When running under a limited UAC account, the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run. This indicates that the authors are trying to hide some messages showed by the system during the setup process