Function at 0x4016b0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Hide graphical window
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x96c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, ecx
push 0x417988
push str._sReleasephysx27GameApp.exe
push 0x418758
mov dword [ebp - 0x968], edx
mov dword [ebp - 0x964], eax
mov dword [0x418750], eax
call edi
add esp, 0xc
push 0x418758
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x401787
lea eax, [ebp - 0x914]
mov dword [ebp - 0x914], 0x104
push eax
push 0x417988
push 0
push 0x20000002
push str.PathRoot
push str.SOFTWARETencentQQ
push connect
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4018a8
push 0x417988
push str._sReleasephysx27GameApp.exe
push 0x418758
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x417988
push 0x415180
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x44
push 0x4189f8
push eax
push 0
call ebx
cmp eax, 7
je 0x401b01
push 0x417988
lea eax, [ebp - 0x910]
push str._sLoaderLoaderBG.bmp
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x2010
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
mov dword [0x418964], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x418964]
mov dword [0x418ac0], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
lea eax, [ebp - 0x924]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [ebp - 0x924], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x91c]
add eax, 0xfffffed4
cdq
push 0
push dword [ebp - 0x964]
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x918]
push 0
push 0
push 0xc8
lea eax, [eax - 0xc8]
sar esi, 1
cdq
push 0x12c
sub eax, edx
sar eax, 1
push eax
push esi
push connect
push 0x4189f8
push str.QQSpeed
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x401b01
push dword [ebp - 0x968]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x910]
push str.RunSpeedGameEvent__d
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x418960], eax
test eax, eax
jne 0x4018cf
push 0x10
push 0x4189f8
push 0x41525c
jmp 0x401af7
push 0x10
push 0x4189f8
push 0x4151cc
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402ea0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x910]
push 0x41526c
push eax
call edi
add esp, 0xc
mov dword [ebp - 0x948], 0
lea eax, [ebp - 0x910]
mov dword [ebp - 0x928], 0
xorps xmm0, xmm0
mov dword [ebp - 0x94c], eax
lea eax, [ebp - 0x960]
movlpd qword [ebp - 0x940], xmm0
push eax
movlpd qword [ebp - 0x938], xmm0
movlpd qword [ebp - 0x930], xmm0
mov dword [ebp - 0x960], 0x3c
mov dword [ebp - 0x95c], 0x40
mov dword [ebp - 0x958], 0
mov dword [ebp - 0x954], str.runas
mov dword [ebp - 0x950], 0x418758
mov dword [ebp - 0x944], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401aeb
mov eax, dword [ebp - 0x928]
mov dword [0x4189f4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x910]
push str.KartMap_Shared__d
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 0xa17
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x4189f0], eax
test eax, eax
jne 0x4019c6
push 0x10
push eax
push 0x4152b4
jmp 0x401af7
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x418754], eax
test eax, eax
jne 0x4019f8
push dword [0x4189f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0
push 0x4152d8
jmp 0x401af7
mov ecx, esi
call fcn.00402c40
mov ecx, dword [0x418968]
test ecx, ecx
jne 0x401a39
mov eax, dword [0x4189f4]
test eax, eax
je 0x401afa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x4189f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4189f4], 0
jmp 0x401afa
mov eax, dword [0x418754]
push 0
push 5
mov dword [eax], esi
mov dword [eax + 8], ecx
mov dword [eax + 0x34], 1
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401a82
mov eax, dword [0x418754]
lea ecx, [ebp - 0x110]
push dword [eax + 8]
add eax, 0x38
push ecx
push str._sQQ
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x418754]
push 0x418970
mov dword [eax + 0x13c], 0
movups xmm0, xmmword [str.hi__girl__gogogo]
movups xmmword [eax + 0x1c0], xmm0
add eax, 0x1d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401ab5
push dword [0x418960]
sub edx, eax
mov eax, dword [0x418754]
mov dword [eax + 0x1d0], edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402ea0
mov esp, ebp
pop ebp
ret
push 0x10
push 0x4189f8
push 0x415280
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402ea0
mov esp, ebp
pop ebp
ret