Function at 0x14009d117
Capabilities:
Capture network configuration via ipconfig
Delete volume shadow copies
Execute command

Disassembly:
jmp 0x1401cf200
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x20]
lea rcx, [0x14024c220]
call fcn.14009d9a5
nop
lea rcx, str.taskkill__f__im_EpicGamesLauncher.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.taskkill__f__im_FortniteClient_Win64_Shipping.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.taskkill__f__im_OneDrive.exe__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.color_b
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.14009c0c8
nop
call fcn.14009d568
nop
lea rdx, str._n_n______Welcome_to_outfall_fortnite_cleaner
lea rcx, [rbp + 0xc8]
call fcn.14009d2d9
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009cfbe
lea rdx, [0x140237874]
mov rcx, rax
call fcn.14009c2a3
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str.start_https:__discord.gg_U5aSurvDZC
call qword [sym.imp.ucrtbased.dll_system]
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str._n_n______Connecting...
lea rcx, [rbp + 0x118]
call fcn.14009ca96
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009c307
lea rdx, [0x140237874]
mov rcx, rax
call fcn.14009c2a3
nop
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str._n_n______Status:_Undetected
lea rcx, [rbp + 0x148]
call fcn.14009c9c9
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009c226
lea rdx, [0x140237874]
mov rcx, rax
call fcn.14009c2a3
nop
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str._n_n______Version:_1.0
lea rcx, [rbp + 0x188]
call fcn.14009d699
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009d6f8
lea rdx, [0x140237874]
mov rcx, rax
call fcn.14009c2a3
nop
call fcn.14009c0c8
nop
mov r9d, 3
lea r8, str.Mac_Address
lea rdx, str.Do_you_want_to_spoof_Mac_.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, str.powershell.exe__Reset_PhysicalDisk___nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.14009c0c8
nop
mov r9d, 3
lea r8, str.Network_Adapter
lea rdx, str.Do_you_want_to_reset_adapters.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str.NETSH_WINSOCK_RESET
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.NETSH_INT_IP_RESET
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.NETSH_INTERFACE_IPV4_RESET
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.NETSH_INTERFACE_IPV6_RESET
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.NETSH_INTERFACE_TCP_RESET
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.IPCONFIG__RELEASE
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.IPCONFIG__FLUSHDNS
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.IPCONFIG__RENEW
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.net_stop_winmgmt__y__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.vssadmin_delete_shadows__All__Quiet__nul_2_1
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.14009c0c8
nop
call fcn.14009d7b1
nop
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
call fcn.14009c0c8
nop
lea rcx, str.Successfully_cleaned._Thank_you_for_using_outfall_cleaner__n
call fcn.14009cfa5
nop
lea rcx, str.Press_any_key_to_exit..._n
call fcn.14009cfa5
nop
call fcn.14009daef
nop
xor eax, eax
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret