Function at 0x41e630
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x644
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x640], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x36]
push edi
push eax
mov word [esp + 0x3c], di
call fcn.00429d70
push 0x206
lea ecx, [esp + 0x24a]
push edi
push ecx
mov word [esp + 0x250], di
call fcn.00429d70
push 0x206
lea edx, [esp + 0x45e]
push edi
push edx
mov word [esp + 0x464], di
call fcn.00429d70
add esp, 0x24
lea eax, [esp + 0xc]
push eax
push 0x20019
push edi
push str.SoftwareTencentTTraveler
push closesocket
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e734
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push edi
push str.ConfigPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e734
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e6e4
sub eax, edx
sar eax, 1
je 0x41e734
lea eax, [esp + 0x30]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e700
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
jne 0x41e734
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e720
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x2e], di
lea eax, [esp + 0x30]
lea edx, [eax + 2]
jmp 0x41e740
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e740
sub eax, edx
sar eax, 1
jne 0x41e806
push ebx
xor ecx, ecx
lea ebx, [esp + 0x18]
call fcn.00424050
mov ecx, dword [esp + 0x1c]
mov esi, 8
cmp dword [esp + 0x30], esi
pop ebx
jae 0x41e775
lea ecx, [esp + 0x18]
lea edx, [esp + 0x30]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, di
jne 0x41e780
lea eax, [esp + 0x30]
lea edx, [eax + 2]
jmp 0x41e7a0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e7a0
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
jne 0x41e7d4
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e7c0
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x2e], di
lea ecx, [esp + 0x30]
push ecx
push str._sTencentTencentTraveler100
push 0x208
mov edx, ecx
push 0x104
push edx
call fcn.00425032
add esp, 0x14
cmp dword [esp + 0x2c], esi
jb 0x41e806
mov eax, dword [esp + 0x18]
push eax
call fcn.004250ac
add esp, 4
lea eax, [esp + 0x30]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e810
sub eax, edx
sar eax, 1
je 0x41e8ff
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x30]
push ecx
call esi
test eax, eax
je 0x41e8ff
lea edx, [esp + 0x30]
push edx
push str._sTtConf.dat
push 0x208
lea eax, [esp + 0x244]
push 0x104
push eax
call fcn.00425032
add esp, 0x14
lea ecx, [esp + 0x238]
push ecx
call esi
test eax, eax
je 0x41e8ff
lea edx, [esp + 0x238]
push edx
push 0x64
lea eax, [esp + 0x448]
push eax
push 0x441b18
push str.strHomePageUrl
push str.COMMON
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x440]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e8a1
sub eax, edx
sar eax, 1
je 0x41e8ff
mov edx, str.QQ.COM
lea ecx, [esp + 0x440]
call fcn.0041e010
test eax, eax
jl 0x41e8d3
mov dword [0x44f014], 1
jmp 0x41e8ff
cmp dword [esp + 0x650], edi
je 0x41e8f9
lea ecx, [esp + 0x238]
push ecx
push str.http:__www.qq.com_
push str.strHomePageUrl
push str.COMMON
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [0x44f014], edi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x648]
pop edi
pop esi
xor ecx, esp
call fcn.00424e88
add esp, 0x644
ret