Function at 0x300248b0
Capabilities:
Accept command line arguments
Access peb ldr_data
Create thread
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x30215e88]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
pushfd
mov eax, dword fs:[0x18]
pop ecx
mov dword [esp + 0x18], ecx
test eax, eax
jne 0x300248ef
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
jmp 0x30024900
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
cmp dword [ebp + 0xc], 1
jne 0x3002517b
push str.KiUserExceptionDispatcher
push 0x301e2b38
mov dword [esp + 0x3c], 0x80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov edi, eax
xor esi, esi
cmp byte [edi], 0xe8
je 0x30024946
mov ecx, edi
call fcn.3002a270
add esi, eax
cmp byte [esi + edi], 0xe8
lea ecx, [esi + edi]
jne 0x30024936
mov al, byte [esi + edi]
lea ecx, [esi + edi]
cmp al, 0xe9
je 0x30024984
cmp al, 0xe8
je 0x30024984
cmp al, 0xf
jne 0x30024969
mov al, byte [ecx + 1]
add al, 0x80
cmp al, 0xf
ja 0x30024969
mov eax, dword [ecx + 2]
add ecx, 6
jmp 0x3002498a
push 0x255
push str.d:workcapecapemoncapemon27hooking_32.c
push 0x301fa138
call fcn.30167119
add esp, 0xc
xor ecx, ecx
jmp 0x3002498c
mov eax, dword [ecx + 1]
add ecx, 5
add ecx, eax
cmp dword [ecx], 0x25ffff8b
je 0x300251bf
mov eax, 0x25ff
cmp word [ecx], ax
je 0x300251bf
cmp word [ecx], 0xff8b
jne 0x300249b7
cmp byte [ecx + 2], 0xe9
je 0x300251bf
cmp byte [ecx], 0xe9
je 0x300251bf
mov eax, 0xf9eb
cmp word [ecx], ax
je 0x300251bf
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x301e2b38
mov dword [0x30267724], esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x50]
mov dword [0x3026772c], eax
call edi
push 0x3026d800
mov dword [0x30267718], eax
mov dword [0x3026d800], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x301e2b38
call edi
mov edi, eax
test edi, edi
je 0x30024b1d
push str.NtDelayExecution
push edi
call ebx
push str.NtQuerySystemInformation
push edi
mov dword [0x30240acc], eax
call ebx
push str.NtQueryInformationProcess
push edi
mov dword [0x30240ac8], eax
call ebx
push str.NtSetInformationProcess
push edi
mov dword [0x30240a4c], eax
call ebx
push str.NtQueryInformationThread
push edi
mov dword [0x3026e5dc], eax
call ebx
push str.NtQueryObject
push edi
mov dword [0x30240958], eax
call ebx
push str.NtQueryKey
push edi
mov dword [0x3024095c], eax
call ebx
push str.NtQueryAttributesFile
push edi
mov dword [0x30240a48], eax
call ebx
push str.NtAllocateVirtualMemory
push edi
mov dword [0x30240950], eax
call ebx
push str.NtProtectVirtualMemory
push edi
mov dword [0x3026e5d4], eax
call ebx
push str.NtFreeVirtualMemory
push edi
mov dword [0x3026e5b8], eax
call ebx
push str.LdrRegisterDllNotification
push edi
mov dword [0x3026e5d8], eax
call ebx
push str.SystemFunction036
push str.advapi32
mov dword [0x3026e5c8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
push str.NtMapViewOfSection
push edi
mov dword [0x30240ac0], eax
call ebx
push str.RtlEqualUnicodeString
push edi
mov dword [0x3026e5b4], eax
call ebx
push str.NtUnmapViewOfSection
push edi
mov dword [0x30240954], eax
call ebx
push str.RtlAdjustPrivilege
push edi
mov dword [0x3026e5b0], eax
call ebx
push str.RtlNtStatusToDosError
push edi
mov dword [0x3026e5bc], eax
call ebx
push str.RtlCompareMemory
push edi
mov dword [0x3026e5e0], eax
call ebx
mov dword [0x30267730], eax
push 0
push 0x400000
push 0
mov dword [fcn.3016413f], 0x30024790
mov dword [fcn.3016a0ac], 0x300247f0
mov dword [fcn.30164124], 0x30024850
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x301f99c4
push 0x301f99d4
mov dword [0x3026d8b0], eax
mov dword [0x3026d894], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
test edi, edi
je 0x30024b82
push 0x3026d894
call ebx
push eax
call edi
call fcn.3004f450
mov dword [0x30269794], 0
mov dword [0x30269798], 0
call fcn.300245f0
call fcn.30024420
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [0x3026b2b8], 0
mov dword [0x3026d8a0], eax
je 0x30024bd0
call fcn.30006190
push str.Standalone_mode_initialised._n
call fcn.3000a0d0
add esp, 4
jmp 0x300251a3
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x30268700
call edi
push 0x30268720
call edi
call fcn.30022860
test eax, eax
je 0x300251bf
mov ecx, 0x30269efc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30024c00
sub ecx, edx
sar ecx, 1
je 0x30024c35
push ecx
push 0x30269efc
push dword [0x3026d8a8]
call fcn.30164487
add esp, 0xc
test eax, eax
jne 0x30024c35
cmp dword [0x3026a830], eax
je 0x300251bf
cmp dword [0x3026a85c], 0
je 0x30024c6d
push fcn.30023f20
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push fcn.30023f20
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 3
push 0
call fcn.3016699a
add esp, 8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x30024ccf
nop
cmp dword [edx + 0x18], esi
je 0x30024c8d
mov edx, dword [edx]
cmp edx, eax
jne 0x30024c80
jmp 0x30024ccf
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
push str.GETPIDS:
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.30050c90
mov edx, dword [esp + 0x40]
add esp, 0xc
shr edx, 2
test edx, edx
je 0x30024d0c
mov eax, dword [0x302406f4]
lea esi, [esp + 0x60]
mov ecx, edx
lea edi, [eax*4 + 0x302406f8]
add eax, edx
rep movsd dword es:[edi], dword [esi]
mov dword [0x302406f4], eax
lea eax, [esp + 0x10]
push eax
push 0x18
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x30024d7c
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 1
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x30024d72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x30024d72
mov ecx, dword [esp + 0x1c]
call fcn.30001150
mov esi, eax
test esi, esi
je 0x30024d72
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push esi
push 1
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x30024dc2
mov ecx, esi
call fcn.300011f0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
push dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push str.REGISTRYUSER_
mov edi, eax
call esi
add edi, eax
mov dword [0x3026e5c4], edi
lea ecx, [edi*2 + 2]
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30024dd0
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30024dd9
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
jmp 0x30024d7e
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push ecx
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x30024e02
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30024e02
push ebx
popfd
mov ecx, 8
mov dword [0x3026e5c0], eax
mov esi, str.REGISTRYUSER_
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x20]
mov esi, edx
jmp 0x30024e20
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x30024e20
mov edi, dword [0x3026e5c0]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x30024e36
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x3026b2e0], 0
jne 0x30024e83
cmp dword [0x3026a85c], 0
jne 0x30024e79
cmp dword [0x3026b2b8], 0
jne 0x30024e79
xor ecx, ecx
jmp 0x30024e7e
mov ecx, 1
call fcn.3004c030
mov esi, dword [0x3026a830]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x3c]
mov dword [0x302404f4], eax
mov eax, dword [esp + 0x38]
mov dword [0x302404f0], eax
test esi, esi
jne 0x30024ece
cmp dword [0x3022f460], esi
je 0x30024ece
cmp dword [0x3026a854], 1
jge 0x30024ece
push str.INFO:Disabling_sleep_skipping.
call fcn.300509d0
add esp, 4
mov dword [0x3022f460], esi
mov eax, dword [0x3026a83c]
mov ecx, 0x2710
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x30267704
push 0
mul ecx
push 0
add dword [0x30269768], eax
push 0x30050f70
adc dword [0x3026976c], edx
push 0
push 0
call edi
push 0x30267708
push 0
push 0
push 0x300512c0
push 0
push 0
mov dword [0x30240b44], eax
call edi
cmp dword [0x30240b44], 0
mov dword [0x30267458], eax
je 0x30024f2b
test eax, eax
jne 0x30024f38
push str.CRITICAL:Error_initializing_unhook_detection_threads_
call fcn.300509d0
add esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
movzx eax, word [esi + 0x2e]
mov word [0x30267442], ax
movzx eax, word [esi + 0x2c]
mov word [0x30267440], ax
movzx ecx, word [esi + 0x2e]
pushfd
mov eax, dword fs:[0x18]
pop dword [esp + 0x2c]
test eax, eax
jne 0x30024f78
or ebx, 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x30024f85
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x14], eax
push ecx
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [esp + 0x30], eax
test ecx, ecx
je 0x30024fba
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0xbf4], edx
test eax, eax
je 0x30024fba
push eax
popfd
movzx eax, word [0x30267440]
mov ecx, dword [esp + 0x30]
push eax
mov dword [0x30267444], ecx
push dword [esi + 0x30]
push ecx
call fcn.3015c210
movzx eax, word [esi + 0x26]
add esp, 0xc
mov word [0x3026744e], ax
movzx eax, word [esi + 0x24]
mov word [0x3026744c], ax
movzx ecx, word [esi + 0x26]
pushfd
mov eax, dword fs:[0x18]
pop dword [esp + 0x30]
test eax, eax
jne 0x3002500c
or ebx, 0xffffffff
mov dword [esp + 0x14], 0xffffffff
jmp 0x30025019
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [esp + 0x14], eax
push ecx
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov dword [esp + 0x2c], eax
test ecx, ecx
je 0x3002504e
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0xbf4], edx
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x3002504e
push ecx
popfd
mov dword [0x30267450], eax
movzx eax, word [0x3026744c]
push eax
push dword [esi + 0x28]
push dword [esp + 0x34]
call fcn.3015c210
add esp, 0xc
push 0x30267714
push 0
push 0
push 0x300514f0
push 0
push 0
call edi
mov dword [0x30267438], eax
test eax, eax
jne 0x30025094
push str.CRITICAL:Error_initializing_procname_watch_thread_
call fcn.300509d0
add esp, 4
push 1
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x3026a72c
lea eax, [esp + 0x50]
mov dword [esp + 0x44], 0xc
push 0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push 0
push eax
mov dword [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x3026770c
push 0
push 0
push 0x30051340
push 0
push 0
mov dword [0x30267700], eax
call edi
cmp dword [0x30267700], 0
mov dword [0x30267448], eax
je 0x30025109
test eax, eax
jne 0x30025116
push str.CRITICAL:Error_initializing_terminate_event_thread_
call fcn.300509d0
add esp, 4
push 0x302697a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.30006190
call fcn.3004da60
call fcn.3002b8f0
call fcn.30005f70
cmp dword [0x3026a838], 0
jne 0x30025151
mov eax, dword fs:[0x30]
cmp dword [eax + 0x64], 1
jne 0x30025151
mov dword [eax + 0x64], 2
cmp dword [0x3026b2e0], 0
jne 0x30025177
cmp dword [0x3026b2bc], 0
jne 0x30025177
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.LOADED:_d
call fcn.300509d0
add esp, 8
mov ecx, dword [esp + 0x18]
mov eax, dword fs:[0x18]
mov byte [0x3026d7e0], 1
test eax, eax
je 0x300251a3
mov edx, dword [esp + 0x24]
mov dword [eax + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xbf4], edx
test ecx, ecx
je 0x300251a3
push ecx
popfd
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword fs:[0x18]
test eax, eax
je 0x300251e4
mov edx, dword [esp + 0x24]
mov dword [eax + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xbf4], edx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x300251e4
push eax
popfd
mov ecx, dword [esp + 0xe4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret 0xc