Function at 0x40af34
Capabilities:
Create process on windows

Disassembly:
push 0x1a0
mov eax, 0x5079d3
call fcn.004c8434
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x94]
and dword [ebp - 0x10], 0
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 4]
push str.btn_close
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b004
cmp dword [ebx + 0x8a4], esi
jne 0x40aff7
mov eax, dword [ebx + 0x9cc]
test eax, eax
je 0x40aff7
cmp dword [eax + 0x698], 2
jne 0x40aff7
movsd xmm3, qword [ebx + 0x8d8]
lea eax, [ebx + 0x940]
movsd xmm2, qword [ebx + 0x8d0]
lea edx, [ebx + 0x910]
push eax
mov al, byte [ebp - 0x9c]
sub esp, 0x28
mov ecx, esp
mov dword [ebx + 0x8a4], 1
mov dword [ecx], vtable.._AV___Func_impl_no_alloc_V___Binder_U_Unforced_std__P8COctoberMainWnd__AEXH_ZPAV3_ABU___Ph__00_2__std__XH_std__.0
and dword [ecx + 0xc], esi
mov dword [ecx + 8], 0x40d4be
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x24], ecx
mov ecx, dword [ebx + 4]
call fcn.00409724
add esp, 0x2c
mov dword [ebx + 0x8e0], eax
jmp 0x40b267
push ecx
mov ecx, ebx
call fcn.0040b2d9
jmp 0x40b267
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btn_inst1
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b064
mov ecx, dword [ebx + 0x9cc]
mov dword [ebx + 0x870], 7
test ecx, ecx
je 0x40b04d
mov eax, dword [ecx]
push 1
call dword [eax + 0x204]
push 0
push 0x64
push 0x3039
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40b267
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btn_sm
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
je 0x40b0ba
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btn_jc
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b0c7
push ecx
mov ecx, ebx
call fcn.0040d8f3
jmp 0x40b267
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btn_agreement
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b107
push 5
xor eax, eax
push eax
push eax
push str.http:__www.66ng.cn_usage_agreemen.html
push str.open
jmp 0x40b260
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btn_changepath
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b13e
mov ecx, ebx
call fcn.0040b431
jmp 0x40b267
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btnwx
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b16d
push 2
jmp 0x40b19a
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btnali
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b1a6
push 1
mov ecx, ebx
call fcn.0040d840
jmp 0x40b267
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 4]
push str.btn_kefu
mov ecx, eax
call fcn.004164a3
lea ecx, [ebp - 0x94]
mov esi, eax
call fcn.004162c6
test esi, esi
jne 0x40b1de
push 1
xor eax, eax
push eax
push eax
push str.https:__tb.53kf.com_code_client_a00d62cb3718463c6315abc8a823a82d3_1
jmp 0x40b25b
mov eax, dword [edi]
lea ecx, [ebp - 0x1ac]
push ecx
mov ecx, edi
call dword [eax + 4]
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
mov ecx, eax
push str.btn_spjc
mov dword [ebp - 0x10], ebx
call fcn.004164a3
test eax, eax
je 0x40b22b
mov eax, dword [edi]
lea ecx, [ebp - 0x128]
push ecx
mov ecx, edi
call dword [eax + 4]
push 3
pop ebx
push str.btn_spjc2
mov ecx, eax
call fcn.004164a3
mov byte [ebp + 0xb], 0
test eax, eax
jne 0x40b22f
mov byte [ebp + 0xb], 1
test bl, 2
je 0x40b23f
lea ecx, [ebp - 0x128]
call fcn.004162c6
lea ecx, [ebp - 0x1ac]
call fcn.004162c6
cmp byte [ebp + 0xb], 0
je 0x40b267
push 1
xor eax, eax
push eax
push eax
push str.https:__gwe969fnnco.feishu.cn_docx_TwfWdwxnho8D2WxiYcFcrrUHnid
push str.Open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004c83fd
ret 4