Function at 0x401020
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e446
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push esi
push edi
mov eax, dword [0x416040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
mov edi, ecx
mov dword [ebp - 0x1c], 0
call fcn.00401ab0
mov ecx, eax
test ecx, ecx
je 0x40141c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40109a
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00401710
mov esi, dword [ebp - 0x14]
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [esi - 8]
push esi
call fcn.004050ec
add esp, 8
test eax, eax
js 0x40143f
cmp eax, dword [esi - 8]
jg 0x40143f
xor ecx, ecx
mov dword [esi - 0xc], eax
push 0x5c
push esi
mov word [esi + eax*2], cx
call fcn.00402c66
add esp, 8
test eax, eax
je 0x4013e8
sub eax, esi
sar eax, 1
test eax, eax
jle 0x4013e8
xor edi, edi
add eax, 1
cmovns edi, eax
mov dword [ebp - 0x28], edi
cmp edi, dword [esi - 0xc]
jl 0x40110d
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401620
mov edi, dword [ebp - 0x18]
jmp 0x40117e
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x401121
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x401139
call fcn.00401ab0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x401426
mov eax, dword [ecx]
push 2
push edi
mov eax, dword [eax]
call eax
test eax, eax
je 0x401430
lea edi, [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], edi
test eax, eax
js 0x40143f
cmp eax, dword [edi - 8]
jg 0x40143f
mov dword [edi - 0xc], eax
xor ecx, ecx
add eax, eax
mov word [edi + eax], cx
test eax, eax
je 0x40117e
push eax
push esi
push edi
call fcn.00402ed0
add esp, 0xc
mov dword [ebp - 0x1c], 1
push str.YoudaoDict.exe
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401470
add esp, 4
mov byte [ebp - 4], 3
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4011b8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov dword [ebp - 0x84], 0x44
mov word [ebp - 0x42], ax
xorps xmm0, xmm0
mov ax, word [ebp + 8]
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x84]
movlpd qword [ebp - 0x80], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x24]
movlpd qword [ebp - 0x78], xmm0
push dword [ebp - 0x10]
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x52], xmm0
movlpd qword [ebp - 0x4a], xmm0
mov dword [ebp - 0x58], 1
movups xmmword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 1
jne 0x401269
push dword [ebp - 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x40]
call edi
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4013ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4013ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401241
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40128f
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4012a7
call fcn.00401ab0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x401435
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov edx, eax
mov dword [ebp - 0x1c], 3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
lea edi, [edx + 0x10]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], eax
lea ecx, [eax + 0x11]
test ecx, ecx
js 0x40143f
mov eax, 1
sub eax, dword [edx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 8]
sub eax, ecx
or eax, dword [ebp - 0x2c]
jge 0x4012f5
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401710
mov edi, dword [ebp - 0x18]
test edi, edi
jne 0x40130b
call fcn.004050d7
mov dword [eax], 0x16
call fcn.00404f7c
jmp 0x40132a
movups xmm0, xmmword [0x413f70]
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x413f80]
movups xmmword [edi + 0x10], xmm0
mov ax, word [0x413f90]
mov word [edi + 0x20], ax
mov eax, dword [ebp - 0x24]
lea ecx, [eax + eax]
lea eax, [edi + 0x22]
test ecx, ecx
je 0x40136a
test eax, eax
je 0x40135a
mov edx, dword [ebp - 0x30]
push ecx
test edx, edx
je 0x40134f
push edx
push eax
call fcn.00402ed0
add esp, 0xc
jmp 0x40136a
push 0
push eax
call fcn.00403450
add esp, 0xc
call fcn.004050d7
mov dword [eax], 0x16
call fcn.00404f7c
mov eax, dword [ebp - 0x24]
add eax, 0x11
cmp eax, dword [edi - 8]
jg 0x40143f
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
lea edx, [ebp - 0x18]
push 0x413f10
lea ecx, [ebp - 0x28]
call fcn.00401470
lea edx, [edi - 0x10]
mov byte [ebp - 4], 3
or edi, 0xffffffff
add esp, 4
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4013b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10
push 0x413f94
push dword [ebp - 0x28]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x28]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40123e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40123e
xor edi, edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x401409
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401880
push 0x80004005
call fcn.00401880
call fcn.00401860
push 0x80004005
call fcn.00401880
push 0x80070057
call fcn.00401880
int3