Function at 0x436090
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x15f4
call fcn.004ab980
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x15ec], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1600]
push esi
mov esi, dword [esp + 0x1608]
push edi
push esi
lea eax, [esp + 0x28]
push eax
mov eax, ebp
mov dword [esp + 0x3c], ebp
call fcn.004366c0
push esi
lea ecx, [esp + 0x24]
push ecx
push ebp
call fcn.00436a20
lea edx, [esp + 0x88e]
push edx
lea eax, [esp + 0x791]
push eax
lea ecx, [esp + 0x694]
xor ebx, ebx
push ecx
lea edx, [esp + 0x694]
push edx
push 0x4cb498
mov dword [esp + 0x9a4], ebx
mov byte [esp + 0x494], bl
mov byte [esp + 0x69c], bl
mov byte [esp + 0x6a0], bl
mov byte [esp + 0x7a1], bl
mov byte [esp + 0x8a2], bl
call fcn.004a00bc
lea eax, [esp + 0x34]
add esp, 0x14
push eax
lea esi, [esp + 0x484]
call fcn.00460e80
lea ecx, [esp + 0x14]
add esp, 4
push ecx
mov eax, esi
mov dword [esp + 0x14], ebx
call fcn.00454de0
mov edi, dword [esp + 0x14]
add esp, 4
cmp edi, ebx
je 0x4365f6
lea esi, [edi + 4]
push str.not_available_for_resource
push esi
call section..text
add esp, 8
cmp eax, ebx
je 0x436182
sub eax, edi
sub eax, 4
cmp eax, 0xffffffff
jne 0x4361a6
push str.unauthorized_user
push esi
call section..text
add esp, 8
cmp eax, ebx
je 0x4365f6
sub eax, edi
sub eax, 4
cmp eax, 0xffffffff
je 0x4365f6
push str._devicetype_:_f.lux_
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.00401480
add esp, 4
lea esi, [esp + 0x38]
call fcn.0044a610
cmp byte [ebp + 4], bl
jne 0x43635c
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x4365e9
push str.POST
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], ebx
call fcn.00460f70
mov esi, dword [esp + 0x24]
add esp, 0xc
cmp esi, ebx
je 0x436394
lea ecx, [esi + 4]
push str.link_button
push ecx
call section..text
add esp, 8
cmp eax, ebx
je 0x436394
sub eax, esi
sub eax, 4
cmp eax, 0xffffffff
je 0x436394
push ebx
call dword [sym.imp.USER32.dll_MessageBeep]
cmp dword [ebp + 0xac], ebx
je 0x436316
push 0x1b
push str.Push_the_button_on_your_Hue
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], ebx
call fcn.0043c200
push 7
push str.Pairing
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], ebx
call fcn.0043c200
fld qword [0x4d33d0]
mov ecx, dword [ebp + 0xac]
mov edi, dword [ecx]
sub esp, 8
lea esi, [esp + 0x40]
fstp qword [esp]
call fcn.0044a720
fdiv qword [0x4d33f8]
mov ecx, dword [ebp + 0xac]
sub esp, 8
lea edx, [esp + 0x24]
lea eax, [esp + 0x38]
fstp qword [esp]
push edx
mov edx, dword [edi]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4362e3
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4362d2
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4362df
cmp eax, ebx
jne 0x4362df
mov esi, dword [esp + 0x28]
call fcn.0045f130
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x436316
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x436309
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436316
cmp eax, ebx
jne 0x436316
mov esi, dword [esp + 0x14]
call fcn.0045f130
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp + 4], bl
jne 0x436353
lea esi, [esp + 0x38]
call fcn.0044a720
fld qword [0x4d33f8]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x43658b
mov eax, dword [esp + 0x160c]
mov edx, dword [ebp + 0x60]
lea ecx, [eax + eax*2]
mov byte [edx + ecx*8 + 8], 0xff
lea ecx, [esp + 0x18]
call fcn.00401420
lea ecx, [esp + 0x1c]
call fcn.00401420
lea ecx, [esp + 0x10]
call fcn.00401420
lea ecx, [esp + 0x480]
call fcn.00403870
lea ecx, [esp + 0x20]
call fcn.00401420
lea ecx, [esp + 0x24]
call fcn.00401420
or eax, 0xffffffff
jmp 0x4366a3
mov eax, dword [esp + 0x70]
xor eax, eax
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x74]
push ecx
lea edi, [esp + 0x6c]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x478], ebx
mov byte [esp + 0x78], bl
mov dword [esp + 0x47c], eax
call fcn.00401250
mov eax, dword [esp + 0x68]
cmp eax, ebx
je 0x4363db
add eax, 4
jmp 0x4363dd
xor eax, eax
mov dword [esp + 0x64], eax
cmp eax, ebx
je 0x4363ef
lea edx, [esp + 0x60]
push edx
call fcn.0046e850
xor ebp, ebp
test dword [esp + 0x70], 0xfffffffc
mov dword [esp + 0x14], ebp
je 0x4364b3
xor eax, eax
lea esi, [esp + 0xdb8]
lea ecx, [esp + 0x60]
call fcn.00404060
mov eax, esi
push str.success
push eax
lea esi, [esp + 0x9a0]
call fcn.00403f90
mov ecx, esi
push str.username
push ecx
lea esi, [esp + 0x11e0]
call fcn.00403f90
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call fcn.00403f20
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x18]
call fcn.00401250
mov esi, dword [esp + 0x30]
cmp esi, ebx
je 0x436488
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x43647b
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436484
cmp eax, ebx
jne 0x436484
call fcn.0045f130
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x11d8]
push ecx
call fcn.00404120
lea edx, [esp + 0x998]
push edx
call fcn.00404120
lea eax, [esp + 0xdb8]
push eax
call fcn.00404120
mov ebp, dword [esp + 0x14]
push ebx
push 0x4cb498
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], ebx
call fcn.0043c200
mov eax, dword [esp + 0x160c]
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x60]
lea eax, [ecx + edx*8 + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x4364e7
add eax, 4
jmp 0x4364e9
xor eax, eax
lea edx, [esp + 0x2c]
push edx
push eax
mov ecx, str.Software_f.lux_Software_LLChue
mov eax, closesocket
lea edi, [esp + 0x50]
call fcn.0041e540
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x43652f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x436526
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43652f
cmp eax, ebx
jne 0x43652f
call fcn.0045f130
lea eax, [esp + 0x14]
lea esi, [esp + 0x48]
call fcn.004023f0
cmp ebp, ebx
je 0x4365c8
lea eax, [ebp + 4]
cmp eax, ebx
je 0x4365c8
cmp byte [eax], bl
je 0x4365c8
mov edi, esi
call fcn.004026d0
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x436572
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43657d
cmp eax, ebx
jne 0x43657d
mov esi, ebp
call fcn.0045f130
lea eax, [esp + 0x60]
push eax
call fcn.00404120
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
cmp esi, ebx
je 0x4361c4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4365b6
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4361c4
cmp eax, ebx
jne 0x4361c4
call fcn.0045f130
jmp 0x4361c4
lea edi, [esp + 0x48]
call fcn.004026d0
lea ecx, [esp + 0x14]
call fcn.00401420
lea eax, [esp + 0x60]
push eax
call fcn.00404120
jmp 0x436353
lea ecx, [esp + 0x1c]
call fcn.00401420
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x160c]
mov edx, dword [ebp + 0x60]
lea ecx, [eax + eax*2]
mov byte [edx + ecx*8 + 8], 1
cmp edi, ebx
je 0x43663d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x43662e
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436643
cmp eax, ebx
jne 0x436643
mov esi, dword [esp + 0x10]
call fcn.0045f130
jmp 0x436643
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [esp + 0x480]
call fcn.00403870
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x436678
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x43666f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436678
cmp eax, ebx
jne 0x436678
call fcn.0045f130
mov esi, dword [esp + 0x24]
cmp esi, ebx
je 0x4366a1
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x436698
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4366a1
cmp eax, ebx
jne 0x4366a1
call fcn.0045f130
xor eax, eax
mov ecx, dword [esp + 0x15fc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049ca20
add esp, 0x15f4
ret 8