea ecx, [ebx - 0xa]
mov dword [ebp - 0x1c], esi
cmp esi, ecx
jae 0x3002b055
lea ecx, [esi + 0xa]
mov dword [ebp - 0x20], ecx
lea eax, [ebx - 0xa]
cmp byte [esi], 0x68
jne 0x3002b101
cmp dword [ecx - 9], edx
jne 0x3002b101
cmp byte [ecx - 5], 0xe8
jne 0x3002b101
lea eax, [ecx + 0x76]
mov edi, ecx
cmp ecx, eax
jae 0x3002b0fe
cmp word [edi], 0x8c2
jne 0x3002b0f3
movzx eax, byte [edi + 2]
test al, al
jne 0x3002b0f3
lea edx, [ecx - 0x8a]
cmp esi, edx
jbe 0x3002b0f3
lea eax, [ecx - 0xd]
nop
cmp byte [eax + 3], 0xe8
jne 0x3002b0e5
lea esi, [eax + 8]
add esi, dword [eax + 4]
cmp esi, dword [ebp - 0x18]
jbe 0x3002b0e5
cmp esi, ebx
jae 0x3002b0e5
cmp byte [eax], 0xff
jne 0x3002b0d6
cmp byte [eax + 1], 0x75
jne 0x3002b0d6
cmp byte [eax + 2], 0x20
jb 0x3002b057
mov cl, byte [eax + 2]
and cl, 0xf8
cmp cl, 0x50
je 0x3002b057
dec eax
lea ecx, [eax + 3]
cmp ecx, edx
ja 0x3002b0b0
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc edi
lea eax, [ecx + 0x76]
cmp edi, eax
jb 0x3002b093
mov edx, dword [ebp - 0x40]
lea eax, [ebx - 0xa]
inc esi
inc ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
cmp esi, eax
jb 0x3002b072
mov ebx, dword [ebp - 4]
xor esi, esi
jmp 0x3002b222
mov eax, str.combase
mov cx, word [esi]
cmp cx, word [eax]
jne 0x3002b146
test cx, cx
je 0x3002b142
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x3002b146
add esi, 4
add eax, 4
test cx, cx
jne 0x3002b120
xor eax, eax
jmp 0x3002b14b
sbb eax, eax
or eax, 1
mov esi, dword [ebp - 8]
test eax, eax
jne 0x3002b18f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebx + 4]
mov ecx, esi
mov edi, eax
call fcn.30002700
mov esi, eax
test esi, esi
je 0x3002b226
cmp esi, edi
je 0x3002b222
push edi
push esi
push dword [ebx + 4]
push str.hook_api:_combase::_s_export_address_0x_p_differs_from_GetProcAddress____0x_p_n
call fcn.3000a0d0
add esp, 0x10
jmp 0x3002b222
mov edx, edi
mov ecx, esi
call fcn.30002700
push dword [ebx + 4]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test edi, edi
je 0x3002b222
test esi, esi
je 0x3002b1d8
cmp esi, edi
je 0x3002b24e
lea edx, [ebp - 0x44]
mov ecx, esi
call fcn.3004ddd0
push dword [ebp - 0x44]
push eax
push esi
push edi
push dword [ebx + 4]
push str.hook_api:_Warning____s_export_address_0x_p_differs_from_GetProcAddress____0x_p___s::0x_x__n
call fcn.3000a0d0
add esp, 0x18
jmp 0x3002b222
mov eax, dword [ebx]
mov ecx, str.clrjit
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x3002b206
test dx, dx
je 0x3002b202
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x3002b206
add eax, 4
add ecx, 4
test dx, dx
jne 0x3002b1e0
xor eax, eax
jmp 0x3002b20b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002b226
push edi
push dword [ebx + 4]
mov esi, edi
push str.hook_api:_clrjit::_s_export_address_0x_p_obtained_via_GetExportAddress_n
call fcn.3000a0d0
add esp, 0xc
test esi, esi
jne 0x3002b24e
cmp dword [ebx + 0x2c], 0
je 0x3002b246
cmp dword [ebx + 0x30], 0
je 0x3002b246
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.30004570
cmp eax, dword [ebx + 0x2c]
jne 0x3002b246
mov esi, dword [ebx + 0x30]
add esi, edi
test esi, esi
je 0x3002b77c
cmp esi, 0xffbadd11
je 0x3002b77c
mov eax, 0x2eb
cmp word [esi], ax
jne 0x3002b2b6
mov eax, dword [esi - 5]
lea ecx, [esi - 5]
mov edx, 0x301fa2d0
mov edi, 1
cmp eax, dword [edx]
jne 0x3002b283
add ecx, 4
mov edi, 0xfffffffd
add edx, 4
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x3002b2aa
cmp edi, 0xfffffffd
je 0x3002b2a6
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x3002b2aa
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x3002b2aa
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x3002b2aa
xor eax, eax
jmp 0x3002b2af
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002b2b6
add esi, 4
cmp dword [esi], 0x909005eb
jne 0x3002b2cf
cmp word [esi + 4], 0x9090
jne 0x3002b2cf
cmp byte [esi + 6], 0x90
jne 0x3002b2cf
add esi, 7
cmp byte [esi], 0xeb
jne 0x3002b2ea
movsx eax, byte [esi + 1]
mov ecx, 0x25ff
cmp word [eax + esi + 2], cx
jne 0x3002b33b
mov eax, dword [eax + esi + 4]
jmp 0x3002b332
cmp dword [esi], 0x8b55ff8b
jne 0x3002b33b
movzx eax, word [esi + 4]
cmp ax, 0x5dec
jne 0x3002b33b
mov al, byte [esi + 6]
lea ecx, [esi + 6]
cmp al, 0xeb
jne 0x3002b31c
movsx eax, byte [ecx + 1]
mov edx, 0x25ff
cmp word [eax + ecx + 2], dx
jne 0x3002b33b
mov eax, dword [eax + ecx + 4]
jmp 0x3002b332
cmp al, 0xe9
jne 0x3002b33b
call fcn.3002ab00
mov ecx, 0x25ff
cmp word [eax], cx
jne 0x3002b33b
mov eax, dword [eax + 2]
mov esi, dword [eax]
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
test eax, eax
je 0x3002b381
mov ecx, str.ntdll
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x3002b36c
test dx, dx
je 0x3002b368
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x3002b36c
add eax, 4
add ecx, 4
test dx, dx
jne 0x3002b346
xor eax, eax
jmp 0x3002b371
sbb eax, eax
or eax, 1
test eax, eax
jne 0x3002b381
cmp byte [esi], 0xb8
jne 0x3002b381
mov dword [ebp - 0xc], 0xb
mov eax, dword [ebx + 4]
mov ecx, 0x301fa2d8
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x3002b3b0
test dl, dl
je 0x3002b3ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x3002b3b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x3002b390
xor ecx, ecx
jmp 0x3002b3b5
sbb ecx, ecx
or ecx, 1
mov edx, esi
mov edi, 0x301fa2e8
mov ebx, 3
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x3002b3d0
add edx, 4
add edi, 4
or ebx, 0xffffffff
mov al, byte [edx]
cmp al, byte [edi]
jne 0x3002b3f7
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x3002b3f7
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x3002b3f7
cmp ebx, 0xffffffff
je 0x3002b3f3
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
jne 0x3002b3f7
xor edx, edx
jmp 0x3002b3fc
sbb edx, edx
or edx, 1
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xc]
neg edx
sbb edx, edx
and edx, ecx
cmp dword [esi], 0x90f302eb
jne 0x3002b414
add esi, 4
test edx, edx
jns 0x3002b435
cmp edx, 0xe
jb 0x3002b435
push edx
push str.WARNING:_Provided_invalid_hook_type:__d
call fcn.300509d0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10], 1
jne 0x3002b44a
cmp byte [esi], 0xb8
jne 0x3002b44a
cmp byte [esi + 5], 0xe9
je 0x3002b77c
mov edi, dword [0x30267454]
xor ecx, ecx
test edi, edi
je 0x3002b47f
jmp 0x3002b460
mov eax, dword [ecx*4 + 0x30245348]
cmp esi, eax
je 0x3002b77c
add eax, 5
cmp esi, eax
je 0x3002b77c
inc ecx
cmp ecx, edi
jb 0x3002b460
cmp edx, 0xd
jne 0x3002b4ae
mov eax, 0xff8b
cmp word [esi], ax
jne 0x3002b4ac
cmp dword [esi - 5], 0xcccccccc
jne 0x3002b49d
cmp byte [esi - 1], 0xcc
je 0x3002b4ae
cmp dword [esi - 5], 0x90909090
jne 0x3002b4ac
cmp byte [esi - 1], 0x90
je 0x3002b4ae
xor edx, edx
lea edi, [edx + edx*2]
shl edi, 2
lea eax, [ebp - 0x24]
push eax
push 0x40
mov dword [ebp - 0x10], edi
mov ecx, dword [edi + 0x3022f360]
mov eax, dword [edi + 0x3022f35c]
add eax, ecx
push eax
mov eax, esi
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x3002b75f
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x3002b4fd
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x3002b50c
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push 0x20c
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3002b543
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0xbf4], ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x3002b543
push eax
popfd
lea eax, [ebp - 0x48]
push eax
push 0x40
push 0x20c
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
test ebx, ebx
je 0x3002b74d
mov edx, dword [edi + 0x3022f35c]
mov ecx, esi
push ebx
call fcn.3002a320
add esp, 4
test eax, eax
je 0x3002b74a
mov eax, dword [esi]
mov ebx, dword [ebp - 4]
mov ecx, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x40], eax
cmp dword [ebx + 0x28], 0
mov eax, dword [esi + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x38], eax
je 0x3002b5a5
call fcn.3002a630
jmp 0x3002b5aa
call fcn.3002a430
mov eax, dword [ebx + 0x38]
sub eax, 0xffffff80
push eax
mov eax, dword [edi + 0x3022f358]
push esi
push ebx
call eax
mov ebx, esi
mov dword [ebp - 0x14], eax
sub ebx, dword [edi + 0x3022f360]
add esp, 0xc
mov edi, dword [0x30267454]
cmp edi, 0x7ff
jne 0x3002b5fc
cmp dword [0x30240ad4], 0
jne 0x3002b5ed
push str.CRITICAL:Reached_maximum_number_of_unhook_detection_entries_
call fcn.300509d0
add esp, 4
mov dword [0x30240ad4], 1
jmp 0x3002b6db
xor ecx, ecx
test edi, edi
je 0x3002b62f
jmp 0x3002b610
mov eax, dword [ecx*4 + 0x30245348]
cmp ebx, eax
je 0x3002b6db
add eax, 5
cmp ebx, eax
je 0x3002b6db
inc ecx
cmp ecx, edi
jb 0x3002b610
xor edx, edx
test edi, edi
je 0x3002b653
jmp 0x3002b640
cmp dword [edx*4 + 0x30245348], 0
je 0x3002b73a
inc edx
cmp edx, edi
jb 0x3002b640
mov edx, edi
mov eax, dword [ebp - 4]
mov ecx, edx
shl ecx, 5
mov dword [edx*4 + 0x30243348], eax
mov eax, dword [ebp - 0x44]
mov dword [edx*4 + 0x30240b48], 0x10
mov dword [ecx + 0x30257348], eax
mov eax, dword [ebp - 0x40]
mov dword [ecx + 0x3025734c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0x30257350], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 0x30257354], eax
mov eax, dword [ebx]
mov dword [ecx + 0x30247348], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 0x3024734c], eax
mov eax, dword [ebx + 8]
mov dword [ecx + 0x30247350], eax
mov eax, dword [ebx + 0xc]
mov dword [edx*4 + 0x30245348], ebx
mov dword [ecx + 0x30247354], eax
cmp edx, 0x800
jae 0x3002b785
mov byte [edx + 0x30242b48], 0
cmp edx, edi
jne 0x3002b6db
inc edi
mov dword [0x30267454], edi
cmp dword [ebp - 0x14], 0
jne 0x3002b70e
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x3002b6f0
mov eax, dword [edx + 0x38]
mov dword [ecx], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov dword [edx + 0x34], 1
mov dword [edx + 0xc], esi
call fcn.30002590
mov ecx, ebx
lea edx, [ebx + eax]
call fcn.3004d9e0
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi + 0x3022f360]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
mov eax, dword [edi + 0x3022f35c]
sub esi, ecx
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edx*4 + 0x30245348], 1
jmp 0x3002b655
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.WARNING:Unable_to_place_hook_on__z
call fcn.300509d0
add esp, 8
jmp 0x3002b711
mov eax, dword [ebp - 4]
push dword [eax + 4]
push str.WARNING:Unable_to_change_protection_for_hook_on__z
call fcn.300509d0
mov eax, dword [ebp - 0x14]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.3015a143
int3