Function at 0x431670
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
sub esp, 0x660
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x65c], eax
push ebp
push esi
push edi
push str.Quit_Setup.exe..._r_n
mov ebp, ecx
call fcn.0041b730
lea edi, [ebp + 0x48]
add esp, 4
mov ecx, edi
call fcn.0043f760
mov esi, eax
test esi, esi
je 0x4316cd
mov ecx, edi
call fcn.0043f540
test eax, eax
jne 0x4316cd
mov ecx, edi
call fcn.00424940
mov ecx, eax
call fcn.00424a00
mov edx, dword [eax]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x80]
push edx
push esi
call eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.0043f540
test eax, eax
je 0x4318bf
cmp dword [0x4a2284], 0
je 0x4318bf
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x52]
push edx
mov word [esp + 0x54], cx
call fcn.00461880
add esp, 0xc
push 0x104
lea eax, [esp + 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [esp + 0x4c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x25a]
push ecx
mov word [esp + 0x25c], ax
call fcn.00461880
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x472]
push eax
mov word [esp + 0x474], dx
call fcn.00461880
add esp, 0x18
push 0x104
lea ecx, [esp + 0x460]
push ecx
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str._c_del__]
mov word [esp + eax + 0x250], cx
add eax, 2
test cx, cx
jne 0x431790
lea eax, [esp + 0x48]
mov edx, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4317b0
lea edi, [esp + 0x250]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4317d0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4317d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x250]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4317f6
mov edx, dword [str.____nul]
mov ecx, dword [0x488fe0]
mov dword [eax], edx
mov edx, dword [0x488fe4]
mov dword [eax + 4], ecx
mov ecx, dword [0x488fe8]
mov dword [eax + 8], edx
push 0x3c
lea edx, [esp + 0x10]
push 0
push edx
mov dword [eax + 0xc], ecx
call fcn.00461880
lea edx, [esp + 0x18]
lea eax, [esp + 0x468]
lea ecx, [esp + 0x25c]
push edx
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], str.Open
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x20], 0x40
call fcn.00461730
add esp, 0x10
test eax, eax
je 0x4318bf
mov eax, dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push eax
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea ecx, [esp + 0x4c]
push ecx
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0x670]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [esp + 0x668]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00461862
add esp, 0x660
ret 4