Function at 0x10035cf7
Capabilities:
Create thread
Inject thread

Disassembly:
push 0x26c
mov eax, 0x10087537
call fcn.1008296f
cmp byte [0x103d7778], 0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jne 0x10035f38
xor edi, edi
push edi
call dword [sym.imp.MSVCR100.dll__time64]
pop ecx
push eax
call dword [sym.imp.MSVCR100.dll_srand]
pop ecx
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push 0x10097248
push edi
mov dword [0x10113488], edx
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x100f315c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x100df8d4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10035923
mov dword [esp], 0x10034953
push 0xfffffffffffffffc
push eax
mov dword [0x100ded8c], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x10383294], eax
cmp eax, edi
je 0x1003629f
push edi
push edi
push edi
push 0x1003599b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
mov eax, 0x10032e98
sub eax, 0x8dfaa5
push 5
mov dword [ebp - 0x1b], eax
lea eax, [ebp - 0x1c]
push eax
push 0x8dfaa0
push dword [0x100df8d4]
mov dword [0x1035eee4], 0x14
mov byte [ebp - 0x1c], 0xe8
mov word [ebp - 0x17], 0x9090
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
lea edi, [ebp - 0x228]
stosd dword es:[edi], eax
xor edi, edi
push edi
push 4
lea eax, [ebp - 0x228]
push eax
push 0xace19d
push dword [0x100df8d4]
mov byte [0x103d7778], 1
call ebx
mov eax, dword [ebp - 0x228]
push edi
push 4
mov dword [0x10111768], eax
lea eax, [ebp - 0x228]
push eax
push 0x67b3b6
push dword [0x100df8d4]
call ebx
mov eax, dword [ebp - 0x228]
push edi
push 6
mov dword [0x10111764], eax
lea eax, [ebp - 0x28]
push eax
push 0xa22047
push dword [0x100df8d4]
mov dword [ebp - 0x28], 0x90909090
mov dword [ebp - 0x24], 0x90909090
mov word [ebp - 0x20], 0x9090
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.recv
push str.ws2_32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10097270
push str.kernel32.dll
mov dword [0x1011341c], eax
call esi
push eax
call edi
push 0
push 5
push 0x10383fbc
push dword [0x1011341c]
mov dword [0x10113164], eax
push dword [0x100df8d4]
call ebx
mov eax, dword [0x1011341c]
mov ecx, 0x100345be
push 0
sub ecx, eax
sub ecx, 5
push 5
mov byte [0x103bfb34], 0xe9
mov dword [0x103bfb35], ecx
push 0x103bfb34
push eax
push dword [0x100df8d4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x10097280
push str.user32.dll
call esi
push eax
call edi
xor edi, edi
push edi
push 5
push 0x101131d8
push eax
push dword [0x100df8d4]
mov dword [0x10113414], eax
call ebx
mov eax, dword [0x10113414]
push edi
push 5
push 0x101131a4
mov ecx, 0x10035c87
sub ecx, eax
push eax
push dword [0x100df8d4]
sub ecx, 5
mov byte [0x101131a4], 0xe9
mov dword [0x101131a5], ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x10035f3a
xor edi, edi
cmp byte [0x103d7779], 0
jne 0x1003629f
push edi
push edi
push edi
mov byte [0x103d7779], 1
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov edi, 0x1f4
push edi
mov dword [0x10113160], eax
lea eax, [ebp - 0x224]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x224]
push eax
push 0x1008a460
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
lea edi, [eax - 8]
pop ecx
lea eax, [ebp - 0x224]
push eax
mov esi, 0x10110f10
call fcn.100064fa
mov dword [esp], 0x1f4
call dword [sym.imp.mfc100.dll_Ordinal_265]
xor edi, edi
pop ecx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], vtable.CBitmap.0
lea esi, [ebp - 0x278]
mov dword [ebp - 4], edi
call fcn.10004efd
push 0x10110f10
mov byte [ebp - 4], 1
push str._sMap__bkBrush.jpg
push dword [ebp - 0x228]
call dword [sym.imp.MSVCR100.dll_sprintf]
mov ecx, dword [ebp - 0x228]
add esp, 0xc
mov eax, esi
push eax
call fcn.10004ce8
mov eax, dword [ebp - 0x274]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_2184]
or dword [ebp - 0x258], 0xffffffff
or dword [ebp - 0x254], 0xffffffff
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x264], edi
mov word [ebp - 0x25c], di
call esi
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, 0x100a5314
call esi
push dword [ebp - 0x228]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
pop ecx
push edi
call esi
push 0xd8e4f1
mov dword [0x100a6090], eax
call esi
mov dword [0x100a608c], eax
push edi
push 5
pop esi
push esi
push 0x10111634
push 0xa7d190
push dword [0x100df8d4]
call ebx
push edi
push esi
push 0x101115d0
push 0x67ca03
push dword [0x100df8d4]
call ebx
push edi
push 6
push 0x101115bc
push 0x757b10
push dword [0x100df8d4]
call ebx
push edi
push 8
push 0x101115a8
push 0x6b6b8a
push dword [0x100df8d4]
call ebx
push edi
push 6
push 0x10111580
push 0x6c19de
push dword [0x100df8d4]
call ebx
push edi
push esi
push 0x1011160c
push 0x67b3b5
push dword [0x100df8d4]
call ebx
push edi
push esi
push 0x101115f8
push 0xace19c
push dword [0x100df8d4]
call ebx
mov eax, dword [0x34cdfc4]
mov esi, dword [eax]
push edi
push 5
push 0x10111574
push dword [esi + 0x144]
push dword [0x100df8d4]
call ebx
push edi
push 5
push 0x10111568
push dword [esi + 0x148]
push dword [0x100df8d4]
call ebx
push edi
push 5
push 0x1011155c
push dword [esi + 0x14c]
push dword [0x100df8d4]
call ebx
push edi
push 5
push 0x10111550
push dword [esi + 0x150]
push dword [0x100df8d4]
call ebx
push edi
push 5
push 0x101112ec
push dword [esi + 0x44]
push dword [0x100df8d4]
call ebx
push 0x1c
lea eax, [ebp - 0x244]
push eax
mov edi, 0xd9419c
push edi
push dword [0x100df8d4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
call esi
lea eax, [ebp - 0x230]
push eax
push 4
push dword [ebp - 0x238]
push edi
push dword [0x100df8d4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call edi
push 0x1c
lea eax, [ebp - 0x244]
push eax
mov ebx, 0xd941b8
push ebx
push dword [0x100df8d4]
call esi
lea eax, [ebp - 0x230]
push eax
push 4
push dword [ebp - 0x238]
push ebx
push dword [0x100df8d4]
call edi
push 0x1c
lea eax, [ebp - 0x244]
push eax
mov ebx, 0xd93fac
push ebx
push dword [0x100df8d4]
call esi
lea eax, [ebp - 0x230]
push eax
push 4
push dword [ebp - 0x238]
push ebx
push dword [0x100df8d4]
call edi
mov esi, dword [sym.imp.MSVCR100.dll_strcpy]
push 0x100972ac
push 0x101117f8
call esi
push 0x100972bc
push 0x10111811
call esi
push 0x100972cc
push 0x1011182a
call esi
push 0x100972d8
push 0x10111843
call esi
push 0x100972e8
push 0x1011185c
call esi
push 0x100972f4
push 0x10111875
call esi
push 0x10097304
push 0x1011188e
call esi
add esp, 0x38
lea ecx, [ebp - 0x278]
call fcn.10004e9d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CBitmap.0
call fcn.100018f7
call fcn.100829f2
ret