Function at 0x40ad90
Capabilities:
Check for foreground window switch

Disassembly:
sub esp, 0x110
mov eax, dword [0x421020]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
push 0
call fcn.0040faba
push eax
call fcn.0040fc68
call fcn.0040fc7a
cdq
mov ecx, 0x2710
idiv ecx
lea edi, [edx + 0x64]
push edi
call fcn.0040fbd4
mov esi, eax
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 0x14
cmp eax, 8
ja case.default.0x40ade1
jmp dword [eax*4 + 0x40b810]
mov dl, bl
xor bl, 0x45
not dl
xor byte [esi], dl
inc bl
xor bl, byte [esi]
call fcn.0040fc7a
cdq
idiv edi
movzx eax, byte [edx + esi]
xor al, 8
mov byte [esi], al
and bl, 0xf
not bl
xor byte [esi], bl
dec byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
or byte [esi], al
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push 0
mov dword [esp + 0x18], 0xa
call dword [sym.imp.ole32.dll_CoInitializeEx]
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 8
ja case.default.0x40ae67
jmp dword [eax*4 + 0x40b834]
mov dl, bl
not dl
xor byte [esi], dl
xor bl, 0x78
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, bl
not cl
add al, cl
movzx ecx, bl
lea edx, [edi - 1]
and edx, ecx
mov byte [edx + esi], al
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
xor byte [esi], 0x95
jmp case.default.0x40ade1
call fcn.0040fc7a
cdq
idiv edi
and bl, 0xf
sub bl, 0x63
mov eax, edi
xor bl, 0x45
and eax, 6
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
mov byte [eax + esi], bl
inc byte [esi]
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
call dword [sym.imp.USER32.dll_GetMessageTime]
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
or dl, byte [ebx]
mov byte [esi], dl
jmp case.default.0x40ade1
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
sub bl, 0x63
mov eax, edi
and eax, 6
xor bl, 0x59
mov byte [eax + esi], bl
call ebp
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
jmp 0x40af64
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
call ebp
call fcn.0040fc7a
cdq
idiv edi
mov al, byte [edx + esi]
xor al, 8
mov byte [esi], al
jmp 0x40ae3d
mov cl, byte [esi]
add bl, 0x76
dec cl
not bl
xor bl, cl
mov byte [esi], bl
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov bl, byte [edx + esi]
inc byte [esi]
add bl, 0x69
call ebp
mov dl, bl
movzx ecx, bl
not dl
lea eax, [edi - 1]
xor dl, 0x31
and eax, ecx
mov byte [eax + esi], dl
dec bl
call fcn.0040fc7a
cdq
idiv edi
and bl, 0xf
movzx edx, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
or byte [esi], al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.0x40ae67.3
mov byte [esi + 1], 0x52
call fcn.0040fc7a
cdq
idiv edi
lea ebp, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
sub bl, 0x63
mov ecx, edi
xor bl, 0x47
and ecx, 6
mov al, byte [edx + esi]
or al, byte [ebp]
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov byte [esi], al
mov byte [ecx + esi], bl
dec byte [esi]
jmp case.default.0x40ae67
call dword [sym.imp.USER32.dll_GetMessageTime]
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, edi
and edx, 6
mov bl, 5
mov byte [edx + esi], 0x40
mov al, bl
not al
xor byte [esi], al
xor bl, 0x37
add bl, 0x67
call ebp
mov cl, bl
movzx eax, bl
not cl
xor cl, 0x73
lea edx, [edi - 1]
and edx, eax
mov byte [edx + esi], cl
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
inc al
mov byte [esi], al
jmp case.default.0x40ae67
inc byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
dec bl
or bl, al
not bl
xor byte [esi], bl
jmp case.default.0x40ae67
inc bl
xor bl, byte [esi]
call ebp
sub bl, 0xf4
xor bl, 0x64
mov edx, edi
and edx, 6
mov byte [edx + esi], bl
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push edi
push esi
mov byte [0x4232c4], 0
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 4
ja case.default.0x40b109
jmp dword [eax*4 + 0x40b858]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b129
mov byte [esi + 1], 0x5a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
not bl
add al, bl
mov byte [esi], al
dec byte [esi]
jmp case.default.0x40b109
dec byte [esi]
add bl, 0x17
mov eax, edi
xor bl, 0x31
and eax, 6
mov byte [eax + esi], bl
dec byte [esi]
jmp case.default.0x40b109
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov eax, edi
and eax, 6
mov dl, byte [edx + esi]
sub dl, 0x63
xor dl, 0x36
mov byte [eax + esi], dl
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov cl, byte [edx + esi]
or cl, byte [ebx]
mov byte [esi], cl
jmp case.default.0x40b109
inc byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
or byte [esi], al
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
or dl, byte [ebx]
mov byte [esi], dl
jmp case.default.0x40b109
add bl, 0x9d
mov al, bl
xor al, 0x44
mov dl, bl
mov ecx, edi
and ecx, 6
mov byte [ecx + esi], al
xor bl, 0x35
not dl
xor byte [esi], dl
mov al, bl
movzx edx, bl
not al
xor al, 0x76
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
push 0x41d280
push 1
call fcn.0040cd90
push eax
call fcn.0040bd60
push eax
call fcn.00409310
push edi
push esi
mov dword [esp + 0x30], eax
call fcn.004015fa
movzx eax, al
add esp, 0x18
sub eax, 0
je 0x40b229
dec eax
je 0x40b247
dec eax
je 0x40b272
jmp 0x40b298
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov al, byte [edx + esi]
or al, byte [ebx]
mov byte [esi], al
call ebp
dec byte [esi]
call fcn.0040fc7a
cdq
idiv edi
mov cl, byte [edx + esi]
xor cl, 8
mov byte [esi], cl
call ebp
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b272
mov byte [esi + 1], 0x7a
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
push 1
mov dl, byte [edx + esi]
or dl, byte [ebx]
mov byte [esi], dl
call dword [sym.imp.USER32.dll_GetSysColor]
dec al
mov byte [esi], al
cmp dword [esp + 0x10], 0xa
jge 0x40b2aa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 9
ja case.default.0x40b2c2
jmp dword [eax*4 + 0x40b86c]
call fcn.0040fc7a
cdq
idiv edi
lea ebx, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov al, byte [edx + esi]
or al, byte [ebx]
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp case.default.0x40b2c2
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
mov al, dl
xor dl, 0x38
not al
xor byte [esi], al
lea ebx, [edx - 0x63]
mov cl, bl
xor cl, 0x6b
mov edx, edi
and edx, 6
mov byte [edx + esi], cl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b34f
mov byte [esi + 1], 0x72
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, bl
not cl
add al, cl
movzx ecx, bl
lea edx, [edi - 1]
and edx, ecx
mov byte [edx + esi], al
call fcn.0040fc7a
jmp 0x40b4ab
sub bl, 0x63
mov eax, edi
and eax, 6
xor bl, 0x68
mov byte [eax + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b397
mov byte [esi + 1], 0x4c
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.default.0x40b2c2
mov byte [esi + 1], 0x66
jmp case.default.0x40b2c2
sub bl, 0x63
mov ecx, edi
and ecx, 6
xor bl, 0x39
push 1
mov byte [ecx + esi], bl
call dword [sym.imp.USER32.dll_GetSysColor]
dec al
mov byte [esi], al
jmp case.default.0x40b2c2
inc byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
dec byte [esi]
jmp case.default.0x40b2c2
add bl, 0x9d
mov dl, bl
xor dl, 0x4e
mov eax, edi
and eax, 6
mov byte [eax + esi], dl
inc bl
xor bl, byte [esi]
lea edx, [edi - 1]
mov cl, bl
movzx eax, bl
not cl
xor cl, 0x78
and edx, eax
mov byte [edx + esi], cl
dec bl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b428
mov byte [esi + 1], 0x69
add bl, 0x72
call ebp
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne case.0x40b2c2.8
mov byte [esi + 1], 0x71
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b45f
mov byte [esi + 1], 0x39
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
add bl, 0x9d
mov cl, bl
xor cl, 0x65
mov edx, edi
and edx, 6
mov byte [esi], al
mov byte [edx + esi], cl
mov al, bl
movzx ecx, bl
not al
lea ebp, [edi - 1]
xor al, 0x39
and ecx, ebp
mov byte [ecx + esi], al
dec bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dl, bl
movzx ecx, bl
not dl
add al, dl
and ecx, ebp
mov byte [ecx + esi], al
call fcn.0040fc7a
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
cdq
idiv edi
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.0040bdd0
push eax
push 1
call fcn.0040bd70
push eax
call fcn.0040cdf0
push eax
call fcn.00409040
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 0x24
cmp eax, 9
ja case.default.0x40b4f6
jmp dword [eax*4 + 0x40b894]
mov al, bl
not al
xor byte [esi], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov byte [esi], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
xor bl, 0x65
inc bl
xor bl, byte [esi]
sub bl, 0x63
mov ecx, edi
and ecx, 6
xor bl, 0x44
mov byte [ecx + esi], bl
call ebp
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
jmp case.default.0x40b4f6
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b567
mov byte [esi + 1], 0x71
call ebp
add bl, 0x72
not bl
xor byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edx, [edi - 1]
sub al, 0x70
and edx, 0x6f
mov byte [edx + esi], al
xor byte [esi], 0x90
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
mov bl, byte [esi]
xor bl, 0x73
inc byte [esi]
add bl, 0x9c
mov dl, bl
mov eax, edi
xor dl, 0x4f
and eax, 6
mov byte [eax + esi], dl
call fcn.0040fc7a
cdq
idiv edi
lea ebp, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov cl, byte [edx + esi]
or cl, byte [ebp]
mov byte [esi], cl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b5f0
mov byte [esi + 1], 0x70
inc bl
xor bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
xor dl, 8
mov byte [esi], dl
and bl, 0xf
mov al, bl
not al
movzx edx, bl
xor al, 0x73
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
mov eax, edi
and eax, 6
mov byte [eax + esi], 0x68
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov bl, byte [edx + esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dl, bl
not dl
add al, dl
movzx edx, bl
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
call fcn.0040fc7a
cdq
idiv edi
lea ebp, [edx + esi]
call fcn.0040fc7a
cdq
idiv edi
mov al, byte [edx + esi]
or al, byte [ebp]
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov byte [esi], al
mov cl, bl
not cl
xor byte [esi], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor bl, 0x68
or al, bl
sub al, 0x63
xor al, 0x46
mov edx, edi
and edx, 6
mov byte [edx + esi], al
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 0
push ecx
call fcn.0040ee30
add esp, 0xc
test eax, eax
jne 0x40b6c8
mov eax, dword [esp + 0x10]
mov edx, eax
dec eax
mov dword [esp + 0x10], eax
test edx, edx
jne 0x40b298
cmp dword [esp + 0x10], 0
jne 0x40b6d9
mov eax, 1
jmp 0x40b7f4
mov eax, dword [esp + 0x14]
push eax
call fcn.0040a350
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
push esi
call fcn.004015fa
mov bl, al
movzx eax, bl
add esp, 8
cmp eax, 4
ja case.default.0x40b704
jmp dword [eax*4 + 0x40b8bc]
call fcn.0040fc7a
cdq
idiv edi
and bl, 0xf
mov cl, byte [edx + esi]
xor cl, 8
mov byte [esi], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dl, bl
not dl
add al, dl
movzx edx, bl
lea ecx, [edi - 1]
and ecx, edx
mov byte [ecx + esi], al
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
idiv edi
mov bl, byte [edx + esi]
sub bl, 0x63
mov edx, edi
and edx, 6
xor bl, 0x39
mov byte [edx + esi], bl
call fcn.0040fc7a
cdq
mov ecx, 0xff
idiv ecx
add dl, byte [esi]
mov bl, dl
call fcn.0040fc7a
cdq
idiv edi
mov byte [edx + esi], bl
call fcn.0040fc7a
jmp case.default.0x40b704
not bl
lea edx, [edi - 1]
and edx, 2
xor bl, 0x75
push 1
mov byte [edx + esi], bl
call dword [sym.imp.USER32.dll_GetSysColor]
mov byte [esi], al
call fcn.0040fc7a
cdq
idiv edi
mov al, byte [edx + esi]
xor al, 8
mov byte [esi], al
jmp case.default.0x40b704
push 1
call dword [sym.imp.USER32.dll_GetSysColor]
mov byte [esi], al
xor al, 0x71
mov bl, al
call fcn.0040fc7a
cdq
idiv edi
mov dl, byte [edx + esi]
and dl, 0xa3
mov byte [esi], dl
cmp dl, 0x61
jne 0x40b7dd
mov byte [esi + 1], 0x77
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov cl, bl
movzx edx, bl
not cl
add al, cl
dec edi
and edi, edx
mov byte [edi + esi], al
xor eax, eax
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040faab
add esp, 0x110
ret 0x10