Function at 0x30023b80
Capabilities:
Accept command line arguments
Access peb ldr_data
Create thread
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x3021ae88]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
pushfd
mov eax, dword fs:[0x18]
pop ecx
mov dword [esp + 0x20], ecx
test eax, eax
jne 0x30023bbf
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
jmp 0x30023bd0
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
cmp dword [ebp + 0xc], 1
jne 0x30024442
push str.KiUserExceptionDispatcher
push 0x301e6ac8
mov dword [esp + 0x3c], 0x80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov edi, eax
xor esi, esi
cmp byte [edi], 0xe8
je 0x30023c16
mov ecx, edi
call fcn.30029510
add esi, eax
cmp byte [esi + edi], 0xe8
lea ecx, [esi + edi]
jne 0x30023c06
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xe9
je 0x30023c54
cmp al, 0xe8
je 0x30023c54
cmp al, 0xf
jne 0x30023c39
mov al, byte [ecx + 1]
add al, 0x80
cmp al, 0xf
ja 0x30023c39
mov eax, dword [ecx + 2]
add ecx, 6
jmp 0x30023c5a
push 0x254
push str.d:workcapecapemoncapemon23hooking_32.c
push 0x301fe0d0
call fcn.3016b269
add esp, 0xc
xor ecx, ecx
jmp 0x30023c5c
mov eax, dword [ecx + 1]
add ecx, 5
add ecx, eax
cmp dword [ecx], 0x25ffff8b
je 0x30024486
mov eax, 0x25ff
cmp word [ecx], ax
je 0x30024486
cmp word [ecx], 0xff8b
jne 0x30023c87
cmp byte [ecx + 2], 0xe9
je 0x30024486
cmp byte [ecx], 0xe9
je 0x30024486
mov eax, 0xf9eb
cmp word [ecx], ax
je 0x30024486
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x301e6ac8
mov dword [0x3026c324], esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x50]
mov dword [0x3026c32c], eax
call edi
push 0x302713a0
mov dword [0x3026c318], eax
mov dword [0x302713a0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x301e6ac8
call edi
mov edi, eax
test edi, edi
je 0x30023ded
push str.NtDelayExecution
push edi
call ebx
push str.NtQuerySystemInformation
push edi
mov dword [0x302456c4], eax
call ebx
push str.NtQueryInformationProcess
push edi
mov dword [0x302456c0], eax
call ebx
push str.NtSetInformationProcess
push edi
mov dword [0x30245644], eax
call ebx
push str.NtQueryInformationThread
push edi
mov dword [0x302727dc], eax
call ebx
push str.NtQueryObject
push edi
mov dword [0x30245550], eax
call ebx
push str.NtQueryKey
push edi
mov dword [0x30245554], eax
call ebx
push str.NtQueryAttributesFile
push edi
mov dword [0x30245640], eax
call ebx
push str.NtAllocateVirtualMemory
push edi
mov dword [0x30245548], eax
call ebx
push str.NtProtectVirtualMemory
push edi
mov dword [0x302727d4], eax
call ebx
push str.NtFreeVirtualMemory
push edi
mov dword [0x302727b8], eax
call ebx
push str.LdrRegisterDllNotification
push edi
mov dword [0x302727d8], eax
call ebx
push str.SystemFunction036
push str.advapi32
mov dword [0x302727c8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
push str.NtMapViewOfSection
push edi
mov dword [0x302456b8], eax
call ebx
push str.RtlEqualUnicodeString
push edi
mov dword [0x302727b4], eax
call ebx
push str.NtUnmapViewOfSection
push edi
mov dword [0x3024554c], eax
call ebx
push str.RtlAdjustPrivilege
push edi
mov dword [0x302727b0], eax
call ebx
push str.RtlNtStatusToDosError
push edi
mov dword [0x302727bc], eax
call ebx
push str.RtlCompareMemory
push edi
mov dword [0x302727e0], eax
call ebx
mov dword [0x3026c330], eax
push 0
push 0x400000
push 0
mov dword [fcn.3016827f], 0x30023a50
mov dword [fcn.3016e10c], 0x30023ab0
mov dword [fcn.30168264], 0x30023b10
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x301fd95c
push 0x301fd96c
mov dword [0x30271450], eax
mov dword [0x30271434], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
test edi, edi
je 0x30023e52
push 0x30271434
call ebx
push eax
call edi
cmp dword [0x3026f250], 0
je 0x30023e72
call fcn.30005b70
push str.Standalone_mode_initialised._n
call fcn.30009b00
add esp, 4
jmp 0x3002446a
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x3026c680
call edi
push 0x3026c6a0
call edi
call fcn.3004c890
mov dword [0x3026d714], 0
mov dword [0x3026d718], 0
call fcn.300238b0
call fcn.300236c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x30271440], eax
call fcn.30021ef0
test eax, eax
je 0x30024486
mov ecx, 0x3026de9c
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30023ed0
sub ecx, edx
sar ecx, 1
je 0x30023f05
push ecx
push 0x3026de9c
push dword [0x3027144c]
call fcn.30169d44
add esp, 0xc
test eax, eax
jne 0x30023f05
cmp dword [0x3026e7d0], eax
je 0x30024486
cmp dword [0x3026e7fc], 0
je 0x30023f3d
push fcn.300231c0
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push fcn.300231c0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 3
push 0
call fcn.3016aaea
add esp, 8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x30023f9f
nop
cmp dword [edx + 0x18], esi
je 0x30023f5d
mov edx, dword [edx]
cmp edx, eax
jne 0x30023f50
jmp 0x30023f9f
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
push str.GETPIDS:
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.3004e0d0
mov edx, dword [esp + 0x40]
add esp, 0xc
shr edx, 2
test edx, edx
je 0x30023fdc
mov eax, dword [0x302452ec]
lea esi, [esp + 0x60]
mov ecx, edx
lea edi, [eax*4 + 0x302452f0]
add eax, edx
rep movsd dword es:[edi], dword [esi]
mov dword [0x302452ec], eax
lea eax, [esp + 0x10]
push eax
push 0x18
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x3002404c
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 1
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x30024042
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x30024042
mov ecx, dword [esp + 0x18]
call fcn.30001150
mov esi, eax
test esi, esi
je 0x30024042
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push esi
push 1
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x30024092
mov ecx, esi
call fcn.300011f0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push str.REGISTRYUSER_
mov edi, eax
call esi
add edi, eax
mov dword [0x302727c4], edi
lea ecx, [edi*2 + 2]
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x300240a0
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x300240a9
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
jmp 0x3002404e
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push ecx
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x300240d2
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x300240d2
push ebx
popfd
mov ecx, 8
mov dword [0x302727c0], eax
mov esi, str.REGISTRYUSER_
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x1c]
mov esi, edx
jmp 0x300240f0
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x300240f0
mov edi, dword [0x302727c0]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x30024106
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x3026f274], 0
jne 0x30024153
cmp dword [0x3026e7fc], 0
jne 0x30024149
cmp dword [0x3026f250], 0
jne 0x30024149
xor ecx, ecx
jmp 0x3002414e
mov ecx, 1
call fcn.300496a0
mov esi, dword [0x3026e7d0]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x3c]
mov dword [0x302450dc], eax
mov eax, dword [esp + 0x38]
mov dword [0x302450d8], eax
test esi, esi
jne 0x3002419e
cmp dword [0x30234000], esi
je 0x3002419e
cmp dword [0x3026e7f4], 1
jge 0x3002419e
push str.INFO:Disabling_sleep_skipping.
call fcn.3004de10
add esp, 4
mov dword [0x30234000], esi
mov eax, dword [0x3026e7dc]
mov ecx, 0x2710
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3026c304
push 0
mul ecx
push 0
add dword [0x3026d6e8], eax
push 0x3004e3b0
adc dword [0x3026d6ec], edx
push 0
push 0
call edi
push 0x3026c308
push 0
push 0
push 0x3004e700
push 0
push 0
mov dword [0x3024573c], eax
call edi
cmp dword [0x3024573c], 0
mov dword [0x3026c050], eax
je 0x300241fb
test eax, eax
jne 0x30024208
push str.CRITICAL:Error_initializing_unhook_detection_threads_
call fcn.3004de10
add esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
movzx eax, word [esi + 0x2e]
mov word [0x3026c03a], ax
movzx eax, word [esi + 0x2c]
mov word [0x3026c038], ax
movzx ecx, word [esi + 0x2e]
pushfd
mov eax, dword fs:[0x18]
pop dword [esp + 0x2c]
test eax, eax
jne 0x30024248
or ebx, 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x30024255
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x14], eax
push ecx
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [esp + 0x30], eax
test ecx, ecx
je 0x3002428a
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0xbf4], edx
test eax, eax
je 0x3002428a
push eax
popfd
movzx eax, word [0x3026c038]
mov ecx, dword [esp + 0x30]
push eax
mov dword [0x3026c03c], ecx
push dword [esi + 0x30]
push ecx
call fcn.30160350
movzx eax, word [esi + 0x26]
add esp, 0xc
mov word [0x3026c046], ax
movzx eax, word [esi + 0x24]
mov word [0x3026c044], ax
movzx ecx, word [esi + 0x26]
pushfd
mov eax, dword fs:[0x18]
pop dword [esp + 0x30]
test eax, eax
jne 0x300242dc
or ebx, 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x300242e9
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x14], eax
push ecx
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [esp + 0x2c], eax
test ecx, ecx
je 0x3002431e
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0xbf4], edx
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x3002431e
push ecx
popfd
mov dword [0x3026c048], eax
movzx eax, word [0x3026c044]
push eax
push dword [esi + 0x28]
push dword [esp + 0x34]
call fcn.30160350
add esp, 0xc
push 0x3026c314
push 0
push 0
push 0x3004e940
push 0
push 0
call edi
mov dword [0x3026c030], eax
test eax, eax
jne 0x30024364
push str.CRITICAL:Error_initializing_procname_watch_thread_
call fcn.3004de10
add esp, 4
push 1
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x3026e6cc
lea eax, [esp + 0x50]
mov dword [esp + 0x44], 0xc
push 0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push 0
push eax
mov dword [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x3026c30c
push 0
push 0
push 0x3004e780
push 0
push 0
mov dword [0x3026c300], eax
call edi
cmp dword [0x3026c300], 0
mov dword [0x3026c040], eax
je 0x300243d9
test eax, eax
jne 0x300243e6
push str.CRITICAL:Error_initializing_terminate_event_thread_
call fcn.3004de10
add esp, 4
push 0x3026d720
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.30005b70
call fcn.3004af40
call fcn.3002ab20
call fcn.30005950
cmp dword [0x3026e7d8], 0
jne 0x30024421
mov eax, dword fs:[0x30]
cmp dword [eax + 0x64], 1
jne 0x30024421
mov dword [eax + 0x64], 2
cmp dword [0x3026f274], 0
jne 0x3002443e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.LOADED:_d
call fcn.3004de10
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword fs:[0x18]
mov byte [0x3027139c], 1
test eax, eax
je 0x3002446a
mov edx, dword [esp + 0x24]
mov dword [eax + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xbf4], edx
test ecx, ecx
je 0x3002446a
push ecx
popfd
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword fs:[0x18]
test eax, eax
je 0x300244ab
mov edx, dword [esp + 0x24]
mov dword [eax + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xbf4], edx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x300244ab
push eax
popfd
mov ecx, dword [esp + 0xe4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret 0xc