Function at 0x4090c0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40bb89
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x411618
call fcn.00403150
test eax, eax
je 0x4090f8
mov eax, 1
jmp 0x40939d
mov eax, dword [esi + 0x14c]
xor ebx, ebx
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
jne 0x40911c
mov eax, 1
jmp 0x40939d
mov cx, word [0x410208]
mov dl, byte [0x41020a]
mov word [esp + 0x38], cx
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x3b]
mov byte [esp + 0x3a], dl
push 0x12c
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x3c]
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x37], 0x5c
je 0x409198
mov edi, 0x410048
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x38]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
push 0x4102c4
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x178], ebx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x170], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x16c], bl
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0xc]
mov ecx, 0x411634
push eax
call sub.MFC42.DLL_CString::operator_1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x411634
call fcn.0040a24c
push ecx
mov byte [esp + 0x174], 2
mov ecx, esp
mov dword [esp + 0x30], esp
push str.data2.dat
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x411618
mov byte [esp + 0x174], bl
call fcn.00403790
cmp eax, ebx
je 0x40924f
lea ecx, [esp + 0xc]
mov dword [esp + 0x16c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40939d
push str.neter.exe
lea ecx, [esp + 0x20]
push 0x411634
push ecx
call sub.MFC42.DLL_operator
push str.uninstall.exe
lea edx, [esp + 0x18]
push 0x411634
push edx
mov byte [esp + 0x178], 3
call sub.MFC42.DLL_operator
push 0x410404
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 4
call sub.MFC42.DLL_CString::CString_2
push str.softwaremountain3_neter
lea ecx, [esp + 0x1c]
mov byte [esp + 0x170], 5
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x174], 6
call fcn.0040a24c
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x178], 7
call fcn.0040a24c
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x17c], 8
call fcn.0040a24c
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
mov byte [esp + 0x180], 9
call fcn.0040a24c
push ecx
mov byte [esp + 0x180], 0xa
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x411634
call fcn.0040a24c
mov ecx, 0x411618
mov byte [esp + 0x180], 6
call fcn.00402ac0
lea ecx, [esp + 0x18]
mov dword [0x411650], 1
mov byte [esp + 0x16c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x16c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x16c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x164
ret