Function at 0x436360
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x15f4
call fcn.004abe10
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x15ec], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1600]
push esi
mov esi, dword [esp + 0x1608]
push edi
push esi
lea eax, [esp + 0x28]
push eax
mov eax, ebp
mov dword [esp + 0x3c], ebp
call fcn.00436990
push esi
lea ecx, [esp + 0x24]
push ecx
push ebp
call fcn.00436cf0
lea edx, [esp + 0x88e]
push edx
lea eax, [esp + 0x791]
push eax
lea ecx, [esp + 0x694]
xor ebx, ebx
push ecx
lea edx, [esp + 0x694]
push edx
push 0x4cb498
mov dword [esp + 0x9a4], ebx
mov byte [esp + 0x494], bl
mov byte [esp + 0x69c], bl
mov byte [esp + 0x6a0], bl
mov byte [esp + 0x7a1], bl
mov byte [esp + 0x8a2], bl
call fcn.004a055c
lea eax, [esp + 0x34]
add esp, 0x14
push eax
lea esi, [esp + 0x484]
call fcn.004612f0
lea ecx, [esp + 0x14]
add esp, 4
push ecx
mov eax, esi
mov dword [esp + 0x14], ebx
call fcn.004550f0
mov edi, dword [esp + 0x14]
add esp, 4
cmp edi, ebx
je 0x4368c6
lea esi, [edi + 4]
push str.not_available_for_resource
push esi
call section..text
add esp, 8
cmp eax, ebx
je 0x436452
sub eax, edi
sub eax, 4
cmp eax, 0xffffffff
jne 0x436476
push str.unauthorized_user
push esi
call section..text
add esp, 8
cmp eax, ebx
je 0x4368c6
sub eax, edi
sub eax, 4
cmp eax, 0xffffffff
je 0x4368c6
push str._devicetype_:_f.lux_
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.00401480
add esp, 4
lea esi, [esp + 0x38]
call fcn.0044a930
cmp byte [ebp + 4], bl
jne 0x43662c
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x4368b9
push str.POST
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], ebx
call fcn.004613e0
mov esi, dword [esp + 0x24]
add esp, 0xc
cmp esi, ebx
je 0x436664
lea ecx, [esi + 4]
push str.link_button
push ecx
call section..text
add esp, 8
cmp eax, ebx
je 0x436664
sub eax, esi
sub eax, 4
cmp eax, 0xffffffff
je 0x436664
push ebx
call dword [sym.imp.USER32.dll_MessageBeep]
cmp dword [ebp + 0xb8], ebx
je 0x4365e6
push 0x1b
push str.Push_the_button_on_your_Hue
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], ebx
call fcn.0043c500
push 7
push str.Pairing
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], ebx
call fcn.0043c500
fld qword [0x4d3400]
mov ecx, dword [ebp + 0xb8]
mov edi, dword [ecx]
sub esp, 8
lea esi, [esp + 0x40]
fstp qword [esp]
call fcn.0044aa40
fdiv qword [0x4d3428]
mov ecx, dword [ebp + 0xb8]
sub esp, 8
lea edx, [esp + 0x24]
lea eax, [esp + 0x38]
fstp qword [esp]
push edx
mov edx, dword [edi]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4365b3
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4365a2
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4365af
cmp eax, ebx
jne 0x4365af
mov esi, dword [esp + 0x28]
call fcn.0045f5a0
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4365e6
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4365d9
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4365e6
cmp eax, ebx
jne 0x4365e6
mov esi, dword [esp + 0x14]
call fcn.0045f5a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp + 4], bl
jne 0x436623
lea esi, [esp + 0x38]
call fcn.0044aa40
fld qword [0x4d3428]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x43685b
mov eax, dword [esp + 0x160c]
mov edx, dword [ebp + 0x64]
lea ecx, [eax + eax*2]
mov byte [edx + ecx*8 + 8], 0xff
lea ecx, [esp + 0x18]
call fcn.00401420
lea ecx, [esp + 0x1c]
call fcn.00401420
lea ecx, [esp + 0x10]
call fcn.00401420
lea ecx, [esp + 0x480]
call fcn.00403870
lea ecx, [esp + 0x20]
call fcn.00401420
lea ecx, [esp + 0x24]
call fcn.00401420
or eax, 0xffffffff
jmp 0x436973
mov eax, dword [esp + 0x70]
xor eax, eax
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x74]
push ecx
lea edi, [esp + 0x6c]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x478], ebx
mov byte [esp + 0x78], bl
mov dword [esp + 0x47c], eax
call fcn.00401250
mov eax, dword [esp + 0x68]
cmp eax, ebx
je 0x4366ab
add eax, 4
jmp 0x4366ad
xor eax, eax
mov dword [esp + 0x64], eax
cmp eax, ebx
je 0x4366bf
lea edx, [esp + 0x60]
push edx
call fcn.0046ecb0
xor ebp, ebp
test dword [esp + 0x70], 0xfffffffc
mov dword [esp + 0x14], ebp
je 0x436783
xor eax, eax
lea esi, [esp + 0xdb8]
lea ecx, [esp + 0x60]
call fcn.00404060
mov eax, esi
push str.success
push eax
lea esi, [esp + 0x9a0]
call fcn.00403f90
mov ecx, esi
push str.username
push ecx
lea esi, [esp + 0x11e0]
call fcn.00403f90
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call fcn.00403f20
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x18]
call fcn.00401250
mov esi, dword [esp + 0x30]
cmp esi, ebx
je 0x436758
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x43674b
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436754
cmp eax, ebx
jne 0x436754
call fcn.0045f5a0
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x11d8]
push ecx
call fcn.00404120
lea edx, [esp + 0x998]
push edx
call fcn.00404120
lea eax, [esp + 0xdb8]
push eax
call fcn.00404120
mov ebp, dword [esp + 0x14]
push ebx
push 0x4cb498
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], ebx
call fcn.0043c500
mov eax, dword [esp + 0x160c]
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x64]
lea eax, [ecx + edx*8 + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x4367b7
add eax, 4
jmp 0x4367b9
xor eax, eax
lea edx, [esp + 0x2c]
push edx
push eax
mov ecx, str.Software_f.lux_Software_LLChue
mov eax, closesocket
lea edi, [esp + 0x50]
call fcn.0041e810
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x4367ff
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4367f6
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4367ff
cmp eax, ebx
jne 0x4367ff
call fcn.0045f5a0
lea eax, [esp + 0x14]
lea esi, [esp + 0x48]
call fcn.004023f0
cmp ebp, ebx
je 0x436898
lea eax, [ebp + 4]
cmp eax, ebx
je 0x436898
cmp byte [eax], bl
je 0x436898
mov edi, esi
call fcn.004026d0
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x436842
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43684d
cmp eax, ebx
jne 0x43684d
mov esi, ebp
call fcn.0045f5a0
lea eax, [esp + 0x60]
push eax
call fcn.00404120
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
cmp esi, ebx
je 0x436494
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x436886
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436494
cmp eax, ebx
jne 0x436494
call fcn.0045f5a0
jmp 0x436494
lea edi, [esp + 0x48]
call fcn.004026d0
lea ecx, [esp + 0x14]
call fcn.00401420
lea eax, [esp + 0x60]
push eax
call fcn.00404120
jmp 0x436623
lea ecx, [esp + 0x1c]
call fcn.00401420
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x160c]
mov edx, dword [ebp + 0x64]
lea ecx, [eax + eax*2]
mov byte [edx + ecx*8 + 8], 1
cmp edi, ebx
je 0x43690d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x4368fe
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436913
cmp eax, ebx
jne 0x436913
mov esi, dword [esp + 0x10]
call fcn.0045f5a0
jmp 0x436913
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [esp + 0x480]
call fcn.00403870
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x436948
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x43693f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436948
cmp eax, ebx
jne 0x436948
call fcn.0045f5a0
mov esi, dword [esp + 0x24]
cmp esi, ebx
je 0x436971
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x436968
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436971
cmp eax, ebx
jne 0x436971
call fcn.0045f5a0
xor eax, eax
mov ecx, dword [esp + 0x15fc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049ceb0
add esp, 0x15f4
ret 8