Function at 0x435380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xca4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0xca0], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x11
mov dword [esp + 0x20], ecx
xor esi, esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x43540f
lea eax, [esp + 0x18]
push eax
push str.Preferences
lea ecx, [esp + 0x30]
push ecx
mov ebx, 1
mov ecx, str.meethue
mov dword [esp + 0x24], ebx
call fcn.0041e8c0
lea eax, [esp + 0x28]
mov dword [esp + 0x44], esi
mov byte [esp + 0x48], bl
call fcn.00402890
test eax, eax
je 0x4353ff
cmp byte [esp + 0x48], 0
je 0x4353ff
lea eax, [esp + 0x28]
call fcn.004029a0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], bl
cmp eax, esi
jne 0x435414
mov byte [esp + 0x13], 0
test bl, 1
je 0x435422
lea edi, [esp + 0x28]
call fcn.00402a90
cmp byte [esp + 0x13], 0
je 0x435613
mov eax, str.https:__discovery.meethue.com_
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435440
sub eax, edx
push eax
push str.https:__discovery.meethue.com_
lea edx, [esp + 0x1c]
push edx
call fcn.0043c500
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.00461240
mov esi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 4
test esi, esi
je 0x435499
push esi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x435490
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x435499
test eax, eax
jne 0x435499
call fcn.0045f5a0
lea ecx, [esp + 0x24]
push ecx
lea esi, [esp + 0x46c]
call fcn.00403e50
test dword [esp + 0x478], 0xfffffffc
mov dword [esp + 0x20], 0
jbe 0x4355dd
mov eax, dword [esp + 0x20]
lea esi, [esp + 0x888]
lea ecx, [esp + 0x468]
call fcn.00404060
lea edx, [esp + 0x18]
push edx
mov eax, esi
push str.internalipaddress
push eax
lea esi, [esp + 0x58]
call fcn.00403f90
mov ecx, eax
call fcn.00403f20
mov esi, dword [esp + 0x18]
mov edi, esi
mov dword [esp + 0x14], edi
test esi, esi
je 0x435544
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0x80
jl 0x43551b
push esi
call ebx
push esi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x435533
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43553c
test eax, eax
jne 0x43553c
call fcn.0045f5a0
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x4c]
push ecx
call fcn.00404120
test edi, edi
je 0x4355b5
lea eax, [edi + 4]
test eax, eax
je 0x43558e
cmp byte [eax], 0
je 0x43558e
test eax, eax
jne 0x435567
mov eax, 0x4cb498
push eax
push str.http:___s_
lea ecx, [esp + 0x1c]
call fcn.00401480
mov esi, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
push edx
add esi, 0x3c
call fcn.0041e340
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4355b5
push edi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x4355aa
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4355b5
test eax, eax
jne 0x4355b5
mov esi, edi
call fcn.0045f5a0
lea eax, [esp + 0x888]
push eax
call fcn.00404120
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x478]
inc eax
shr ecx, 2
mov dword [esp + 0x20], eax
cmp eax, ecx
jb 0x4354c3
lea edx, [esp + 0x468]
push edx
call fcn.00404120
mov esi, dword [esp + 0x24]
test esi, esi
je 0x435613
push esi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x43560a
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x435613
test eax, eax
jne 0x435613
call fcn.0045f5a0
mov eax, dword [esp + 0x1c]
test dword [eax + 0x40], 0xfffffffe
jne 0x43568b
lea ecx, [esp + 0x18]
push ecx
push str.Preferences
lea edx, [esp + 0x30]
push edx
mov ecx, str.upnphue
mov dword [esp + 0x24], 1
call fcn.0041e8c0
lea eax, [esp + 0x28]
mov dword [esp + 0x44], 0
mov byte [esp + 0x48], 1
call fcn.00402890
test eax, eax
je 0x43566b
cmp byte [esp + 0x48], 0
je 0x43566b
lea eax, [esp + 0x28]
call fcn.004029a0
mov eax, dword [esp + 0x34]
lea edi, [esp + 0x28]
mov dword [esp + 0x40], eax
mov esi, eax
call fcn.00402a90
test esi, esi
je 0x43568b
mov ecx, dword [esp + 0x1c]
call fcn.0043bf80
mov ecx, dword [esp + 0xcac]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0049ceb0
mov esp, ebp
pop ebp
ret