Function at 0x4022a0
Capabilities:
Create thread
Get common file path
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x604
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0x600], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x60]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x410
push 0
push eax
mov dword [esp + 0x20], esi
call fcn.00404630
add esp, 0xc
lea eax, [esp + 0x58]
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x478]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x68]
mov edx, str._USER
push eax
mov ecx, ebx
call fcn.00401e60
add esp, 4
test eax, eax
je 0x40234c
lea eax, [esp + 0x270]
mov edx, str._FILE
push eax
mov ecx, ebx
call fcn.00401e60
add esp, 4
test eax, eax
je 0x40234c
lea ecx, [esp + 0x68]
call fcn.00402130
jmp 0x4025f1
mov ecx, ebx
call fcn.00401fa0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
push 0
push str.http:__cidian.youdao.com_apps_log.html_keyfromdeskdict.crashactionCRASHEDctypeLauchMonitor
push 0x403540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40237d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41d290], esi
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xffffff
call esi
push 0xc8c8c8
mov dword [0x41d294], eax
call esi
push 0x40
push 0
push 0
push 1
push 0x6d
push dword [0x41d290]
mov dword [0x41d4ac], eax
call dword [sym.imp.USER32.dll_LoadImageW]
push 0x91d500
push 0
push 0
push 0x1c
push 0
mov dword [0x41d4b4], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ecx
lea eax, [esp + 0x14]
mov edx, 0x100
push eax
mov ecx, 0x91d500
call fcn.00401200
test eax, eax
js 0x402406
mov eax, dword [esp + 0x10]
mov edx, 0x100
push ecx
push str.YodaoDeskDictCrashRpt_
push ecx
sub edx, eax
lea ecx, [eax*2 + 0x91d500]
call fcn.00401270
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402410
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x402449
cmp word [ebx + edi*2], 0x20
jne 0x402431
inc edi
cmp edi, ecx
jl 0x402423
jmp 0x402449
cmp edi, ecx
jge 0x402449
cmp word [ebx + edi*2], 0x20
je 0x402443
inc edi
cmp edi, ecx
jl 0x402435
jmp 0x402449
xor eax, eax
mov word [ebx + edi*2], ax
push ecx
lea eax, [esp + 0x14]
mov edx, 0x100
push eax
mov ecx, 0x91d500
call fcn.00401200
test eax, eax
js 0x40247c
mov eax, dword [esp + 0x10]
mov edx, 0x100
push ecx
push ebx
push ecx
sub edx, eax
lea ecx, [eax*2 + 0x91d500]
call fcn.00401270
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push 0x91d500
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x41c774], eax
cmp eax, 0xffffffff
je 0x4025c0
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov eax, dword [esp + 0x48]
add eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x41d4a0], eax
test eax, eax
je 0x4025f1
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x50]
push eax
push dword [0x41c774]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4025f1
push dword [0x41c774]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [esp + 0x18]
xor edi, edi
mov eax, dword [0x41d4a0]
shr ecx, 1
mov word [eax + ecx*2], di
call fcn.004033a0
push ecx
push ebx
push ecx
mov edx, 0x100
mov ecx, 0x921700
call fcn.00401270
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push str.http:__cidian.youdao.com_apps_log.html_keyfromdeskdict.crashactionSHOWctypeShowCrashWnd
push 0x403540
push edi
push edi
call eax
test eax, eax
je 0x402551
push eax
call esi
push 0
push 0x401ae0
push 0
push 0x65
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [0x41c770], edi
je 0x402573
call fcn.00401860
cmp dword [0x41d4a4], edi
je 0x402586
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x41d294]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x40259d
push eax
call esi
mov eax, dword [0x41d294]
cmp dword [0x41d4ac], edi
je 0x4025a8
push eax
call esi
mov eax, dword [0x41d4b4]
test eax, eax
je 0x4025b8
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4025f1
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.http:__cidian.youdao.com_apps_log.html_keyfromdeskdict.crashactionSHOWctypeShowCrashWndFailed
push 0x403540
push 0
push 0
call eax
test eax, eax
je 0x4025f1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x60c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004035f4
mov esp, ebp
pop ebp
ret 0x10