Function at 0x14000d9a0
Capabilities:
Capture network configuration via ipconfig
Clear windows event logs
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [0x14008e354]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Saturn_Paid_Temp___discord.gg_saturniv_n_n__1__Spoof_MAC_n__2__Deep_Clean_n__3__Randomize__Tournament__n_n__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a040
lea rdx, [rbp + 0x3f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp + 0x3f]
sub ecx, 1
je 0x14000dbe3
sub ecx, 1
je 0x14000daf7
cmp ecx, 1
jne 0x14000dcca
lea rcx, [0x1400e5b80]
call fcn.140017e50
call fcn.140001fe0
mov qword [0x1400a1aa8], rax
cmp rax, 0xffffffffffffffff
je 0x14000dcc5
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
mov qword [rbp + 0x2f], rax
mov ecx, 0x51bf
call fcn.1400723f8
test rax, rax
je 0x14000daf0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rbp + 0x1f], rbx
lea rdi, [rbx + 0x5198]
mov qword [rbp + 0x2f], rdi
mov r8d, 0x5198
lea rdx, [0x14009c910]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x27], rdi
mov dword [rbp + 0x17], 0
sub rdi, rbx
lea rax, [rbp + 0x17]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 0
mov r8, rdi
mov rdx, rbx
call fcn.1400091b0
mov rcx, qword [0x1400a1aa8]
call fcn.1400029f0
nop
cmp rdi, 0x1000
jb 0x14000dae0
mov edi, 0x51bf
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000daf0
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1400722d0
jmp 0x14000dcc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [0x1400e5b80]
call fcn.140017e50
lea rcx, [0x1400e5b80]
call fcn.140017e50
lea rcx, [0x14008e354]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400723f8
mov rdx, rax
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14008e640]
movdqu xmmword [rbp + 0x2f], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32deepcln.bat]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14008e388]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14008e390]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14008e394]
mov word [rdx + 0x1c], ax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
mov r8d, 0x428d6
lea rdx, str.::_Bat_To_Exe_Converter__r_n::_r_n::YAwzoRdxOkEWAnk_r_n::fBw5plQjdG8_r_n::YAwzuBVtJxjWCl3EqQJgSA_r_n::ZR4luwNxJguZRRnk_r_n::Yhs_ulQjdF5_r_n::cxAkpRVqdFKZSjk_r_n::cBs_ulQjdF5_r_n::ZR41oxFsdFKZSDk_r_n::eBoioBt6dFKZSDk_r_n::cRo6pxp7LAbNWATEpCI_r_n::egkzugNsPRvcWATEpCI_r_n::dAsiuh18IRvcCxnZtBJQ_r_n::cRYluBh_LUEWAnk_r_n::YxY4rhsaUJeA_r_n::cxY6rQJ7JhzQF1fEqQJQ_r_n::ZQ05rAF9IBncCkqN0xwdVs0_r_n::ZQ05rAF9IAHYFVzEqQJQ_r_n::eg0_rx1wNQPfEVWBkM9LVsJDGQ_r_n::fBEirQZwNQPfEVWBkM9LVsJDGQ_r_n::cRolqwZ3JBvQF1fEqQJQ_r_n::dhA7uBVwLUEWDk_r_n::YQ03rBFzNR3SWATElA_r_n::dhAmsQZ3MwfNWATElA_r_n::ZQ0_vhVqMQ3MEVWAtB9wSA_r_n::Zg8zqx1_OA3MEVWAtB9wSA_r_n::dhA7pRFwIByZRRnk_r_n::Zh4grVQjdCyDJGyX8VAjFClbQxCGG6pDaETNTL7OGA8AMYTOdf_r_n::YB416EkZW8_r_n::_r_n::_r_n::978f952a14a936cc963da21a135fa983_r_n_echo_off_r_n::_BatchGotAdmin_r_n:______________________________________r_n_r_nREM_____Check_for_permissions_r_nIF___PROCESSOR_ARCHITECTURE___EQU__amd64____r_n_nul_2_1___SYSTEMROOT_SysWOW64cacls.exe____SYSTEMROOT_SysWOW64config_system__r_n__ELSE___r_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__r_n__r_n_r_nREM_____If_error_flag_set__we_do_not_have_admin._r_nif__errorlevel__NEQ_0___r_necho_Requesting_Admin..._r_ngoto_UACPrompt_r_n__else___goto_gotAdmin___r_n_r_n:UACPrompt_r_necho_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__r_nset_params___r_necho_UAC.ShellExecute__cmd.exe_____c____s0____params:____________runas___1______temp_getadmin.vbs__r_n_r_n__temp_getadmin.vbs__r_ndel___temp_getadmin.vbs__r_nexit__B_r_n_r_n:gotAdmin_r_npushd___CD___r_nCD__D___dp0__r_n_r_ntaskkill__f__im_epicgameslauncher.exe__nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping_EAC.exe__nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping_BE.exe__nul_r_ntaskkill__f__im_FortniteLauncher.exe__nul_r_ntaskkill__f__im_OneDrive.exe__nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping.exe__nul_r_ntaskkill__f__im_EpicGamesLauncher.exe__nul_r_ntaskkill__f__im_UnrealCEFSubProcess.exe__nul_r_ntaskkill__f__im_CEFProcess.exe__nul_r_ntaskkill__f__im_EasyAntiCheat.exe__nul_r_ntaskkill__f__im_BEService.exe__nul_r_ntaskkill__f__im_BEServices.exe__nul_r_ntaskkill__f__im_BattleEye.exe__nul_r_ntaskkill__f__im_PerfWatson2.exe__nul_r_ntaskkill__f__im_vgtray.exe__nul_r_n_r_nSc_stop_EasyAntiCheat_r_nSc_stop_FortniteClient_Win64_Shipping_EAC_r_nSc_stop_BattleEye_r_nSc_stop_FortniteClient_Win64_Shipping_BE_r_n_r_ndel__s__f__q__SYSTEMDRIVE_windows_temp._r_nrd__s__q__SYSTEMDRIVE_windows_temp_r_nmd_c:windows_temp_r_ndel__s__f__q__SYSTEMDRIVE_WINDOWSPrefetch_r_ndel__s__f__q__temp_._r_nrd__s__q__temp__r_nmd__temp__r_ndel__q__f__s__SYSTEMDRIVE_Temp._r_ndel__q__f__s__WINDIR_Prefetch._r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineHardware_Survey___f_1_nul_2_nul_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_EngineIdentifiers___f_1_nul_2_nul_r_nreg_delete__HKUS_1_5_21_860440266_1445122309_108474356_1001SoftwareEpic_GamesUnreal_EngineIdentifiers___va__f_1_nul_2_nul_r_nreg_delete__HKUS_1_5_21_860440266_1445122309_108474356_1001SoftwareEpic_GamesUnreal_EngineHardware_Survey___va__f_1_nul_2_nul_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_1_nul_2_nul_r_nreg_delete__HKUS_1_5_21_860440266_1445122309_108474356_1001SoftwareEpic_Games___f_1_nul_2_nul_r_nREG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d_DESKTOP__random___f_1_nul_2_nul_r_nREG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d_DESKTOP__random___f_1_nul_2_nul_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_1_nul_2_nul_r_n_echo_off_____r_ndel__s__f__q__windir__temp._____r_nrd__s__q__windir__temp_____r_nmd__windir__temp_____r_ndel__s__f__q__windir_Prefetch._____r_nrd__s__q__windir_Prefetch_____r_nmd__windir_Prefetch_____r_ndel__s__f__q__windir__system32dllcache._____r_nrd__s__q__windir__
lea rcx, [rbp + 0x1f]
call fcn.14000d850
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x14000dbd7
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dbd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dbd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400722d0
lea rcx, str.C:WindowsSystem32deepcln.bat
jmp 0x14000dcbf
lea rcx, [0x1400e5b80]
call fcn.140017e50
lea rcx, [0x1400e5b80]
call fcn.140017e50
lea rcx, [0x14008e354]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400723f8
mov rdx, rax
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14008e620]
movdqu xmmword [rbp + 0x2f], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32clean.bat]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14008e368]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14008e370]
mov dword [rax + 0x18], ecx
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
mov r8d, 0x813
lea rdx, str._ECHO_OFF_r_n_SETLOCAL_ENABLEDELAYEDEXPANSION_r_n_SETLOCAL_ENABLEEXTENSIONS_r_n_r_n_::Generate_and_implement_a_random_MAC_address_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_CALL_:MAC_r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_NetworkAddress__t_REG_SZ__d__MAC____f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Disable_power_saving_mode_for_network_adapters_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_PnPCapabilities__t_REG_DWORD__d_24__f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Reset_NIC_adapters_so_the_new_MAC_address_is_implemented_and_the_power_saving_mode_is_disabled._r_n_FOR__F__tokens2_delims__skip2____a_IN___wmic_nic_where__netconnectionid_like_____get_netconnectionid_netconnectionstatus__format:csv___DO___r_n_netsh_interface_set_interface_name___a__disable__NUL_2_NUL_r_n_netsh_interface_set_interface_name___a__enable__NUL_2_NUL_r_n___r_n_r_n_GOTO_:EOF_r_n_:MAC_r_n_::Generates_semi_random_value_of_a_length_according_to_the__if__COUNT____line__minus_one__and_from_the_characters_in_the_GEN_variable_r_n_SET_COUNT0_r_n_SET_GENABCDEF0123456789_r_n_SET_GEN226AE_r_n_SET_MAC_r_n_:MACLOOP_r_n_SET__a_COUNT1_r_n_SET_RND_random__r_n_::__n__where_the_value_of_n_is_the_number_of_characters_in_the_GEN_variable_minus_one.__So_if_you_have_15_characters_in_GEN__set_the_number_as_14_r_n_SET__A_RNDRND__16_r_n_SET_RNDGEN_GEN:_RND__1__r_n_SET__A_RND2RND__4_r_n_SET_RNDGEN2_GEN2:_RND2__1__r_n_IF___COUNT____EQU__2___SET_MAC_MAC__RNDGEN2___ELSE__SET_MAC_MAC__RNDGEN___r_n_IF__COUNT___LEQ_11_GOTO_MACLOOP
lea rcx, [rbp + 0x1f]
call fcn.14000d850
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x14000dcb8
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dcb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dcb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400722d0
lea rcx, str.C:WindowsSystem32clean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000d9a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400722b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret