Is there analysis on what encryption algorithm was being used? And how the payment confirmation switch works on the malware.

Is it possible instead of patching the OS, to release a patch which patches the malware binary to no-op the payment switch?