Function at 0x404d90
Capabilities:
Check for foreground window switch
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b490
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x150], esi
mov dword [ebp - 4], 0
call fcn.00402fe0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0x14c], eax
call fcn.00402380
mov ecx, eax
test ecx, ecx
jne 0x404df5
push 0x80004005
call fcn.00402030
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 1
lea ebx, [esi + 0x84]
mov eax, dword [ebx]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x40
or eax, ecx
jge 0x404e2a
push 0x40
mov ecx, ebx
call fcn.00406730
mov ecx, dword [ebx]
lea edx, [ebp - 0x134]
call fcn.004082f0
mov ecx, dword [ebx]
mov dword [ebp - 0x144], eax
test ecx, ecx
je 0x404e59
push dword [ecx - 8]
push ecx
call fcn.0040d5a2
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x405211
mov eax, dword [ebx]
cmp ecx, dword [eax - 8]
jg 0x405211
push dword [ebp - 0x14c]
mov dword [eax - 0xc], ecx
mov eax, dword [ebx]
mov byte [ecx + eax], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
sete byte [ebp - 0x129]
call fcn.004056f0
mov ecx, esi
call fcn.00405220
cmp dword [ebp - 0x144], 0
je 0x4051b0
lea edx, [ebp - 0x13c]
mov dword [ebp - 0x144], 0
push edx
lea edx, [ebp - 0x140]
mov dword [ebp - 0x13c], 4
push edx
lea edx, [ebp - 0x158]
push edx
push dword [esi + 0x48]
lea ecx, [esi + 0x44]
push dword [ecx]
push 0x80000001
call dword [0x4254ac]
test eax, eax
jne 0x404eef
cmp dword [ebp - 0x140], eax
mov ecx, 1
cmove eax, ecx
mov dword [ebp - 0x144], eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x130], esp
lea eax, [esi + 0x48]
mov dword [ebp - 0x13c], 4
push eax
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x128], ecx
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 2
lea eax, [esi + 0x44]
mov dword [ebp - 0x128], ecx
push eax
call fcn.00406650
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00405c80
push 1
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x130], esp
mov ecx, esp
mov dword [ebp - 0x13c], 4
push eax
mov dword [ebp - 0x140], 1
mov word [ebp - 0x19], 0x766f
mov word [ebp - 0x16], 0x72
mov word [ebp - 0x1f], 0x7475
mov byte [ebp - 0x17], 0x65
mov word [ebp - 0x1c], 0x6552
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x1d], 0x6f
call fcn.004063a0
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
lea eax, [esi + 0x8c]
mov dword [ebp - 0x128], ecx
push eax
call fcn.00406650
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00405c80
push dword [ebp - 0x134]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x405020
push 0x104
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0040c5f0
mov eax, dword [0x4254a8]
add esp, 0xc
test eax, eax
je 0x404ff2
push 0
push 0x26
lea ecx, [ebp - 0x124]
push ecx
push 0
call eax
add esp, 0x10
push dword [esi + 0x90]
lea eax, [ebp - 0x124]
push eax
call dword [0x4254a4]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x134]
push 0x421810
push eax
call fcn.00406a00
add esp, 0x14
sub esp, 8
mov dword [ebp - 0x128], 0
mov ecx, esp
mov dword [ebp - 0x130], esp
mov dword [ebp - 0x148], ecx
push ebx
call fcn.00406650
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x148], esp
push 0x4217c4
call fcn.004063a0
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
lea eax, [ebp - 0x134]
mov dword [ebp - 0x138], ecx
push eax
call fcn.00406650
lea edx, [ebp - 0x128]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.00408be0
add esp, 0x10
test eax, eax
jne 0x4050ec
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x138], esp
mov dword [ebp - 0x148], ecx
push ebx
call fcn.00406650
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x148], esp
push 0x4217c4
call fcn.004063a0
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
lea eax, [ebp - 0x134]
mov dword [ebp - 0x154], ecx
push eax
call fcn.00406650
lea edx, [ebp - 0x128]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.00408990
add esp, 0x10
cmp byte [ebp - 0x129], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x405151
xor esi, esi
nop dword [eax]
call edi
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x130]
je 0x405139
push 0x64
call ebx
inc esi
cmp esi, 0x12c
jl 0x405100
jmp 0x40514b
push 0x3e8
call ebx
mov ecx, dword [ebp - 0x14c]
call fcn.00409a30
mov esi, dword [ebp - 0x150]
cmp dword [ebp - 0x144], 0
je 0x4051b0
push 0x9c4
call ebx
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x154], esp
lea eax, [esi + 0x48]
mov dword [ebp - 0x13c], 4
push eax
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x138], ecx
call fcn.00406650
push ecx
mov ecx, esp
mov byte [ebp - 4], 8
lea eax, [esi + 0x44]
mov dword [ebp - 0x138], ecx
push eax
call fcn.00406650
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00405c80
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x134]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4051d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4051f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409cd3
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402030
int3