Function at 0x10036767
Capabilities:
Create thread
Inject thread

Disassembly:
push 0x25c
mov eax, 0x1008730c
call fcn.10083aac
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor ebx, ebx
cmp byte [0x103be365], bl
jne 0x1003695d
push ebx
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
pop ecx
pop ecx
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push 0x10098418
push ebx
mov dword [0x103be1bc], edx
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1010eafc], eax
call edi
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x10098160
mov dword [0x100f3d44], eax
call edi
push eax
call fcn.10034294
pop ecx
pop ecx
push 0x1003574f
push 0xfffffffffffffffc
push eax
mov dword [0x100e04bc], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x103be1c4], eax
cmp eax, ebx
je 0x10036cac
push ebx
push ebx
push ebx
push 0x1003430c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10342a38], 0x14
call fcn.10033950
push ebx
xor eax, eax
lea edi, [ebp - 0x214]
push 4
stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
push 0x8df4e8
push dword [0x100f3d44]
mov byte [0x103be365], 1
call esi
mov eax, dword [ebp - 0x214]
push ebx
push 4
mov dword [0x10112354], eax
lea eax, [ebp - 0x214]
push eax
push 0x511f8a
push dword [0x100f3d44]
call esi
mov eax, dword [ebp - 0x214]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push 6
mov dword [0x10112350], eax
lea eax, [ebp - 0x1c]
push eax
push 0x843c8a
push dword [0x100f3d44]
mov dword [ebp - 0x1c], 0x90909090
mov dword [ebp - 0x18], 0x90909090
mov word [ebp - 0x14], 0x9090
call edi
push str.recv
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 5
push 0x103be1c8
push eax
push dword [0x100f3d44]
mov dword [0x103be150], eax
call esi
mov eax, dword [0x103be150]
push ebx
push 5
push 0x103be1fc
mov ecx, 0x10033f01
sub ecx, eax
push eax
push dword [0x100f3d44]
sub ecx, 5
mov byte [0x103be1fc], 0xe9
mov dword [0x103be1fd], ecx
call edi
push 0x10098404
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 5
push 0x103bdf0c
push eax
push dword [0x100f3d44]
mov dword [0x103be148], eax
call esi
mov eax, dword [0x103be148]
mov byte [0x103bded8], 0xe9
mov ecx, 0x10034611
push ebx
push 5
push 0x103bded8
sub ecx, eax
push eax
push dword [0x100f3d44]
sub ecx, 5
mov dword [0x103bded9], ecx
call edi
cmp byte [0x103be364], bl
jne 0x10036cac
push ebx
push ebx
push ebx
mov byte [0x103be364], 1
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov edi, 0x1f4
push edi
mov dword [0x103bde98], eax
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x210]
push eax
push 0x1008b430
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strlen
sub eax, 8
push eax
lea eax, [ebp - 0x210]
push eax
push 0x10111b20
call fcn.1000616e
push edi
call sub.mfc100.dll_Ordinal_265
add esp, 0x14
mov edi, eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], ebx
call fcn.100041c8
push 0x10111b20
push str._sMap__bkBrush.jpg
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push edi
lea ecx, [ebp - 0x268]
call fcn.10004b19
lea ecx, [ebp - 0x268]
call fcn.10004208
push eax
lea ecx, [ebp - 0x218]
call sub.mfc100.dll_Ordinal_2184
push dword [ebp - 0x214]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, 0x100a6398
call sub.mfc100.dll_Ordinal_2184
push edi
call sub.mfc100.dll_Ordinal_1296
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
pop ecx
push ebx
call edi
push 0xd8e4f1
mov dword [0x100a6c78], eax
call edi
push ebx
push 5
pop edi
push edi
push 0x10112220
push 0x899e50
push dword [0x100f3d44]
mov dword [0x100a6c74], eax
call esi
push ebx
push edi
push 0x101121bc
push 0x512ac3
push dword [0x100f3d44]
call esi
push ebx
push edi
push 0x101121a8
push 0x5d85a0
push dword [0x100f3d44]
call esi
push ebx
push 6
push 0x10112194
push 0x568061
push dword [0x100f3d44]
call esi
push ebx
push 6
push 0x10112180
push 0x8d39e5
push dword [0x100f3d44]
call esi
push ebx
push 6
push 0x1011216c
push 0x53b68a
push dword [0x100f3d44]
call esi
push ebx
push edi
push 0x101121f8
push 0x511f89
push dword [0x100f3d44]
call esi
push ebx
push edi
push 0x101121e4
push 0x8df4e7
push dword [0x100f3d44]
call esi
mov eax, dword [0x11f6d2c]
mov edi, dword [eax]
push ebx
push 5
push 0x10112160
push dword [edi + 0x144]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10112154
push dword [edi + 0x148]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10112148
push dword [edi + 0x14c]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10111ee4
push dword [edi + 0x150]
push dword [0x100f3d44]
call esi
push ebx
push 5
push 0x10111dac
push dword [edi + 0x44]
push dword [0x100f3d44]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x1c
lea eax, [ebp - 0x234]
push eax
mov edi, 0xae4084
push edi
push dword [0x100f3d44]
call esi
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x228]
push edi
push dword [0x100f3d44]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call edi
push 0x1c
lea eax, [ebp - 0x234]
push eax
mov ebx, 0xaec55c
push ebx
push dword [0x100f3d44]
call esi
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x228]
push ebx
push dword [0x100f3d44]
call edi
push 0x1c
lea eax, [ebp - 0x234]
push eax
mov ebx, 0xae74a4
push ebx
push dword [0x100f3d44]
call esi
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x228]
push ebx
push dword [0x100f3d44]
call edi
push 0x100983d4
push 0x101123e8
call sub.MSVCR100.dll_strcpy
push 0x100983c4
push 0x10112401
call sub.MSVCR100.dll_strcpy
push 0x100983b8
push 0x1011241a
call sub.MSVCR100.dll_strcpy
push 0x100983a8
push 0x10112433
call sub.MSVCR100.dll_strcpy
push 0x1009839c
push 0x1011244c
call sub.MSVCR100.dll_strcpy
push 0x1009838c
push 0x10112465
call sub.MSVCR100.dll_strcpy
push 0x1009837c
push 0x1011247e
call sub.MSVCR100.dll_strcpy
add esp, 0x38
lea ecx, [ebp - 0x268]
call fcn.100046b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
call fcn.10001447
call fcn.10083b2f
ret