Function at 0x462a20
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x4b5590]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x20], ebx
je 0x462abb
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x462abf
lea edx, [eax + eax*4]
shl edx, 2
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x4b5590]
mov edi, eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x44]
push eax
push 1
push ecx
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
cmp dword [esp + 0x14], ebx
je 0x462ab1
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [0x4b5590]
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push edx
call esi
cmp eax, ebx
jne 0x462ab1
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x462a8e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x462abf
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x462e37
push ebp
mov ebp, dword [sym.imp.USER32.dll_VkKeyScanA]
mov eax, dword [esp + 0x20]
mov ecx, 5
mov esi, eax
lea edi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x48]
add eax, 0x14
and edx, 0xffff
mov dword [esp + 0x20], eax
lea eax, [edx - 1]
cmp eax, 0xf
ja case.0x462ba2.13
xor ecx, ecx
mov cl, byte [eax + 0x462e64]
jmp dword [ecx*4 + 0x462e50]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], eax
mov dword [0x4b55c0], eax
mov eax, dword [0x4b55b0]
mov dword [esp + 0x44], ecx
test eax, eax
je case.0x462ba2.13
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x38]
mov edx, dword [edx + 0x14]
call eax
jmp case.0x462ba2.13
mov edi, dword [esp + 0x52]
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov edx, edi
mov dword [esp + 0x30], ecx
and edx, 0xffff
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x28], esi
lea ecx, [edx - 0xc]
mov dword [esp + 0x34], eax
cmp ecx, 0x85
mov dword [0x4b55c0], eax
ja case.0x462ba2.16
xor edx, edx
mov dl, byte [ecx + 0x462e88]
jmp dword [edx*4 + 0x462e74]
test esi, esi
jne 0x462bd4
mov cl, byte [esp + 0x56]
test cl, cl
je 0x462bd4
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
push eax
mov word [esp + 0x34], si
call fcn.00462f10
mov eax, dword [0x4b55c0]
add esp, 4
test al, 1
je case.0x462ba2.13
test ah, 1
je case.0x462ba2.13
and al, 0xf7
mov dword [0x4b55c0], eax
jmp case.0x462ba2.13
test al, 3
je 0x462bfe
test ah, 1
je case.0x462ba2.13
lea ecx, [esp + 0x28]
push ecx
call fcn.00462f10
add esp, 4
jmp case.0x462ba2.13
test al, 3
je 0x462c1d
test ah, 1
je case.0x462ba2.13
test esi, esi
je case.0x462ba2.16
test al, 0xf
jne case.0x462ba2.16
xor edx, edx
cmp word [0x4b55c4], dx
sete dl
mov word [0x4b55c4], dx
cmp di, 0x43
jne 0x462c4e
test esi, esi
jne 0x462c4e
test al, 0xc
je 0x462c4e
mov dword [esp + 0x28], 1
mov ecx, dword [0x4b55a0]
test ecx, ecx
je 0x462bfe
test al, 0x80
je 0x462bfe
lea eax, [esp + 0x13]
push 1
lea ecx, [esp + 0x36]
push eax
push ecx
call dword [sym.imp.USER32.dll_OemToCharBuffA]
mov edi, dword [esp + 0x30]
mov eax, dword [0x4b55c0]
movsx ebx, byte [esp + 0x13]
and edi, 0xff
and eax, 0x10
jne 0x462cfe
mov cl, byte [edi + 0x4b5478]
test cl, cl
je 0x462cfe
push ebx
call dword [sym.imp.USER32.dll_IsCharAlphaA]
test eax, eax
je 0x462ce2
movsx si, bl
push ebx
and esi, 0xffff
call dword [sym.imp.USER32.dll_IsCharUpperA]
test eax, eax
push esi
je 0x462cba
call dword [sym.imp.USER32.dll_CharLowerA]
jmp 0x462cc0
call dword [sym.imp.USER32.dll_CharUpperA]
mov esi, eax
push ebx
and esi, 0xffff
call ebp
push esi
mov ebx, eax
call ebp
cmp bx, 0xffff
je 0x462ce2
xor al, bl
jne 0x462ce2
test esi, esi
jne 0x462bfe
test byte [0x4b55c0], 0xc
jne 0x462bfe
mov dl, byte [edi + 0x4b5478]
mov byte [esp + 0x32], dl
jmp 0x462bfe
test eax, eax
je 0x462bfe
mov al, byte [edi + 0x4b5478]
test al, al
je 0x462bfe
push ebx
call dword [sym.imp.USER32.dll_IsCharAlphaA]
test eax, eax
je 0x462d65
movsx si, bl
push ebx
and esi, 0xffff
call dword [sym.imp.USER32.dll_IsCharUpperA]
test eax, eax
push esi
je 0x462d3d
call dword [sym.imp.USER32.dll_CharLowerA]
jmp 0x462d43
call dword [sym.imp.USER32.dll_CharUpperA]
mov esi, eax
push ebx
and esi, 0xffff
call ebp
push esi
mov ebx, eax
call ebp
cmp bx, 0xffff
je 0x462d65
xor al, bl
jne 0x462d65
test esi, esi
jne 0x462bfe
mov al, byte [edi + 0x4b52bc]
mov byte [esp + 0x32], al
jmp 0x462bfe
mov eax, dword [esp + 0x4c]
test eax, eax
je case.0x462ba2.13
push 0
call fcn.00461e00
add esp, 4
jmp case.0x462ba2.13
mov esi, dword [esp + 0x4c]
mov edi, dword [0x49fc04]
cmp si, 0x84
mov dword [esp + 0x1c], esi
jg 0x462dac
cmp word [esp + 0x4e], 0x3c
jle 0x462df8
mov eax, dword [0x4b558c]
lea edx, [esp + 0x5c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ax, word [esp + 0x1e]
cmp ax, 0x3c
movsx ecx, ax
jl 0x462dd0
mov ecx, 0x3c
cmp si, 0x84
movsx eax, si
jl 0x462ddf
mov eax, 0x84
push 1
push ecx
lea ecx, [esp + 0x64]
push eax
push ecx
call fcn.00461720
mov esi, dword [esp + 0x6c]
add esp, 0x10
mov dword [esp + 0x1c], esi
mov ecx, dword [edi + 0x10]
movsx eax, si
cmp eax, ecx
mov cx, word [esp + 0x1e]
jne 0x462e11
mov esi, dword [edi + 0xc]
movsx edx, cx
cmp edx, esi
je case.0x462ba2.13
mov edx, dword [edi + 0x18]
movsx ecx, cx
push ecx
push eax
push edx
push edi
call fcn.004670c0
add esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x14], eax
jne 0x462ad9
pop ebp
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
test eax, eax
je 0x462e49
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x64
ret