Function at 0x18026000
Capabilities:
Check if file exists
Get file attributes
Persist via run registry key

Disassembly:
mov eax, 0x1448
call fcn.18029d80
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x1444], eax
cmp dword [0x1805379c], 0
jne 0x18026639
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x104
lea eax, [esp + 0x1048]
push eax
push 0
call esi
mov ebp, dword [sym.imp.MSVCR90.dll_wcscpy_s]
test eax, eax
jbe 0x18026061
lea ecx, [esp + 0x1044]
push ecx
push 0x104
lea edx, [esp + 0x834]
push edx
jmp 0x18026073
push str.c:hnchwp_
push 0x104
lea eax, [esp + 0x834]
push eax
call ebp
add esp, 0xc
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [esp + 0xe4e]
push edx
mov word [esp + 0xe50], cx
call sub.MSVCR90.dll_memset
push 0
push 0
push 0x100
lea eax, [esp + 0xe5c]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x854]
push 0
push ecx
call dword [sym.imp.MSVCR90.dll__wsplitpath_s]
lea edx, [esp + 0xe74]
push str.Viewer
push edx
call dword [sym.imp.MSVCR90.dll_wcsstr]
add esp, 0x38
test eax, eax
je 0x180260f6
lea ecx, [esp + 0xe44]
sub eax, ecx
sar eax, 1
push eax
mov edx, ecx
push edx
mov eax, ecx
push 0x100
push eax
call dword [sym.imp.MSVCR90.dll_wcsncpy_s]
add esp, 0x10
lea ecx, [esp + 0xe44]
push ecx
push str.AppName
call sym.HncBL90.dll_HncRegisterPath
xor edx, edx
xor ecx, ecx
xor eax, eax
mov word [esp + 0x1c], dx
mov word [esp + 0x222], cx
mov word [esp + 0x422], dx
lea ecx, [esp + 0x82c]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x18040c1c
mov word [esp + 0x22], ax
mov word [esp + 0x622], ax
call fcn.18006600
lea ebx, [esp + 0x82c]
lea ecx, [esp + 0x18]
call fcn.18026650
mov ecx, ebx
push ecx
call sym.HncBL90.dll_HncRemoveBackSlash
mov edx, ebx
push edx
push 0x180432c8
call sym.HncBL90.dll_HncRegisterPath
mov ecx, dword [0x18050454]
push 0x104
lea eax, [esp + 0x1048]
push eax
push ecx
call esi
test eax, eax
jbe 0x18026199
lea edx, [esp + 0x1044]
push edx
push 0x104
mov eax, ebx
push eax
jmp 0x180261ab
push str.C:HncCommon90_
push 0x104
lea ecx, [esp + 0x834]
push ecx
call ebp
xor edx, edx
xor ecx, ecx
xor eax, eax
mov word [esp + 0x28], dx
mov word [esp + 0x22e], cx
mov word [esp + 0x42e], dx
add esp, 0xc
lea ecx, [esp + 0x82c]
lea edx, [esp + 0x18]
mov word [esp + 0x22], ax
mov word [esp + 0x622], ax
call fcn.18006600
lea ebx, [esp + 0x82c]
lea ecx, [esp + 0x18]
call fcn.18026650
mov ecx, ebx
push ecx
call sym.HncBL90.dll_HncRemoveBackSlash
mov edx, ebx
push edx
push str.Common
call sym.HncBL90.dll_HncRegisterPath
mov eax, ebx
push 0x5c
push eax
call dword [sym.imp.MSVCR90.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x18026224
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0x82c]
push edx
lea eax, [esp + 0xa38]
push 0x104
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0xa34]
push ecx
call sym.HncBL90.dll_HncRemoveBackSlash
lea edx, [esp + 0xa34]
push edx
push 0x18043304
call sym.HncBL90.dll_HncRegisterPath
lea eax, [esp + 0xa34]
push eax
push str._sShared
lea edx, [esp + 0x834]
call fcn.180054a0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 8
lea ecx, [esp + 0x82c]
push ecx
call edi
cmp eax, 0xffffffff
je 0x18026293
and eax, 0x10
jne 0x180262b5
lea esi, [esp + 0x82c]
call fcn.18025de0
test eax, eax
jne 0x180262b5
push str.C:HncShared_
mov edx, esi
push 0x104
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x82c]
push eax
call edi
cmp eax, 0xffffffff
je 0x180262c9
and eax, 0x10
jne 0x180262e5
lea ecx, [esp + 0xa34]
push ecx
push str._sShared
lea edx, [esp + 0x834]
call fcn.180054a0
add esp, 8
lea edx, [esp + 0x82c]
push edx
call sym.HncBL90.dll_HncRemoveBackSlash
lea eax, [esp + 0x82c]
push eax
push str.SharedData
call sym.HncBL90.dll_HncRegisterPath
mov esi, dword [sym.imp.MSVCR90.dll__wgetenv_s]
push 0x18043358
push 0x104
lea ecx, [esp + 0x1254]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], 0
call esi
add esp, 0x10
cmp dword [esp + 0x14], 0
jne 0x18026356
push str.TEMP
push 0x104
lea eax, [esp + 0x1254]
push eax
lea ecx, [esp + 0x20]
push ecx
call esi
add esp, 0x10
cmp dword [esp + 0x14], 0
jbe 0x18026361
lea edx, [esp + 0x124c]
jmp 0x18026398
lea esi, [esp + 0xa34]
call fcn.18025f20
test eax, eax
je 0x1802638a
mov ecx, esi
push ecx
push str._sTemp_
lea edx, [esp + 0xc44]
call fcn.180054a0
add esp, 8
jmp 0x180263ab
lea esi, [esp + 0x1044]
call fcn.18025d70
mov edx, esi
push edx
lea eax, [esp + 0xc40]
push 0x104
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0xc3c]
push ecx
call sym.HncBL90.dll_HncRemoveBackSlash
lea edx, [esp + 0xc3c]
push edx
push str.Temp
call sym.HncBL90.dll_HncRegisterPath
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor eax, eax
push 0x80000001
mov word [esp + 0x838], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, dword [sym.imp.MSVCR90.dll_wcscat_s]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1802641d
mov edx, dword [esp + 0x10]
push edx
lea edi, [esp + 0x830]
mov ecx, str.AppData
call fcn.18025d00
add esp, 4
test eax, eax
je 0x18026432
mov eax, dword [esp + 0x10]
push eax
call ebp
lea esi, [esp + 0xa34]
call fcn.18025f20
test eax, eax
je 0x18026465
mov ecx, esi
push ecx
jmp 0x1802646d
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea edx, [esp + 0x82c]
push edx
call sym.HncBL90.dll_HncAppendBackSlash
push 0x18043238
lea eax, [esp + 0x830]
push 0x104
push eax
call ebx
add esp, 0xc
jmp 0x18026481
lea edx, [esp + 0xc3c]
push edx
push str._sAppData_
lea edx, [esp + 0x834]
call fcn.180054a0
add esp, 8
lea eax, [esp + 0x82c]
push eax
call sym.HncBL90.dll_HncRemoveBackSlash
lea ecx, [esp + 0x82c]
push ecx
push str.UserData
call sym.HncBL90.dll_HncRegisterPath
push str.UserShared90
lea edx, [esp + 0x830]
push 0x104
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x82c]
push eax
call sym.HncBL90.dll_HncRemoveBackSlash
lea ecx, [esp + 0x82c]
push ecx
push str.UserSharedData
call sym.HncBL90.dll_HncRegisterPath
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor edx, edx
push 0x80000002
mov word [esp + 0x838], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1802651d
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esp + 0x830]
mov ecx, str.Common_AppData
call fcn.18025d00
add esp, 4
test eax, eax
je 0x18026539
mov edx, dword [esp + 0x10]
push edx
call ebp
lea esi, [esp + 0xa34]
call fcn.18025f20
lea edx, [esp + 0x82c]
test eax, eax
je 0x18026566
mov eax, esi
push eax
jmp 0x1802656e
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x82c]
push ecx
call sym.HncBL90.dll_HncAppendBackSlash
push 0x18043238
lea edx, [esp + 0x830]
push 0x104
push edx
call ebx
add esp, 0xc
jmp 0x1802657b
lea ecx, [esp + 0xc3c]
push ecx
push str._sSysData_
call fcn.180054a0
add esp, 8
lea edx, [esp + 0x82c]
push edx
call sym.HncBL90.dll_HncRemoveBackSlash
lea eax, [esp + 0x82c]
push eax
push str.AllUserData
call sym.HncBL90.dll_HncRegisterPath
push 0x104
lea ecx, [esp + 0x830]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push eax
call sym.HncBL90.dll_HncGetResourceExt
lea edx, [esp + 0x82c]
push edx
push str.SysExt
call sym.HncBL90.dll_HncRegisterPath
push 0x104
lea eax, [esp + 0x830]
push eax
push 0xffff
call sym.HncBL90.dll_HncGetResourceExt
lea ecx, [esp + 0x82c]
push ecx
push str.ResExt
call sym.HncBL90.dll_HncRegisterPath
push 0x18043448
push str.DsoExt
call sym.HncBL90.dll_HncRegisterPath
xor edx, edx
lea eax, [esp + 0x82c]
push eax
mov word [esp + 0xc40], dx
push 0x18043460
lea edx, [esp + 0xc44]
call fcn.180054a0
add esp, 8
lea ecx, [esp + 0xc3c]
push ecx
push str.Lang
call sym.HncBL90.dll_HncRegisterPath
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1444]
xor ecx, esp
call fcn.1802929c
add esp, 0x1448
ret