Function at 0x1400023a0
Capabilities:
Create thread
Execute command
Self delete

Disassembly:
sub rsp, 0x38
test ecx, ecx
jne 0x140002415
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_eulen__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_loader__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_d3d__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_atx__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_purplerain__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_hwid__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_getid__Q__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_d3d__Q__F
add rsp, 0x38
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp ecx, 1
jne 0x1400025a7
mov qword [rsp + 0x30], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_eulen__Q__F
xor ebx, ebx
lea r8, [0x140001060]
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002454
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_loader__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002483
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_d3d__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400024b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_atx__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400024e1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_purplerain__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_hwid__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000253f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_getid__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000256e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.cd_C:Users_USERNAME_AppDataRoamingMicrosoftWindowsRecent__del_d3d__Q__F
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x30]
test rax, rax
je 0x1400025a7
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret