Function at 0x409550
Capabilities:
Delete file
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40bc4f
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push esi
mov esi, ecx
push edi
mov ecx, 0x411618
call fcn.004021c0
test eax, eax
je 0x409599
mov eax, 1
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x168
ret
mov eax, dword [esi + 0x14c]
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x4095cf
mov eax, 1
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x168
ret
mov cx, word [0x410208]
mov dl, byte [0x41020a]
mov word [esp + 0x38], cx
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x3b]
mov byte [esp + 0x3a], dl
push 0x12c
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x3c]
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x37], 0x5c
je 0x40964b
mov edi, 0x410048
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x38]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
push 0x4101ec
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x178], 0
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x170], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x16c], 0
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
mov ecx, 0x411638
push eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, 0x411618
call fcn.00403830
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x411638
call fcn.0040a24c
push ecx
mov byte [esp + 0x174], 2
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.data3.dat
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x411618
mov byte [esp + 0x174], 0
call fcn.00403790
test eax, eax
je 0x409724
lea ecx, [esp + 8]
mov dword [esp + 0x16c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x168
ret
push str.data_rcno.ini
lea ecx, [esp + 0x14]
push 0x411638
push ecx
call sub.MFC42.DLL_operator
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
mov byte [esp + 0x170], 3
call esi
push str.data_ttbox_uninstall.dat
lea eax, [esp + 0x10]
push 0x411638
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x16c], 3
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
push ecx
call esi
push str.cm.exe
lea edx, [esp + 0x1c]
push 0x411638
push edx
call sub.MFC42.DLL_operator
push str.uninstall.exe
lea eax, [esp + 0x18]
push 0x411638
push eax
mov byte [esp + 0x178], 5
call sub.MFC42.DLL_operator
push 0x4101d8
lea ecx, [esp + 0x24]
mov byte [esp + 0x170], 6
call sub.MFC42.DLL_CString::CString_2
push str.softwaremountain3jsb
lea ecx, [esp + 0x20]
mov byte [esp + 0x170], 7
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x174], 8
call fcn.0040a24c
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
mov byte [esp + 0x178], 9
call fcn.0040a24c
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
mov byte [esp + 0x17c], 0xa
call fcn.0040a24c
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x180], 0xb
call fcn.0040a24c
push ecx
mov byte [esp + 0x180], 0xc
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x411638
call fcn.0040a24c
mov ecx, 0x411618
mov byte [esp + 0x180], 8
call fcn.00402ac0
lea ecx, [esp + 0x1c]
mov dword [0x411654], 1
mov byte [esp + 0x16c], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x16c], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x16c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x16c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x16c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x164]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x168
ret