Function at 0x4013f0
Capabilities:
Create thread
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x674
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0x670], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x4196fc
push eax
mov dword [esp + 0x24], eax
xor esi, esi
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x1c]
push eax
push 0x2000
push 0x91d700
call fcn.00401010
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
add esp, 0x18
test edi, edi
je 0x401450
push 0x91d700
push edi
call ebx
lea eax, [esp + 0x478]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ecx
lea eax, [esp + 0x1c]
mov edx, 0x100
push eax
lea ecx, [esp + 0x480]
call fcn.00401200
test eax, eax
js 0x4014a2
mov eax, dword [esp + 0x18]
mov edx, 0x100
push ecx
push str.YodaoDeskDictCrashRpt_
push ecx
lea ecx, [esp + 0x484]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.00401270
push ecx
lea eax, [esp + 0x47c]
mov edx, 0x100
push eax
push ecx
lea ecx, [esp + 0x284]
call fcn.00401270
push ecx
lea eax, [esp + 0x1c]
mov edx, 0x100
push eax
lea ecx, [esp + 0x280]
call fcn.00401200
test eax, eax
js 0x4014f9
mov eax, dword [esp + 0x18]
mov edx, 0x100
push ecx
push str..dmp
push ecx
lea ecx, [esp + 0x284]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.00401270
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x401789
nop dword [eax]
lea eax, [esp + 0x54]
push eax
push str._s...
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00401010
add esp, 0x1c
test edi, edi
je 0x401552
push 0x91d700
push edi
call ebx
push ecx
lea eax, [esp + 0x47c]
mov edx, 0x100
push eax
push ecx
lea ecx, [esp + 0x284]
call fcn.00401270
push ecx
lea eax, [esp + 0x1c]
mov edx, 0x100
push eax
lea ecx, [esp + 0x280]
call fcn.00401200
test eax, eax
js 0x4015a9
push ecx
lea eax, [esp + 0x58]
mov edx, 0x100
push eax
mov eax, dword [esp + 0x20]
sub edx, eax
push ecx
lea ecx, [esp + 0x284]
lea ecx, [ecx + eax*2]
call fcn.00401270
lea edx, [esp + 0x278]
call fcn.00402d50
test eax, eax
je 0x401686
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x54]
push eax
push 0x4197e0
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00401010
add esp, 0x1c
test edi, edi
je 0x4015fd
push 0x91d700
push edi
call ebx
lea ecx, [esp + 0x54]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401604
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x52], 0x70
jne 0x40167c
xor eax, eax
test ecx, ecx
je 0x401646
movzx esi, word [esp + eax*2 + 0x54]
cmp esi, 0x2e
je 0x401642
movzx edx, word [eax*2 + 0x921700]
cmp edx, 0x2e
je 0x401642
cmp si, dx
jne 0x401642
inc eax
cmp eax, ecx
jb 0x401621
mov esi, dword [esp + 0x14]
cmp word [esp + eax*2 + 0x54], 0x2e
jne 0x40167c
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
push str.http:__cidian.youdao.com_apps_log.html_keyfromdeskdict.crashactionBGctypeSendRptSucc
push 0x403540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40167c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
mov dword [esp + 0x14], esi
jmp 0x40173f
lea eax, [esp + 0x54]
push eax
push 0x4198a4
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00401010
add esp, 0x1c
test edi, edi
je 0x4016b8
push 0x91d700
push edi
call ebx
lea ecx, [esp + 0x54]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016c0
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x52], 0x70
jne 0x40173b
xor eax, eax
test ecx, ecx
je 0x401705
nop dword [eax]
movzx esi, word [esp + eax*2 + 0x54]
cmp esi, 0x2e
je 0x401701
movzx edx, word [eax*2 + 0x921700]
cmp edx, 0x2e
je 0x401701
cmp si, dx
jne 0x401701
inc eax
cmp eax, ecx
jb 0x4016e0
mov esi, dword [esp + 0x14]
cmp word [esp + eax*2 + 0x54], 0x2e
jne 0x40173b
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0
push str.http:__cidian.youdao.com_apps_log.html_keyfromdeskdict.crashactionBGctypeSendRptFail
push 0x403540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40173b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401520
mov eax, dword [esp + 0x1c]
push eax
push esi
push str._d_.__d_._r_n
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x2c]
call fcn.00401010
add esp, 0x20
test edi, edi
je 0x401789
push 0x91d700
push edi
call ebx
mov ecx, dword [esp + 0x67c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004035f4
mov esp, ebp
pop ebp
ret