Function at 0x4025aa
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x43b404
call fcn.0042b1c9
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
mov edi, dword [str.windowinit]
mov ecx, esi
call fcn.0040775c
push edi
push eax
call fcn.0042abab
pop ecx
pop ecx
test eax, eax
je 0x4029de
mov edi, dword [str.click]
mov ecx, esi
call fcn.0040775c
push edi
push eax
call fcn.0042abab
pop ecx
pop ecx
test eax, eax
jne 0x4029c8
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0040775c
push str.closebtn
push eax
call fcn.0042abab
mov ebx, eax
neg ebx
pop ecx
sbb bl, bl
pop ecx
or edi, 0xffffffff
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
jne 0x402710
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0040775c
push str.btnOk
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x40268a
mov dword [0x44c134], 0x65
jmp 0x402710
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.0040775c
push str.btnCancel
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
jne 0x402706
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.0040775c
push str.btnClose
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x402721
mov dword [0x44c134], 0x64
mov ecx, dword [ebp - 0x10]
push esi
add ecx, 0xfffffff0
call fcn.00402553
jmp 0x4029de
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 4
call fcn.0040775c
push str.btnDown
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x40276f
push 5
xor eax, eax
push eax
push eax
push str.http:__xy.hintsoft.com.cn__vdownload
jmp 0x402803
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 5
call fcn.0040775c
push str.btnDoc
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x4027ba
push 5
xor eax, eax
push eax
push eax
push str.http:__bbs.hintsoft.com.cn_bbs_thread_229704_1_1.html
jmp 0x402803
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 6
call fcn.0040775c
push str.btnVideo
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x402814
push 5
xor eax, eax
push eax
push eax
push str.http:__xy.hintsoft.com.cn__vvideohelp
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4029de
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 7
call fcn.0040775c
push str.optInfo
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x4028a6
mov esi, dword [ebp - 0x10]
add esi, 0xc
push str.optInfo
mov ecx, esi
call fcn.00405221
push str.btnCancel
mov ecx, esi
mov ebx, eax
call fcn.00405221
mov ecx, ebx
mov edi, eax
call fcn.004090ec
neg al
sbb al, al
inc al
movzx eax, al
push eax
mov ecx, ebx
call fcn.004090f3
mov esi, dword [edi]
mov ecx, ebx
call fcn.004090ec
movzx eax, al
push eax
mov ecx, edi
call dword [esi + 0xd0]
jmp 0x4029de
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 8
call fcn.0040775c
push str.minbtn
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x4028f0
push 0
push 0xf020
jmp 0x40297c
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 9
call fcn.0040775c
push str.maxbtn
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x402937
push 0
push 0xf030
jmp 0x40297c
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 0xa
call fcn.0040775c
push str.restorebtn
push eax
call fcn.0042abab
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x54]
inc bl
mov dword [ebp - 4], edi
call fcn.004077a3
test bl, bl
je 0x40298e
push 0
push 0xf120
mov ecx, dword [ebp - 0x10]
push 0x112
add ecx, 0xfffffff0
call fcn.00407d48
jmp 0x4029de
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
lea edx, [ebp - 0x98]
push edx
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 0xb
call fcn.0040775c
push str.btn_menu
push eax
call fcn.0042abab
pop ecx
pop ecx
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], edi
call fcn.004077a3
jmp 0x4029de
mov edi, dword [str.timer]
mov ecx, esi
call fcn.0040775c
push edi
push eax
call fcn.0042abab
pop ecx
pop ecx
call fcn.0042b268
ret 4