Function at 0x10035a40
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008f396
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [0x101a495c], bl
jne 0x10035aaf
mov eax, dword [0x101a4958]
cmp eax, ebx
jne 0x10035a9f
push str._ClearGHook__YAHPAUHWND_____Z
push str.yb_key.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101a4958], eax
jmp 0x10035aaf
mov eax, dword [eax + 0x13]
mov eax, dword [eax]
cmp eax, ebx
jle 0x10035aaf
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x101a4956], bl
jne 0x10035b17
push str.yb_mem.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
jle 0x10035b17
mov ecx, dword [0x100fe7b4]
push ebx
push 1
push 0x1011cc08
lea edi, [eax + 0xaacf]
push edi
push ecx
call esi
mov al, 0x90
cmp byte [0x1011cc08], al
jne 0x10035af7
mov byte [0x101a4956], 1
jmp 0x10035b17
mov edx, dword [0x100fe7b4]
push ebx
push 2
push 0x1011cc08
push edi
push edx
mov byte [0x1011cc08], al
mov byte [0x1011cc09], al
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x101a4955], bl
jne 0x10035c11
push ebx
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 8
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push 0x1009e228
push ebx
mov dword [0x101a46e8], edx
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1011956c], eax
call edi
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x1009e114
mov dword [0x100fe7b4], eax
call edi
push eax
call fcn.10034b20
add esp, 8
push ebx
push ebx
push ebx
push 0x10034bd0
push ebx
push ebx
mov dword [0x100eaf2c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x100fe7b4]
push ebx
push 4
lea edx, [ebp - 0x208]
push edx
push 0xafdf4e
push eax
mov dword [0x1012d3cc], 0xa
mov byte [0x101a4955], 1
mov dword [ebp - 0x208], ebx
call esi
mov eax, dword [0x100fe7b4]
mov ecx, dword [ebp - 0x208]
push ebx
push 4
lea edx, [ebp - 0x208]
push edx
push 0x697a00
push eax
mov dword [0x1011cd0c], ecx
call esi
mov ecx, dword [ebp - 0x208]
push 0x1009e218
push str.kernel32.dll
mov dword [0x1011cd08], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101a43c4], eax
cmp byte [0x101a4954], bl
jne 0x10036068
push ebx
push ebx
push ebx
mov byte [0x101a4954], 1
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push 0x1f4
lea edx, [ebp - 0x204]
push ebx
push edx
mov dword [0x101a43c0], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1f4
lea eax, [ebp - 0x204]
push eax
push 0x1009e1fc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x204]
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10035c70
sub eax, edi
add eax, 0xfffffff8
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0x1011c4d0
call fcn.10006dd0
push 0x1f4
call sub.mfc100.dll_Ordinal_265
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x208], ebx
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 4], ebx
call fcn.10003060
push 0x1011c4d0
push str._sMap__bkBrush.jpg
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push edi
lea ecx, [ebp - 0x25c]
call fcn.100043c0
mov eax, dword [ebp - 0x258]
or ecx, 0xffffffff
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
push eax
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x248], ebx
mov word [ebp - 0x240], bx
call sub.mfc100.dll_Ordinal_2184
mov edx, dword [ebp - 0x208]
push edx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, 0x100ae39c
call sub.mfc100.dll_Ordinal_2184
push edi
call sub.mfc100.dll_Ordinal_1296
add esp, 4
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push ebx
push 5
push 0x1011cbf4
mov dword [0x100b12e8], eax
mov eax, dword [0x100fe7b4]
push 0xaac8c0
push eax
call esi
mov ecx, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cb90
push 0x699333
push ecx
call esi
mov edx, dword [0x100fe7b4]
push ebx
push 6
push 0x1011cb7c
push 0x7786b0
push edx
call esi
mov eax, dword [0x100fe7b4]
push ebx
push 8
push 0x1011cb68
push 0x6d3ac1
push eax
call esi
mov ecx, dword [0x100fe7b4]
push ebx
push 6
push 0x1011cb40
push 0x6de626
push ecx
call esi
mov edx, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cbcc
push 0x6979ff
push edx
call esi
mov eax, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cbb8
push 0xafdf4d
push eax
call esi
mov ecx, dword [0x35011d4]
mov edi, dword [ecx]
mov edx, dword [edi + 0x144]
mov eax, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cb34
push edx
push eax
call esi
mov ecx, dword [edi + 0x148]
mov edx, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cb28
push ecx
push edx
call esi
mov eax, dword [edi + 0x14c]
mov ecx, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cb1c
push eax
push ecx
call esi
mov edx, dword [edi + 0x150]
mov eax, dword [0x100fe7b4]
push ebx
push 5
push 0x1011cb10
push edx
push eax
call esi
mov ecx, dword [edi + 0x44]
mov edx, dword [0x100fe7b4]
push ebx
push 5
push 0x1011c8ac
push ecx
push edx
call esi
mov ecx, dword [0x100fe7b4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x1c
lea eax, [ebp - 0x228]
push eax
push 0xdc9d2c
push ecx
call esi
mov eax, dword [ebp - 0x21c]
mov ecx, dword [0x100fe7b4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea edx, [ebp - 0x214]
push edx
push 4
push eax
push 0xdc9d2c
push ecx
call edi
mov eax, dword [0x100fe7b4]
push 0x1c
lea edx, [ebp - 0x228]
push edx
push 0xdc9d48
push eax
call esi
mov edx, dword [ebp - 0x21c]
mov eax, dword [0x100fe7b4]
lea ecx, [ebp - 0x214]
push ecx
push 4
push edx
push 0xdc9d48
push eax
call edi
mov edx, dword [0x100fe7b4]
push 0x1c
lea ecx, [ebp - 0x228]
push ecx
push 0xdc9b14
push edx
call esi
mov ecx, dword [ebp - 0x21c]
mov edx, dword [0x100fe7b4]
lea eax, [ebp - 0x214]
push eax
push 4
push ecx
push 0xdc9b14
push edx
call edi
mov eax, dword [0x1009e1d8]
mov ecx, dword [0x1009e1dc]
mov edx, dword [0x1009e1e0]
mov dword [0x1011cd98], eax
movzx eax, word [0x1009e1e4]
mov dword [0x1011cd9c], ecx
mov ecx, dword [0x1009e1c8]
mov dword [0x1011cda0], edx
mov edx, dword [0x1009e1cc]
mov word [0x1011cda4], ax
mov eax, dword [0x1009e1d0]
mov dword [0x1011cdb1], ecx
movzx ecx, byte [0x1009e1d4]
mov dword [0x1011cdb5], edx
mov edx, dword [0x1009e1bc]
mov dword [0x1011cdb9], eax
mov eax, dword [0x1009e1c0]
mov byte [0x1011cdbd], cl
mov ecx, dword [0x1009e1c4]
mov dword [0x1011cdca], edx
mov edx, dword [0x1009e1ac]
mov dword [0x1011cdce], eax
mov eax, dword [0x1009e1b0]
mov dword [0x1011cdd2], ecx
mov ecx, dword [0x1009e1b4]
mov dword [0x1011cde3], edx
mov dl, byte [0x1009e1b8]
mov dword [0x1011cde7], eax
mov eax, dword [0x1009e1a0]
mov dword [0x1011cdeb], ecx
mov ecx, dword [0x1009e1a4]
mov byte [0x1011cdef], dl
mov edx, dword [0x1009e1a8]
mov dword [0x1011cdfc], eax
mov eax, dword [0x1009e190]
mov dword [0x1011ce00], ecx
mov ecx, dword [0x1009e194]
mov dword [0x1011ce04], edx
mov edx, dword [0x1009e198]
mov dword [0x1011ce15], eax
movzx eax, word [0x1009e19c]
mov dword [0x1011ce19], ecx
mov ecx, dword [0x1009e180]
mov dword [0x1011ce1d], edx
mov edx, dword [0x1009e184]
mov word [0x1011ce21], ax
mov eax, dword [0x1009e188]
mov dword [0x1011ce2e], ecx
mov dword [0x1011ce32], edx
movzx ecx, byte [0x1009e18c]
mov byte [0x1011ce3a], cl
lea ecx, [ebp - 0x25c]
mov dword [0x1011ce36], eax
call fcn.10003ce0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
call fcn.10001550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10086786
mov esp, ebp
pop ebp
ret