Function at 0x4016c0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x964
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, ecx
push edi
push 0x418988
push str._sReleasephysx27_64GameApp.exe
push 0x419760
mov dword [ebp - 0x964], edx
mov dword [0x419750], ebx
call esi
add esp, 0xc
push 0x419760
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x401792
lea eax, [ebp - 0x914]
mov dword [ebp - 0x914], 0x104
push eax
push 0x418988
push 0
push 0x20000002
push str.PathRoot
push str.SOFTWARETencentQQ
push connect
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4018a7
push 0x418988
push str._sReleasephysx27_64GameApp.exe
push 0x419760
call esi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x418988
push 0x4161c8
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x44
push 0x419a08
push eax
push 0
call edi
cmp eax, 7
je 0x401b06
push 0x418988
lea eax, [ebp - 0x910]
push str._sLoaderLoaderBG.bmp
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x910]
push 0x2010
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
mov dword [0x419970], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [0x419970]
mov dword [0x419a04], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
lea eax, [ebp - 0x924]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [ebp - 0x924], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x918]
push 0
push ebx
push 0
add eax, 0xffffff38
push 0
cdq
push 0xc8
sub eax, edx
push 0x12c
sar eax, 1
push eax
mov eax, dword [ebp - 0x91c]
add eax, 0xfffffed4
cdq
sub eax, edx
sar eax, 1
push eax
push connect
push 0x419a08
push str.QQSpeed
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x419754], eax
test eax, eax
je 0x401b06
mov eax, dword [ebp - 0x964]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x41996c], eax
call ebx
push eax
lea eax, [ebp - 0x910]
push str.RunSpeedGameEvent__d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x419968], eax
test eax, eax
jne 0x4018ce
push 0x10
push 0x419a08
push 0x4162a4
jmp 0x401af2
push 0x10
push 0x419a08
push 0x416214
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403102
mov esp, ebp
pop ebp
ret
call ebx
push eax
lea eax, [ebp - 0x910]
push 0x4162b4
push eax
call esi
add esp, 0xc
mov dword [ebp - 0x948], 0
lea eax, [ebp - 0x910]
mov dword [ebp - 0x928], 0
xorps xmm0, xmm0
mov dword [ebp - 0x94c], eax
lea eax, [ebp - 0x960]
movlpd qword [ebp - 0x940], xmm0
push eax
movlpd qword [ebp - 0x938], xmm0
movlpd qword [ebp - 0x930], xmm0
mov dword [ebp - 0x960], 0x3c
mov dword [ebp - 0x95c], 0x40
mov dword [ebp - 0x958], 0
mov dword [ebp - 0x954], str.runas
mov dword [ebp - 0x950], 0x419760
mov dword [ebp - 0x944], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401ae6
mov eax, dword [ebp - 0x928]
mov dword [0x419a00], eax
call ebx
push eax
lea eax, [ebp - 0x910]
push str.KartMap_Shared__d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 0xa17
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x41997c], eax
test eax, eax
jne 0x4019bd
push 0x10
push eax
push 0x4162fc
jmp 0x401af2
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x419758], eax
test eax, eax
jne 0x4019ef
push dword [0x41997c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0
push 0x416320
jmp 0x401af2
call fcn.00402e50
mov edx, dword [0x419974]
test edx, edx
jne 0x401a2e
mov eax, dword [0x419a00]
test eax, eax
je 0x401afa
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x419a00]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x419a00], 0
jmp 0x401afa
mov ecx, dword [0x419758]
mov eax, dword [0x419754]
push 0
push 5
mov dword [ecx], eax
lea eax, [ebp - 0x110]
push eax
push 0
mov dword [ecx + 8], edx
mov dword [ecx + 0x34], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401a7d
mov eax, dword [0x419758]
lea ecx, [ebp - 0x110]
push dword [eax + 8]
add eax, 0x38
push ecx
push str._sQQ
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x419758]
push 0x419980
mov dword [eax + 0x13c], 0
movups xmm0, xmmword [str.rouruandefeng888]
movups xmmword [eax + 0x1c0], xmm0
add eax, 0x1d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401ab0
push dword [0x419968]
sub edx, eax
mov eax, dword [0x419758]
mov dword [eax + 0x1d0], edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403102
mov esp, ebp
pop ebp
ret
push 0x10
push 0x419a08
push 0x4162c8
push dword [0x419754]
call edi
push dword [0x419754]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403102
mov esp, ebp
pop ebp
ret