Function at 0x140006800
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa80
mov rax, qword [0x140018280]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov rdx, rcx
mov rdi, r8
lea rcx, [0x14001aa24]
xor r8d, r8d
call fcn.140005528
lea rdx, str.uninstall.lng
lea rcx, [0x14001aa28]
call fcn.1400052ac
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, str.riched32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [0x14001aa10]
lea rdx, str.RARICON
mov r12, rax
call qword [sym.imp.USER32.dll_LoadIconA]
mov ecx, 0xfffffff4
mov qword [0x14001bfa8], rax
call fcn.140006d88
xor r13d, r13d
mov ecx, eax
lea rax, str.MS_Shell_Dlg
xor r9d, r9d
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x2bc
call qword [sym.imp.GDI32.dll_CreateFontA]
lea rdx, [rsp + 0x270]
lea rcx, str.sfxcmd
mov r8d, 0x400
mov esi, r13d
mov bpl, r13b
mov qword [0x14001bfa0], rax
mov byte [rsp + 0x270], r13b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [rsp + 0x270], r13b
je 0x140006952
lea rbx, [rsp + 0x270]
cmp byte [rbx], 0x2d
je 0x140006925
cmp byte [rbx], 0x2f
jne 0x140006941
movsx ecx, byte [rbx + 1]
call fcn.140008914
cmp eax, 0x53
jne 0x140006941
movzx ecx, byte [rbx + 2]
call fcn.140008c80
cmp eax, r13d
je 0x14000694b
inc rbx
cmp byte [rbx], r13b
je 0x140006952
jmp 0x14000691b
mov byte [0x14001bfb0], 1
lea rdx, [0x1400142d4]
mov rcx, rdi
call fcn.140007d88
mov rdi, rax
cmp rax, r13
je 0x140006bcb
inc rdi
lea rdx, str.setup
mov r8d, 5
mov rcx, rdi
call fcn.1400121c8
cmp eax, r13d
jne 0x140006992
mov bpl, 1
jmp 0x140006aa9
lea rdx, [0x1400142c8]
mov r8d, 3
mov rcx, rdi
call fcn.1400121c8
cmp eax, r13d
jne 0x1400069b8
mov byte [0x14001bfb1], 1
jmp 0x140006aa9
movsx ecx, byte [rdi]
call fcn.140008914
cmp eax, 0x53
jne 0x1400069e1
movzx ecx, byte [rdi + 1]
call fcn.140008c80
cmp eax, r13d
jne 0x1400069e1
mov byte [0x14001bfb0], 1
dec esi
jmp 0x140006aa9
lea rdx, str.wait
mov r8d, 4
mov rcx, rdi
call fcn.1400121c8
cmp eax, r13d
jne 0x140006a0b
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006aa9
lea rdx, str.warning
mov r8d, 7
mov rcx, rdi
call fcn.1400121c8
cmp eax, r13d
jne 0x140006aa9
lea rdx, [rsp + 0x670]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x13f1
call fcn.14000547c
lea rdx, [0x1400142b4]
lea rcx, [rsp + 0x70]
mov r8, rax
call fcn.140007180
mov ecx, 0x13f2
call fcn.14000547c
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.14000702c
lea r8, [rsp + 0x670]
lea rcx, [rsp + rax + 0x70]
mov rdx, rbx
call fcn.140007180
mov ecx, 0x13f0
call fcn.14000547c
lea rdx, [rsp + 0x70]
mov r9d, 0x10040
mov r8, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [0x1400142d4]
mov rcx, rdi
inc esi
call fcn.140007d88
mov rdi, rax
cmp rax, r13
jne 0x14000696d
cmp bpl, r13b
je 0x140006bc6
call fcn.140005cd8
mov rcx, qword [0x14001aa10]
lea r9, [0x140005ea0]
lea rdx, str.SETUPDLG
xor r8d, r8d
mov bl, al
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_DialogBoxParamA]
cmp rax, r13
je 0x140006bc6
call fcn.140005c18
mov r11b, byte [0x14001bfb1]
cmp r11b, r13b
jne 0x140006b3d
mov rcx, qword [0x14001aa10]
lea r9, [0x1400057f8]
lea rdx, str.DONEDLG
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_DialogBoxParamA]
mov r11b, byte [0x14001bfb1]
cmp bl, r13b
je 0x140006b82
cmp byte [0x14001bfb0], r13b
jne 0x140006b82
cmp r11b, r13b
jne 0x140006b82
mov ecx, 0x13ed
call fcn.14000547c
mov ecx, 0x140f
mov rbx, rax
call fcn.14000547c
mov r9d, 0x10040
mov r8, rbx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r11b, byte [0x14001bfb1]
cmp byte [0x14001bba0], r13b
je 0x140006bc6
cmp byte [0x14001bfb0], r13b
jne 0x140006bc6
cmp r11b, r13b
jne 0x140006bc6
lea rax, [0x1400137ff]
lea r8, [0x14001bba0]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp esi, r13d
jne 0x140006bd0
call fcn.1400060d4
cmp r12, r13
je 0x140006bde
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, qword [0x14001bfa0]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x14001bfa8]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.140007160
mov rbx, qword [rsp + 0xab8]
add rsp, 0xa80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret