Function at 0x404650
Capabilities:
Create process on windows
Query environment variable
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x388
mov eax, dword [0x417034]
xor eax, esp
mov dword [esp + 0x380], eax
push ebx
push esi
lea eax, [esp + 0x20]
push edi
mov ebx, ecx
push eax
xor esi, esi
call fcn.00406bd0
add esp, 4
test eax, eax
jne 0x40468d
mov eax, dword [esp + 0x24]
mov esi, eax
shr esi, 0x10
imul esi, esi, 0x64
movzx ecx, ax
add esi, ecx
push 0
push ebx
push str._Info__Running_update_package_from______s_n
call fcn.004070f0
xor eax, eax
push 0x44
push eax
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.00409070
push 0x208
lea eax, [esp + 0x195]
push 0
push eax
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], 5
mov byte [esp + 0x19c], 0
call fcn.00409070
push 0x105
lea ecx, [esp + 0x98]
push 0
push ecx
call fcn.00409070
add esp, 0x30
push 0x105
lea edx, [esp + 0x74]
push edx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, 0x105
lea eax, [esp + 0x70]
lea esp, [esp]
cmp byte [eax], 0
je 0x40473f
add eax, 1
sub ecx, 1
jne 0x404730
jmp 0x40475f
test ecx, ecx
je 0x40475f
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0x70]
mov eax, str.Temp
call fcn.004013f0
cmp esi, 0xc8
jne 0x404773
lea eax, [esp + 0x70]
push eax
push str.__q:a__c:_install.exe__l__sdd_netfx20MSI.txt__q_
jmp 0x404791
cmp esi, 0x190
jne 0x404787
lea ecx, [esp + 0x70]
push ecx
push str.__q__norestart__log__sdd_netfx40MSI.txt
jmp 0x404791
lea edx, [esp + 0x70]
push edx
push 0x412ca8
mov eax, 0x209
lea edi, [esp + 0x180]
call fcn.00401390
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 8
push ebx
call esi
mov edi, eax
lea eax, [esp + 0x178]
push eax
call esi
lea esi, [edi + eax + 3]
push esi
call fcn.0040885b
mov edi, eax
add esp, 4
test edi, edi
jne 0x4047da
mov dword [esp + 0x10], 0xe
jmp 0x404900
cmp esi, 0x7fffffff
ja 0x4048ef
mov eax, 0x414148
mov ecx, esi
mov edx, edi
call fcn.004013f0
test eax, eax
jl 0x4048ef
xor edx, edx
test esi, esi
mov ecx, esi
mov eax, edi
je 0x40481d
cmp byte [eax], 0
je 0x404815
add eax, 1
sub ecx, 1
jne 0x404806
jmp 0x40481d
test ecx, ecx
jne 0x40489f
mov edx, 0x80070057
xor eax, eax
test edx, edx
jl 0x4048ef
mov ecx, esi
sub ecx, eax
lea edx, [eax + edi]
mov eax, ebx
call fcn.004013f0
test eax, eax
jl 0x4048ef
push 0x414148
mov ecx, esi
call fcn.00401340
test eax, eax
jl 0x4048ef
lea ecx, [esp + 0x178]
push ecx
mov ecx, esi
call fcn.00401340
test eax, eax
jl 0x4048ef
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4048a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
jmp 0x4048f7
mov eax, esi
sub eax, ecx
jmp 0x404824
mov ecx, dword [esp + 0x1c]
push ecx
mov ebx, str._Info__CLR_setup_process_id:__d_n
call fcn.00407010
mov edx, dword [esp + 0x18]
push edx
call fcn.00405e10
push 0
push 0
push str._Info__CLR_setup_process_exited_n
mov dword [esp + 0x24], eax
call fcn.004070f0
add esp, 0x14
cmp dword [esp + 0x10], 0
jne 0x4048f7
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x4048f7
mov dword [esp + 0x10], 0x643
push edi
call fcn.00407d45
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x404911
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40491c
push eax
call esi
mov ecx, dword [esp + 0x38c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040850f
add esp, 0x388
ret