Function at 0x140007254
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
mov eax, 0x1480
call fcn.140012000
sub rsp, rax
mov rax, qword [0x140019280]
xor rax, rsp
mov qword [rsp + 0x1470], rax
mov rbx, rcx
mov cl, 1
call fcn.140005d80
lea rcx, [0x14001ba04]
xor r8d, r8d
mov rdx, rbx
call fcn.140005b18
lea rdx, str.uninstall.lng
lea rcx, [0x14001ba08]
call fcn.140005870
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, str.riched32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [0x14001b9f0]
lea rdx, str.RARICON
mov r12, rax
call qword [sym.imp.USER32.dll_LoadIconW]
xor r13d, r13d
mov qword [0x14001e388], rax
cmp rax, r13
jne 0x140007315
mov rcx, qword [0x14001b9e8]
cmp rcx, qword [0x14001b9f0]
je 0x140007315
lea rdx, str.RARICON
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [0x14001e388], rax
mov ecx, 0xfffffff4
call fcn.1400076fc
xor r9d, r9d
xor r8d, r8d
mov ecx, eax
lea rax, str.MS_Shell_Dlg
xor edx, edx
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x2bc
call qword [sym.imp.GDI32.dll_CreateFontW]
lea rdx, [rsp + 0x70]
lea rcx, str.sfxcmd
mov r8d, 0x400
mov esi, r13d
mov qword [0x14001e380], rax
mov bpl, r13b
mov word [rsp + 0x70], r13w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdi, r13
cmp word [rsp + 0x70], r13w
je 0x1400073ee
lea rax, [rsp + 0x70]
mov rbx, r13
cmp word [rax], 0x2d
je 0x1400073b5
cmp word [rax], 0x2f
jne 0x1400073d3
movzx ecx, word [rsp + rbx + 0x72]
call fcn.140005fd4
cmp eax, 0x53
jne 0x1400073d3
movzx ecx, word [rsp + rbx + 0x74]
call fcn.1400097e4
cmp eax, r13d
je 0x1400073e7
inc rdi
lea rbx, [rdi + rdi]
lea rax, [rsp + rbx + 0x70]
cmp word [rax], r13w
je 0x1400073ee
jmp 0x1400073a9
mov byte [0x14001e390], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [0x140014e94]
mov rcx, rax
call fcn.140008e34
mov rdi, rax
cmp rax, r13
je 0x140007696
add rdi, 2
lea rdx, str.setup
mov r8d, 5
mov rcx, rdi
call fcn.140005ee8
cmp eax, r13d
jne 0x140007435
mov bpl, 1
jmp 0x140007562
lea rdx, [0x140014e80]
mov r8d, 3
mov rcx, rdi
call fcn.140005ee8
cmp eax, r13d
jne 0x14000745b
mov byte [0x14001e391], 1
jmp 0x140007562
movzx ecx, word [rdi]
call fcn.140005fd4
cmp eax, 0x53
jne 0x140007484
movzx ecx, word [rdi + 2]
call fcn.140005d28
cmp al, r13b
jne 0x140007484
mov byte [0x14001e390], 1
dec esi
jmp 0x140007562
lea rdx, str.wait
mov r8d, 4
mov rcx, rdi
call fcn.140005ee8
cmp eax, r13d
jne 0x1400074ae
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007562
lea rdx, str.warning
mov r8d, 7
mov rcx, rdi
call fcn.140005ee8
cmp eax, r13d
jne 0x140007562
lea rdx, [rsp + 0xc70]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x13f1
call fcn.140005a58
lea r8, [0x140014e58]
lea rcx, [rsp + 0x870]
mov r9, rax
mov edx, 0x200
call fcn.140007768
mov ecx, 0x13f2
call fcn.140005a58
lea rcx, [rsp + 0x870]
mov rbx, rax
call fcn.140007fd4
lea r9, [rsp + 0xc70]
lea rcx, [rsp + rax*2 + 0x870]
mov r8, rbx
mov edx, 0x200
call fcn.140007768
mov ecx, 0x13f0
call fcn.140005a58
lea rdx, [rsp + 0x870]
mov r9d, 0x10040
mov r8, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x140014e94]
mov rcx, rdi
inc esi
call fcn.140008e34
mov rdi, rax
cmp rax, r13
jne 0x14000740f
cmp bpl, r13b
je 0x140007691
call fcn.140006610
mov rcx, qword [0x14001b9f0]
lea r9, [0x140006fec]
lea rdx, str.SETUPDLG
xor r8d, r8d
mov bl, al
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, r13
je 0x140007691
call fcn.140006544
mov r11b, byte [0x14001e391]
cmp r11b, r13b
jne 0x1400075f6
mov rcx, qword [0x14001b9f0]
lea r9, [0x1400060f8]
lea rdx, str.DONEDLG
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov r11b, byte [0x14001e391]
cmp bl, r13b
je 0x14000763b
cmp byte [0x14001e390], r13b
jne 0x14000763b
cmp r11b, r13b
jne 0x14000763b
mov ecx, 0x13ed
call fcn.140005a58
mov ecx, 0x140f
mov rbx, rax
call fcn.140005a58
mov r9d, 0x10040
mov r8, rbx
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r11b, byte [0x14001e391]
cmp word [0x14001db80], r13w
je 0x140007691
cmp byte [0x14001e390], r13b
jne 0x140007691
cmp r11b, r13b
jne 0x140007691
lea rcx, [0x14001db80]
call fcn.140001a7c
cmp al, r13b
je 0x140007691
lea rax, [0x1400139b0]
lea r8, [0x14001db80]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, r13d
jne 0x14000769b
call fcn.1400069b8
cmp r12, r13
je 0x1400076a9
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, qword [0x14001e380]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x14001e388]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x14001e394]
mov rcx, qword [rsp + 0x1470]
xor rcx, rsp
call fcn.140008090
lea r11, [rsp + 0x1480]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret