Function at 0x140005d90
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005dda
jmp 0x1400060a0
lea rcx, [rbp - 0x18]
lea rdx, str.Recent
call fcn.140008ee0
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e1c
jmp 0x1400060a0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea rcx, [rbp - 0x38]
call fcn.140008ee0
jmp 0x140005e31
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e63
jmp 0x1400060b5
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e95
jmp 0x1400060b5
lea rcx, [rbp + 8]
mov rdx, 0xffffffff80000001
lea r8, [rbp - 0x38]
lea r9, [rbp - 0x18]
call fcn.140004420
jmp 0x140005eb2
lea rcx, [rbp - 0x38]
call fcn.140006880
lea rcx, [rbp - 0x18]
call fcn.140006880
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005ef6
jmp 0x1400060ba
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005f28
jmp 0x1400060ba
lea rdx, str.C:Windowsprefetch
lea rcx, [rbp - 0x58]
call fcn.140008ee0
jmp 0x140005f3d
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005f6f
jmp 0x1400060bf
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005fa1
jmp 0x1400060bf
lea rcx, [rbp + 8]
call fcn.1400051b0
jmp 0x140005faf
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005fe1
jmp 0x1400060c4
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140006013
jmp 0x1400060c4
lea rcx, [rbp - 0x58]
call fcn.1400051b0
jmp 0x140006021
lea rcx, [rbp - 0x58]
call fcn.140006880
lea rcx, [rbp + 8]
call fcn.140006880
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140006065
jmp 0x1400060c9
mov eax, dword [0x14004b384]
mov ecx, dword [0x14004b388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140006097
jmp 0x1400060c9
add rsp, 0xb0
pop rbp
ret
lea rcx, [rbp - 0x18]
lea rdx, str.Recent
call fcn.140008ee0
jmp 0x140005dda
jmp 0x140005e63
jmp 0x140005ef6
jmp 0x140005f6f
jmp 0x140005fe1
jmp 0x140006065