Function at 0x418265
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x41827b
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x418287
or edi, 1
push 1
call esi
test ax, ax
jge 0x418293
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x41829f
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x4182ab
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x4183fc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x47aed0]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push esi
push edi
mov edi, dword [ebp + 0x98]
xor eax, eax
mov esi, 0x104
push esi
push eax
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], al
lea eax, [ebp - 0x7b]
push eax
call fcn.0043f190
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push eax
mov ecx, edi
call sym.TXKmplayer.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_
mov ecx, dword [ebp + 0x8c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0043ee6a
add ebp, 0x90
leave
ret

Function at 0x41a80c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x41a831
cmp ebx, dword [esi + 0x54]
je 0x41a831
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x41a8f3
push edi
test eax, eax
je 0x41a884
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call sym.TXKmplayer.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool_
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x41a8f2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x41a8f2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x41a8f2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x41a8f2
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call sym.TXKmplayer.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool_
pop edi
pop esi
pop ebx
leave
ret 4