Function at 0x140239d80
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx]
mov rbx, rcx
test edx, edx
je 0x14023a2cf
cmp edx, 0x1a
jg 0x14023a06c
je 0x14023a03c
cmp edx, 0xe
jg 0x140239f2c
je 0x140239efc
sub edx, 2
je 0x140239ecc
sub edx, 3
je 0x140239e9c
sub edx, 2
je 0x140239e6c
dec edx
je 0x140239e3c
sub edx, 3
je 0x140239e0c
cmp edx, 2
jne 0x14023a328
lea r8d, [rdx + 0x3e]
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
call fcn.14000c9f8
mov r8d, 8
lea rdx, str.My_Music
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0xa
lea rdx, str.Start_Menu
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 6
lea rdx, str.Recent
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 7
lea rdx, [0x14035db10]
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 8
lea rdx, str.Personal
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 8
lea rdx, str.Programs
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 8
lea rdx, str.My_Video
jmp 0x14023a31f
sub edx, 0x10
je 0x14023a00c
sub edx, 6
je 0x140239fdc
dec edx
je 0x140239fac
dec edx
je 0x140239f7c
dec edx
jne 0x14023a328
lea r8d, [rdx + 0x40]
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
call fcn.14000c9f8
mov r8d, 0xe
lea rdx, str.Common_Desktop
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0xe
lea rdx, str.Common_Startup
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0xf
lea rdx, str.Common_Programs
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0x11
lea rdx, str.Common_Start_Menu
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 7
lea rdx, str.Desktop
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 7
lea rdx, str.AppData
jmp 0x14023a31f
cmp edx, 0x27
jg 0x14023a1f4
je 0x14023a1c4
sub edx, 0x1c
je 0x14023a194
sub edx, 4
je 0x14023a164
dec edx
je 0x14023a134
dec edx
je 0x14023a104
dec edx
je 0x14023a0d4
cmp edx, 3
jne 0x14023a328
lea r8d, [rdx + 0x26]
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
add rcx, 0x10
call fcn.14000c9f8
mov r8d, 0xf
lea rdx, str.ProgramFilesDir
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0xe
lea rdx, str.Common_AppData
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 7
lea rdx, [0x14035dfc0]
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 7
lea rdx, [0x14035dfd0]
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 5
lea rdx, [0x14035db00]
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0xd
lea rdx, str.Local_AppData
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, VariantTimeToDosDateTime
lea rdx, str.My_Pictures
jmp 0x14023a31f
sub edx, 0x28
je 0x140239e9c
sub edx, 6
je 0x14023a2a2
sub edx, 7
je 0x14023a275
dec edx
je 0x14023a245
dec edx
jne 0x14023a328
lea r8d, [rdx + 0x40]
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
call fcn.14000c9f8
mov r8d, VariantTimeToDosDateTime
lea rdx, str.CommonVideo
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0xe
lea rdx, str.CommonPictures
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, VariantTimeToDosDateTime
lea rdx, str.CommonMusic
jmp 0x14023a31f
mov qword [rcx + 8], 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add rcx, 0x10
mov r8d, 0x40
call fcn.14000c9f8
mov r8d, 0x10
lea rdx, str.Common_Documents
jmp 0x14023a31f
mov rdx, qword [rbx + 0x28]
lea rcx, [0x140329170]
cmp rdx, qword [rcx]
jne 0x14023a2ed
mov rdx, qword [rbx + 0x30]
cmp rdx, qword [rcx + 8]
jne 0x14023a2ed
xor eax, eax
jmp 0x14023a2f2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14023a328
lea rcx, [rbx + 0x10]
lea r8d, [rax + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov qword [rbx + 8], 0xffffffff80000001
call fcn.14000c9f8
mov r8d, 0x26
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
lea rcx, [rbx + 0x18]
call fcn.14000c9f8
add rsp, 0x20
pop rbx
ret