Function at 0x403790
Capabilities:
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x380
mov eax, dword [0x417034]
xor eax, esp
mov dword [esp + 0x378], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0
push ebx
push str._Info__Running_update_package_from______s_n
call fcn.004070f0
xor eax, eax
push 0x44
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x24], 0
call fcn.00409070
push 0x208
lea ecx, [esp + 0x18d]
push 0
push ecx
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], 1
mov word [esp + 0x74], 5
mov byte [esp + 0x194], 0
call fcn.00409070
push 0x105
lea edx, [esp + 0x90]
push 0
push edx
call fcn.00409070
add esp, 0x30
push 0x105
lea eax, [esp + 0x6c]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, 0x105
lea eax, [esp + 0x68]
cmp byte [eax], 0
je 0x403854
add eax, 1
sub ecx, 1
jne 0x403845
jmp 0x403874
test ecx, ecx
je 0x403874
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0x68]
mov eax, str.Temp
call fcn.004013f0
lea ecx, [esp + 0x68]
push ecx
push str.__q__norestart
mov eax, 0x209
lea edi, [esp + 0x178]
call fcn.00401390
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 8
push ebx
call esi
lea edx, [esp + 0x170]
push edx
mov edi, eax
call esi
lea esi, [edi + eax + 3]
push esi
call fcn.0040885b
mov edi, eax
add esp, 4
test edi, edi
jne 0x4038c7
mov dword [esp + 0xc], 0xe
jmp 0x4039e2
cmp esi, 0x7fffffff
ja 0x4039d1
mov eax, 0x414148
mov ecx, esi
mov edx, edi
call fcn.004013f0
test eax, eax
jl 0x4039d1
xor edx, edx
test esi, esi
mov ecx, esi
mov eax, edi
je 0x403906
cmp byte [eax], 0
je 0x403902
add eax, 1
sub ecx, 1
jne 0x4038f3
jmp 0x403906
test ecx, ecx
jne 0x403984
mov edx, 0x80070057
xor eax, eax
test edx, edx
jl 0x4039d1
mov ecx, esi
sub ecx, eax
lea edx, [eax + edi]
mov eax, ebx
call fcn.004013f0
test eax, eax
jl 0x4039d1
push 0x414148
mov ecx, esi
call fcn.00401340
test eax, eax
jl 0x4039d1
lea eax, [esp + 0x170]
push eax
mov ecx, esi
call fcn.00401340
test eax, eax
jl 0x4039d1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40398a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
jmp 0x4039d9
mov eax, esi
sub eax, ecx
jmp 0x40390d
mov eax, dword [esp + 0x18]
push eax
mov ebx, str._Info__WIC_setup_process_id:__d_n
call fcn.00407010
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00405e10
push 0
push 0
push str._Info__WIC_setup_process_exited_n
mov dword [esp + 0x20], eax
call fcn.004070f0
add esp, 0x14
cmp dword [esp + 0xc], 0
jne 0x4039d9
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x4039d9
mov dword [esp + 0xc], 0x643
push edi
call fcn.00407d45
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4039f3
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4039fe
push eax
call esi
mov ecx, dword [esp + 0x384]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040850f
add esp, 0x380
ret