Function at 0x4016a0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Hide graphical window
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x96c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, ecx
push 0x415948
push str._sReleasephysx27GameApp.exe
push 0x4166f0
mov dword [ebp - 0x968], edx
mov dword [ebp - 0x964], eax
mov dword [0x4166e8], eax
call edi
add esp, 0xc
push 0x4166f0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x401777
lea eax, [ebp - 0x914]
mov dword [ebp - 0x914], 0x104
push eax
push 0x415948
push 0
push 0x20000002
push str.PathRoot
push str.SOFTWARETencentQQ
push connect
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x401898
push 0x415948
push str._sReleasephysx27GameApp.exe
push 0x4166f0
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x415948
push 0x4130c0
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x44
push 0x416990
push eax
push 0
call ebx
cmp eax, 7
je 0x401af1
push 0x415948
lea eax, [ebp - 0x910]
push str._sLoaderLoaderBG.bmp
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x2010
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
mov dword [0x4168fc], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x4168fc]
mov dword [0x416a58], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
lea eax, [ebp - 0x924]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [ebp - 0x924], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x91c]
add eax, 0xfffffed4
cdq
push 0
push dword [ebp - 0x964]
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x918]
push 0
push 0
push 0xc8
lea eax, [eax - 0xc8]
sar esi, 1
cdq
push 0x12c
sub eax, edx
sar eax, 1
push eax
push esi
push connect
push 0x416990
push str.QQSpeed
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x401af1
push dword [ebp - 0x968]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x910]
push str.RunSpeedGameEvent__d
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4168f8], eax
test eax, eax
jne 0x4018bf
push 0x10
push 0x416990
push 0x41319c
jmp 0x401ae7
push 0x10
push 0x416990
push 0x41310c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402e00
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x910]
push 0x4131ac
push eax
call edi
add esp, 0xc
mov dword [ebp - 0x948], 0
lea eax, [ebp - 0x910]
mov dword [ebp - 0x928], 0
xorps xmm0, xmm0
mov dword [ebp - 0x94c], eax
lea eax, [ebp - 0x960]
movlpd qword [ebp - 0x940], xmm0
push eax
movlpd qword [ebp - 0x938], xmm0
movlpd qword [ebp - 0x930], xmm0
mov dword [ebp - 0x960], 0x3c
mov dword [ebp - 0x95c], 0x40
mov dword [ebp - 0x958], 0
mov dword [ebp - 0x954], str.runas
mov dword [ebp - 0x950], 0x4166f0
mov dword [ebp - 0x944], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401adb
mov eax, dword [ebp - 0x928]
mov dword [0x41698c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x910]
push str.KartMap_Shared__d
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 0xa17
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x416988], eax
test eax, eax
jne 0x4019b6
push 0x10
push eax
push 0x4131f4
jmp 0x401ae7
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4166ec], eax
test eax, eax
jne 0x4019e8
push dword [0x416988]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0
push 0x413218
jmp 0x401ae7
mov ecx, esi
call fcn.00402ba0
mov ecx, dword [0x416900]
test ecx, ecx
jne 0x401a29
mov eax, dword [0x41698c]
test eax, eax
je 0x401aea
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x41698c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41698c], 0
jmp 0x401aea
mov eax, dword [0x4166ec]
push 0
push 5
mov dword [eax], esi
mov dword [eax + 8], ecx
mov dword [eax + 0x34], 1
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401a72
mov eax, dword [0x4166ec]
lea ecx, [ebp - 0x110]
push dword [eax + 8]
add eax, 0x38
push ecx
push str._sQQ
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x4166ec]
push 0x416908
mov dword [eax + 0x13c], 0
movups xmm0, xmmword [str.hi__girl__gogogo]
movups xmmword [eax + 0x1c0], xmm0
add eax, 0x1d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401aa5
push dword [0x4168f8]
sub edx, eax
mov eax, dword [0x4166ec]
mov dword [eax + 0x1d0], edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402e00
mov esp, ebp
pop ebp
ret
push 0x10
push 0x416990
push 0x4131c0
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402e00
mov esp, ebp
pop ebp
ret