Function at 0x180008d20
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x300
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x18002f048]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
xor edi, edi
mov dword [rsp + 0x30], edi
lea rsi, vtable.CCfgOPBaseT_int_.0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x78], edi
mov qword [rbp - 0x70], rdi
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x18000926f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rdx, [0x180021be8]
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x180008db0
mov r8d, eax
lea rcx, [rbp - 0x68]
call fcn.1800056c0
lea rcx, [rsp + 0x78]
call fcn.180004660
nop
lea rax, vtable.CCfgShell.0
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x58]
call fcn.1800011a0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.18000b960
call fcn.180007ea0
test eax, eax
je 0x180008e0d
lea rcx, str.CZipContextMenu_Start
call fcn.1800086d0
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.isps
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008e5b
cmp dword [rsp + 0x3c], 4
jne 0x180008e5b
cmp dword [rsp + 0x34], eax
jne 0x1800091aa
mov r8d, 0x104
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.explorer.exe
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180008e9d
lea rdx, str.Coupon.exe
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800091aa
call fcn.180007ea0
xor r8d, r8d
lea rdx, str.StartTime
mov rcx, qword [rbp - 0x80]
test eax, eax
je 0x180008f0f
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x40], 8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008ef2
cmp dword [rsp + 0x44], 0xb
jne 0x180008ef2
mov rbx, qword [rsp + 0x50]
jmp 0x180008efa
mov rbx, rdi
mov qword [rsp + 0x50], rbx
xor ecx, ecx
call fcn.1800124ac
sub rax, rbx
cmp rax, 0x3c
jge 0x180008f6b
jmp 0x1800091aa
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x48], 8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008f4d
cmp dword [rsp + 0x4c], 0xb
jne 0x180008f4d
mov rbx, qword [rsp + 0x58]
jmp 0x180008f55
mov rbx, rdi
mov qword [rsp + 0x58], rbx
xor ecx, ecx
call fcn.1800124ac
sub rax, rbx
cmp rax, 0x708
jl 0x1800091aa
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x60]
call fcn.1800070c0
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000918a
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x18000927a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 1
mov r9d, 4
lea r8, str._startby
lea rdx, str._s_d
lea rcx, [rsp + 0x68]
call fcn.180002090
nop
mov rdi, qword [rsp + 0x68]
lea r12, [rdi - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x180008ff9
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x18000900a
call fcn.180002c40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x180009285
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x30], 3
movsxd r13, dword [rdi - 0x10]
lea rdx, str._auto
mov rsi, r14
nop dword [rax + rax]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x180009040
lea r15d, [rsi + r13]
test r15d, r15d
js 0x180009290
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x180009082
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.180004d30
mov rbx, qword [rsp + 0x70]
lea rdx, str._auto
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x1800090b0
test rbx, rbx
jne 0x1800090a5
call fcn.18000df84
mov dword [rax], 0x16
call fcn.18000de64
jmp 0x1800090b0
mov r8, rsi
mov rcx, rbx
call fcn.18000b4f0
mov rdx, r13
lea rcx, [rsi + rbx]
mov r9d, r13d
mov r8, rdi
call fcn.180006410
cmp r15d, dword [rbx - 0xc]
jg 0x180009264
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor edi, edi
mov word [rbx + rax*2], di
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, qword [rsp + 0x60]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x30], 1
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000911c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, r14d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x180009138
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
xor ecx, ecx
call fcn.1800124ac
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.StartTime
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.180007ea0
test eax, eax
je 0x180009183
lea rcx, str.Update_Start
call fcn.1800086d0
lea rsi, vtable.CCfgOPBaseT_int_.0
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800091aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov qword [rbp - 0x58], rsi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1800091c1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x48], edi
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800091e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1800091f5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x48], edi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180009207
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180009226
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x180009234
test rdi, rdi
je 0x180009234
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.18000a020
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
int3
mov ecx, 0x80070057
call fcn.1800016f0
int3