Function at 0x4016b0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Hide graphical window
Initialize winsock library
Query or enumerate registry value
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd84
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push esi
push edi
push 0x417948
mov edi, ecx
mov dword [ebp - 0xd80], edx
push str._sReleasephysx27GameApp.exe
push 0x418710
mov dword [0x418708], edi
call ebx
add esp, 0xc
push 0x418710
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401784
lea eax, [ebp - 0xb9c]
mov dword [ebp - 0xb9c], 0x104
push eax
push 0x417948
push 0
push 0x20000002
push str.PathRoot
push str.SOFTWARETencentQQ
push connect
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4018a8
push 0x417948
push str._sReleasephysx27GameApp.exe
push 0x418710
call ebx
add esp, 0xc
lea eax, [ebp - 0xb98]
push 0x417948
push 0x415120
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0xb98]
push 0x44
push 0x4189b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x401c61
push 0x417948
lea eax, [ebp - 0xb98]
push str._sLoaderLoaderBG.bmp
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0xb98]
push 0x2010
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
mov dword [0x41891c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x41891c]
mov dword [0x418a78], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
lea eax, [ebp - 0xbac]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [ebp - 0xbac], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0xba4]
add eax, 0xfffffed4
cdq
push 0
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0xba0]
push edi
push 0
push 0
lea eax, [eax - 0xc8]
sar esi, 1
push 0xc8
cdq
push 0x12c
sub eax, edx
sar eax, 1
push eax
push esi
push connect
push 0x4189b0
push str.QQSpeed
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
mov dword [ebp - 0xb9c], edi
test edi, edi
je 0x401c61
push dword [ebp - 0xd80]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
push eax
lea eax, [ebp - 0xb98]
push str.RunSpeedGameEvent__d
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0xb98]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x418918], eax
test eax, eax
jne 0x4018cf
push 0x10
push 0x4189b0
push 0x4151fc
jmp 0x401c52
push 0x10
push 0x4189b0
push 0x41516c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402be0
mov esp, ebp
pop ebp
ret
call esi
push eax
lea eax, [ebp - 0xb98]
push 0x41520c
push eax
call ebx
add esp, 0xc
mov dword [ebp - 0xd64], 0
lea eax, [ebp - 0xb98]
mov dword [ebp - 0xd44], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd68], eax
lea eax, [ebp - 0xd7c]
movlpd qword [ebp - 0xd5c], xmm0
push eax
movlpd qword [ebp - 0xd54], xmm0
movlpd qword [ebp - 0xd4c], xmm0
mov dword [ebp - 0xd7c], 0x3c
mov dword [ebp - 0xd78], 0x40
mov dword [ebp - 0xd74], 0
mov dword [ebp - 0xd70], str.runas
mov dword [ebp - 0xd6c], 0x418710
mov dword [ebp - 0xd60], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401c46
mov eax, dword [ebp - 0xd44]
mov dword [0x4189ac], eax
call esi
push eax
lea eax, [ebp - 0xb98]
push str.KartMap_Shared__d
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0xb98]
push eax
push 0xa17
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x4189a8], eax
test eax, eax
jne 0x4019be
push 0x10
push eax
push 0x415254
jmp 0x401c52
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x41870c], eax
test eax, eax
jne 0x4019f0
push dword [0x4189a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0
push 0x415278
jmp 0x401c52
lea eax, [ebp - 0xd40]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x401b56
push 0x417948
lea eax, [ebp - 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.DirSvrInfo1.ini
lea eax, [ebp - 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x398]
push eax
push 0x40
lea eax, [ebp - 0x88]
push eax
push str.127.0.0.1
push 0x415450
push str.ServerInfo1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, 0x418a88
lea esi, [ebp - 0x88]
xor ebx, ebx
push esi
call fcn.004064a6
add esp, 4
mov byte [edi], al
lea edi, [edi + 1]
push 0x2e
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x401a86
inc ebx
add esi, 2
cmp ebx, 4
jb 0x401a60
lea eax, [ebp - 0x398]
push eax
push 0x40
lea eax, [ebp - 0x88]
push eax
push str.27015_27015_27015
push str.Ports
push str.ServerInfo1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2c
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, dword [ebp - 0xb9c]
test eax, eax
je 0x401ac9
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x88]
push eax
call fcn.004064a6
movups xmm0, xmmword [str.nghoangphatngan]
add esp, 4
mov word [0x418a8c], ax
movups xmmword [0x418a98], xmm0
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push 0
mov dword [0x418a90], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x418a90]
mov dword [0x418aa8], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0x4028a0
push edi
push 0x81
push dword [0x418708]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push dword [0x418a90]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x418aa8]
call dword [sym.imp.GDI32.dll_DeleteDC]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [0x418920]
test ecx, ecx
jne 0x401b90
mov eax, dword [0x4189ac]
test eax, eax
je 0x401c5a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x4189ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4189ac], 0
jmp 0x401c5a
mov eax, dword [0x41870c]
push 0
push 5
mov dword [eax], edi
mov dword [eax + 8], ecx
mov dword [eax + 0x34], 1
lea eax, [ebp - 0x190]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401bd9
mov eax, dword [0x41870c]
lea ecx, [ebp - 0x190]
push dword [eax + 8]
add eax, 0x38
push ecx
push str._sQQ
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x41870c]
push 0x418928
mov dword [eax + 0x13c], 0
movups xmm0, xmmword [str.nghoangphatngan]
movups xmmword [eax + 0x1c0], xmm0
add eax, 0x1d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, eax
lea eax, [edx + 1]
nop dword [eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401c10
push dword [0x418918]
sub edx, eax
mov eax, dword [0x41870c]
mov dword [eax + 0x1d0], edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402be0
mov esp, ebp
pop ebp
ret
push 0x10
push 0x4189b0
push 0x415220
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call eax
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402be0
mov esp, ebp
pop ebp
ret