Function at 0x40a350
Capabilities:
Check for foreground window switch
Get common file path
Query environment variable

Disassembly:
sub esp, 0x420
mov eax, dword [0x421020]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
push ebx
push ebp
push esi
push edi
push 0
mov dword [esp + 0x14], eax
call fcn.0040faba
push eax
call fcn.0040fc68
call fcn.0040fc7a
cdq
mov ecx, 0x2710
idiv ecx
lea edi, [edx + 0x64]
push edi
call fcn.0040fbd4
mov esi, eax
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 0x14
cmp eax, 8
ja case.default.0x40a3b0
jmp dword [eax*4 + 0x40acf4]
call fcn.0040fc7a
cdq
idiv edi
lea ebp, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
movzx edx, byte [edx + esi]
or dl, byte [ebp]
mov byte [esi], dl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a3ec
mov byte [esi + 1], 0x53
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.0x40a3b0.1
mov byte [esi + 1], 0x44
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a41e
mov byte [esi + 1], 0x44
sub bl, 0xc6
xor bl, 0x63
mov eax, edi
and eax, 6
mov byte [eax + esi], bl
jmp case.default.0x40a3b0
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
inc byte [esi]
jmp case.default.0x40a3b0
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a493
mov byte [esi + 1], 0x63
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
jmp case.default.0x40a3b0
add bl, 0x9d
mov al, bl
mov ecx, edi
xor al, 0x67
and ecx, 6
mov byte [ecx + esi], al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a4d0
mov byte [esi + 1], 0x4f
call fcn.0040fc7a
cdq
idiv edi
lea ebp, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
or dl, byte [ebp]
mov byte [esi], dl
inc bl
xor bl, byte [esi]
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
not bl
xor al, bl
mov byte [esi], al
jmp case.default.0x40a3b0
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a518
mov byte [esi + 1], 0x37
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a531
mov byte [esi + 1], 0x59
inc bl
xor bl, dl
inc byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
dec bl
or bl, al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.0x40a3b0.8
mov byte [esi + 1], 0x63
mov al, bl
not al
movzx edx, bl
xor al, 0x34
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
mov eax, edi
and eax, 6
mov byte [eax + esi], 0x30
push 0x104
push 0x4231c0
call fcn.0040c750
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
push esi
call fcn.004015fa
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 4
ja case.default.0x40a5a8
jmp dword [eax*4 + 0x40ad18]
call fcn.0040fc7a
cdq
idiv edi
mov cl, byte [edx + esi]
xor cl, 8
mov byte [esi], cl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp case.default.0x40a5a8
call ebp
or byte [esi], al
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
jmp case.default.0x40a5a8
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a60a
mov byte [esi + 1], 0x39
call ebp
mov dl, bl
not dl
lea ecx, [edi - 1]
add al, dl
and ecx, 2
mov byte [ecx + esi], al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
and bl, 0xf
not bl
xor byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp case.default.0x40a5a8
call fcn.0040fc7a
cdq
idiv edi
push 1
mov al, byte [edx + esi]
xor al, 8
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetSysColor]
and bl, 0xf
not bl
xor al, bl
mov byte [esi], al
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push 0
push edx
call fcn.0040ee30
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
je 0x40acd6
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 3
ja case.default.0x40a692
jmp dword [eax*4 + 0x40ad2c]
mov al, byte [esi]
add bl, 0x63
mov cl, bl
dec al
xor bl, 0x68
not cl
xor al, cl
mov byte [esi], al
mov dl, bl
movzx ecx, bl
not dl
xor dl, 0x33
lea eax, [edi - 1]
and eax, ecx
mov byte [eax + esi], dl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.0x40a692.2
mov byte [esi + 1], 0x76
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov bl, byte [edx + esi]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
inc byte [esi]
sub bl, 0x9f
sub bl, 0xc6
mov edx, edi
and edx, 6
xor bl, 0x33
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
call fcn.0040bd40
push eax
call fcn.0040cd90
push eax
call fcn.0040bee0
push eax
call fcn.00409250
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0040bdd0
push eax
push 1
call fcn.0040bf00
push eax
call fcn.0040cdf0
push eax
call fcn.00409040
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 0x24
cmp eax, 6
ja case.default.0x40a78d
jmp dword [eax*4 + 0x40ad3c]
inc bl
xor bl, byte [esi]
call ebp
mov dl, bl
not dl
add al, dl
movzx edx, bl
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
inc byte [esi]
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.default.0x40a78d
mov byte [esi + 1], 0x49
jmp case.default.0x40a78d
mov dl, bl
not dl
xor byte [esi], dl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor bl, 0x48
add bl, 8
mov al, bl
xor al, 0x59
mov ecx, edi
and ecx, 6
mov byte [ecx + esi], al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a82d
mov byte [esi + 1], 0x69
call ebp
mov dl, bl
not dl
add al, dl
movzx edx, bl
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
dec byte [esi]
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov ecx, edi
and ecx, 6
mov al, byte [edx + esi]
sub al, 0x63
mov dl, al
xor dl, 0x65
mov byte [ecx + esi], dl
mov dl, al
movzx eax, al
not dl
xor dl, 0x6b
lea ecx, [edi - 1]
and ecx, eax
mov byte [ecx + esi], dl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a8a3
mov byte [esi + 1], 0x39
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a8bc
mov byte [esi + 1], 0x55
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.0x40a78d.6
mov byte [esi + 1], 0x4c
inc byte [esi]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40a8f0
mov byte [esi + 1], 0x69
dec byte [esi]
call fcn.0040c770
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0040d7e0
mov ebx, eax
call fcn.0040c790
push eax
push ebx
call fcn.0040d7e0
mov dword [esp + 0x2c], eax
call fcn.0040cc30
push eax
push ebx
call fcn.0040d7e0
mov ebp, eax
call fcn.0040c5e0
push eax
push ebx
call fcn.0040d7e0
push eax
call fcn.0040d9b0
add esp, 0x24
mov dword [esp + 0x20], eax
test ebp, ebp
je 0x40acbb
cmp dword [ebp], 2
jne 0x40acbb
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40acbb
cmp dword [eax], 2
jne 0x40acbb
push eax
call fcn.0040d9b0
push ebp
mov ebx, eax
call fcn.0040d9b0
add esp, 8
lea edx, [esp + 0x120]
push edx
push 0
push 0x41d280
push 0x4231c0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x120]
push eax
call fcn.0040c7c0
push eax
lea ecx, [esp + 0x128]
push 0x104
push ecx
call fcn.004014b0
push ebx
push 0x41d278
lea edx, [esp + 0x23c]
push 0x104
push edx
call fcn.00409a00
add esp, 0x20
mov ebx, 5
nop
cmp ebx, 5
jge 0x40a9e0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x20]
push eax
push ebp
push 0x4231c0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x234]
push edx
call fcn.00409670
add esp, 0x14
test eax, eax
je 0x40aa1c
mov eax, ebx
dec ebx
test eax, eax
jg 0x40a9d0
mov ecx, dword [esp + 0x10]
call fcn.004094d0
jmp 0x40acd6
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 4
ja case.default.0x40aa34
jmp dword [eax*4 + 0x40ad58]
inc bl
xor bl, byte [esi]
mov ecx, edi
sub bl, 0x63
and ecx, 6
xor bl, 0x7a
mov byte [ecx + esi], bl
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
jmp case.default.0x40aa34
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40aa8c
mov byte [esi + 1], 0x43
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
not bl
xor bl, 0x38
lea edx, [edi - 1]
and edx, 1
mov byte [edx + esi], bl
jmp case.default.0x40aa34
mov al, byte [esi]
inc al
xor bl, al
mov cl, bl
not cl
xor cl, al
mov byte [esi], cl
xor bl, 0x77
movzx edx, byte [esi]
dec bl
inc dl
not bl
xor bl, dl
mov byte [esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.default.0x40aa34
mov byte [esi + 1], 0x78
jmp case.default.0x40aa34
mov al, bl
not al
xor byte [esi], al
xor bl, 0x62
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, bl
not cl
add al, cl
movzx ecx, bl
lea edx, [edi - 1]
and edx, ecx
mov byte [edx + esi], al
call fcn.0040c810
mov ebx, dword [esp + 0x10]
push eax
push ebx
call fcn.0040d7e0
add esp, 8
test eax, eax
je 0x40acb2
cmp dword [eax], 1
jne 0x40acb2
push eax
call fcn.0040a2b0
mov ecx, ebx
call fcn.004094d0
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 0xc
cmp eax, 8
ja case.default.0x40ab44
jmp dword [eax*4 + 0x40ad6c]
inc bl
xor bl, byte [esi]
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
mov dl, bl
not dl
xor al, dl
mov byte [esi], al
xor bl, 0x6d
inc byte [esi]
add bl, 0x9c
mov al, bl
mov ecx, edi
xor al, 0x4c
and ecx, 6
mov byte [ecx + esi], al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
and bl, 0xf
mov al, byte [esi]
inc bl
xor bl, al
inc bl
xor bl, al
add bl, 0x76
dec al
mov byte [esi], al
not bl
xor byte [esi], bl
mov bl, 0x78
inc bl
xor bl, byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, bl
not cl
add al, cl
movzx ecx, bl
lea edx, [edi - 1]
and edx, ecx
mov byte [edx + esi], al
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
dec edi
mov dl, byte [edx + esi]
mov al, dl
xor dl, 0x67
mov cl, dl
movzx edx, dl
not al
xor byte [esi], al
not cl
xor cl, 0x79
and edi, edx
mov byte [edi + esi], cl
jmp case.default.0x40ab44
inc byte [esi]
call fcn.0040fc7a
cdq
idiv edi
mov al, byte [edx + esi]
xor al, 8
mov byte [esi], al
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov cl, byte [edx + esi]
or cl, byte [ebx]
mov byte [esi], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
jmp case.default.0x40ab44
not bl
dec edi
xor bl, 0x6a
and edi, 8
mov byte [edi + esi], bl
call dword [sym.imp.USER32.dll_GetMessageTime]
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
dec byte [esi]
call fcn.0040bd40
push eax
call fcn.0040cd90
push eax
call fcn.0040bfd0
push eax
call fcn.00409250
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0040bdd0
push eax
push 1
call fcn.0040bf00
push eax
call fcn.0040cdf0
push eax
call fcn.00409040
add esp, 0x1c
mov eax, 1
jmp 0x40acd8
mov ecx, ebx
call fcn.004094d0
jmp 0x40acd6
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x40acd6
dec eax
mov dword [ecx + 4], eax
jne 0x40acd6
push ecx
call fcn.0040da80
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040faab
add esp, 0x420
ret