Function at 0x10036821
Capabilities:
Create thread
Inject thread

Disassembly:
push 0x25c
mov eax, 0x100876fc
call fcn.10083e9c
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor ebx, ebx
cmp byte [0x103be369], bl
jne 0x10036a38
push ebx
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
pop ecx
pop ecx
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push 0x10098458
push ebx
mov dword [0x103be1c0], edx
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1010eafc], eax
call edi
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x10098180
mov dword [0x100f3d44], eax
call edi
push eax
call fcn.1003434b
pop ecx
pop ecx
push 0x10035805
push 0xfffffffffffffffc
push eax
mov dword [0x100e04bc], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x103be1c8], eax
cmp eax, ebx
je 0x10036d73
push ebx
push ebx
push ebx
push 0x100343c3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10342a38], 0x14
call fcn.10033a06
push ebx
xor eax, eax
lea edi, [ebp - 0x214]
push 4
stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
push 0xacdd4d
push dword [0x100f3d44]
mov byte [0x103be369], 1
call esi
mov eax, dword [ebp - 0x214]
push ebx
push 4
mov dword [0x10112354], eax
lea eax, [ebp - 0x214]
push eax
push 0x67b3b6
push dword [0x100f3d44]
call esi
mov eax, dword [ebp - 0x214]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push 6
mov dword [0x10112350], eax
lea eax, [ebp - 0x1c]
push eax
push 0xa21bf7
push dword [0x100f3d44]
mov dword [ebp - 0x1c], 0x90909090
mov dword [ebp - 0x18], 0x90909090
mov word [ebp - 0x14], 0x9090
call edi
push str.recv
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10098440
push str.kernel32.dll
mov dword [0x103be154], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 5
push 0x103be1cc
push dword [0x103be154]
mov dword [0x103bde9c], eax
push dword [0x100f3d44]
call esi
mov eax, dword [0x103be154]
push ebx
push 5
push 0x103be200
mov ecx, 0x10033fb8
sub ecx, eax
push eax
push dword [0x100f3d44]
sub ecx, 5
mov byte [0x103be200], 0xe9
mov dword [0x103be201], ecx
call edi
push 0x10098424
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 5
mov dword [0x103be14c], eax
push 0x103bdf10
push eax
push dword [0x100f3d44]
call esi
mov eax, dword [0x103be14c]
push ebx
push 5
push 0x103bdedc
mov ecx, 0x100346c8
sub ecx, eax
push eax
push dword [0x100f3d44]
sub ecx, 5
mov byte [0x103bdedc], 0xe9
mov dword [0x103bdedd], ecx
call edi
cmp byte [0x103be368], bl
jne 0x10036d73
push ebx
push ebx
push ebx
mov byte [0x103be368], 1
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov edi, 0x1f4
push edi
mov dword [0x103bde98], eax
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x210]
push eax
push 0x1008b430
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strlen
sub eax, 8
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10111b20
call fcn.100061f2
push edi
call sub.mfc100.dll_Ordinal_265
add esp, 0x14
mov edi, eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], ebx
call fcn.100041d3
push 0x10111b20
push str._sMap__bkBrush.jpg
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push edi
lea ecx, [ebp - 0x268]
call fcn.10004b24
lea ecx, [ebp - 0x268]
call fcn.10004213
push eax
lea ecx, [ebp - 0x218]
call sub.mfc100.dll_Ordinal_2184
push dword [ebp - 0x214]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, 0x100a6398
call sub.mfc100.dll_Ordinal_2184
push edi
call sub.mfc100.dll_Ordinal_1296
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
pop ecx
push ebx
call edi
push 0xd8e4f1
mov dword [0x100a6c78], eax
call edi
push ebx
push 5
pop edi
push edi
push 0x10112220
push 0xa7cd40
push dword [0x100f3d44]
mov dword [0x100a6c74], eax
call esi
push ebx
push edi
push 0x101121bc
push 0x67ca03
push dword [0x100f3d44]
call esi
push ebx
push 6
push 0x101121a8
push 0x7576b0
push dword [0x100f3d44]
call esi
push ebx
push 8
push 0x10112194
push 0x6b6b8a
push dword [0x100f3d44]
call esi
push ebx
push 6
push 0x1011216c
push 0x6c19be
push dword [0x100f3d44]
call esi
push ebx
push edi
push 0x101121f8
push 0x67b3b5
push dword [0x100f3d44]
call esi
push ebx
push edi
push 0x101121e4
push 0xacdd4c
push dword [0x100f3d44]
call esi
mov eax, dword [0x34ccfc4]
mov edi, dword [eax]
push ebx
push 5
push 0x10112160
push dword [edi + 0x144]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10112154
push dword [edi + 0x148]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10112148
push dword [edi + 0x14c]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10111ee4
push dword [edi + 0x150]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10111dac
push dword [edi + 0x44]
push dword [0x100f3d44]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x1c
lea eax, [ebp - 0x234]
push eax
mov edi, 0xd9317c
push edi
push dword [0x100f3d44]
call esi
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x228]
push edi
push dword [0x100f3d44]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call edi
push 0x1c
lea eax, [ebp - 0x234]
push eax
mov ebx, 0xd93198
push ebx
push dword [0x100f3d44]
call esi
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x228]
push ebx
push dword [0x100f3d44]
call edi
push 0x1c
lea eax, [ebp - 0x234]
push eax
mov ebx, 0xd92f8c
push ebx
push dword [0x100f3d44]
call esi
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x228]
push ebx
push dword [0x100f3d44]
call edi
push 0x100983f4
push 0x101123e8
call sub.MSVCR100.dll_strcpy
push 0x100983e4
push 0x10112401
call sub.MSVCR100.dll_strcpy
push 0x100983d8
push 0x1011241a
call sub.MSVCR100.dll_strcpy
push 0x100983c8
push 0x10112433
call sub.MSVCR100.dll_strcpy
push 0x100983bc
push 0x1011244c
call sub.MSVCR100.dll_strcpy
push 0x100983ac
push 0x10112465
call sub.MSVCR100.dll_strcpy
push 0x1009839c
push 0x1011247e
call sub.MSVCR100.dll_strcpy
add esp, 0x38
lea ecx, [ebp - 0x268]
call fcn.100046bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
call fcn.10001444
call fcn.10083f1f
ret