Function at 0x44bc6a
Capabilities:
Check for foreground window switch
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbdc
push ebx
push esi
push edi
mov dword [ebp - 0x818], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x1d4], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call fcn.004536a0
add esp, 4
mov dword [ebp - 0x7dc], eax
lea edi, [ebp - 0x7d8]
xor eax, eax
mov ecx, 0xab
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.004536a0
add esp, 4
mov byte [ebp - 0x7d7], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push eax
call fcn.004536a0
add esp, 4
mov byte [ebp - 0x7d6], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
push eax
call fcn.004536a0
add esp, 4
mov byte [ebp - 0x7d5], al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
push eax
call fcn.004536a0
add esp, 4
mov byte [ebp - 0x7d4], al
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x7bc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
push eax
call fcn.004536a0
add esp, 4
test eax, eax
je 0x44bdba
mov dword [0x4622fc], 1
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x20]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x630]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x24]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x5ae]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x44bdc4
mov dword [0x4622fc], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x462284], 0
je 0x44be01
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push str..STLWA_64sync
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1d8], eax
jmp 0x44be3d
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
mov eax, str..STVISTAsync
mov ecx, str..STLWAsync
xor edx, edx
cmp dword [0x462280], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffff
jne 0x44be86
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error___d__occurred_during_driver_fetch._n_nPlease_Report_to_your_Administrator.
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push str.SofTrack_License_Control_Message
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44c4e9
mov dword [0x4817e8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x814], eax
mov byte [ebp - 0x52b], 3
mov byte [ebp - 0x7d8], 0
xor eax, eax
mov al, byte [ebp - 0x7d7]
test al, 4
je 0x44c147
mov dword [ebp - 0x818], 1
mov byte [ebp - 0x52c], 0x61
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x1bc], 0
push 0
lea eax, [ebp - 0x854]
push eax
push 0x1c2
lea eax, [ebp - 0x1cc]
push eax
push 0x2ee
lea eax, [ebp - 0x52c]
push eax
push 0xab350200
mov eax, dword [ebp - 0x1d8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 4], eax
push 0
push 0
call fcn.0044b485
add esp, 8
test eax, eax
je 0x44c13a
mov byte [ebp - 0x84c], 0
mov dword [ebp - 0x1d0], 0
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1d0]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0044b668
add esp, 0x18
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7c0], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [ebp - 8], 0
je 0x44c05c
cmp dword [ebp - 0x850], 0
je 0x44c05c
mov dword [ebp - 0x818], 8
test byte [ebp - 8], 4
je 0x44c000
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID3both
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x44c057
test byte [ebp - 8], 2
je 0x44c033
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID2both
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x44c057
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID1both
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x44c13a
cmp dword [ebp - 8], 0
je 0x44c0ff
mov dword [ebp - 0x818], 8
test byte [ebp - 8], 4
je 0x44c0a3
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID3
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x44c0fa
test byte [ebp - 8], 2
je 0x44c0d6
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID2
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x44c0fa
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID1
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x44c13a
cmp dword [ebp - 0x850], 0
je 0x44c13a
mov dword [ebp - 0x818], 8
lea eax, [ebp - 0x7d8]
push eax
push 0x44c4ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTIDtv
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp - 0x818], 8
jne 0x44c159
jmp 0x44c22a
cmp dword [ebp - 0x818], 1
jne 0x44c1bc
mov byte [ebp - 0x7d6], 1
mov byte [ebp - 0x7d5], 0xa
mov esi, str.Advanced_Timekeeper_Prompt_did_not_find_reference_list__please_manually_enter_your_code_s_:
lea edi, [ebp - 0x7bc]
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x7d8]
push eax
push 0x432b4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x47ebd8
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x44c22a
xor eax, eax
mov al, byte [ebp - 0x7d6]
test al, 4
je 0x44c1f9
mov byte [ebp - 0x7d8], 1
mov eax, str.SILENT
lea ecx, [ebp - 0x739]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov al, byte [eax + 0xc]
mov byte [ecx + 0xc], al
jmp 0x44c22a
lea eax, [ebp - 0x7d8]
push eax
push 0x432b4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push str.CLIENTID
mov eax, dword [0x4817e8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
movsx eax, byte [ebp - 0x7d8]
test eax, eax
jne 0x44c245
mov byte [ebp - 0x52b], 8
jmp 0x44c494
movsx eax, byte [ebp - 0x7d8]
cmp eax, 1
jne 0x44c3c4
mov al, byte [ebp - 0x7d4]
mov byte [ebp - 0x407], al
lea eax, [ebp - 0x406]
push eax
call fcn.00452990
add esp, 4
mov byte [ebp - 0x402], 0xc2
lea edi, [ebp - 0x739]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x401]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x23c], 0
mov dword [ebp - 0x81c], 0x62
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
mov al, byte [0xb4bb40]
test eax, eax
je 0x44c362
mov edi, 0xb4bb40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x338]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x23c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x338]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x338]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x23c]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x84c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x351]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x23c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x338]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x52b], 1
jmp 0x44c494
movsx eax, byte [ebp - 0x7d8]
cmp eax, 3
jne 0x44c494
mov byte [ebp - 0x52b], 3
lea edi, [ebp - 0xbdc]
xor eax, eax
mov ecx, 0x70
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebp - 0xa18]
xor eax, eax
mov ecx, 0x70
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp - 0xbdc], 0x63
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0xbd8], eax
push 0
lea eax, [ebp - 0x854]
push eax
push 0x1c2
lea eax, [ebp - 0xa18]
push eax
push 0x1c2
lea eax, [ebp - 0xbdc]
push eax
push 0xab350200
mov eax, dword [ebp - 0x1d8]
push eax
call fcn.004372d3
add esp, 0x20
mov dword [0x462eac], 0x63
mov eax, dword [ebp - 0xa0c]
push eax
mov eax, dword [ebp - 0xa14]
push eax
call fcn.0041e60f
add esp, 8
cmp dword [0x462eac], 0x63
jne 0x44c494
cmp dword [0x4622c8], 0
je 0x44c484
jmp 0x44c494
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44c465
mov byte [ebp - 0x52c], 0x65
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x528], eax
push 0
lea eax, [ebp - 0x854]
push eax
push 0x1c2
lea eax, [ebp - 0x1cc]
push eax
push 0x2ee
lea eax, [ebp - 0x52c]
push eax
push 0xab350200
mov eax, dword [ebp - 0x1d8]
push eax
call fcn.004372d3
add esp, 0x20
mov eax, dword [ebp - 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret