Function at 0x1400026a0
Capabilities:
Capture network configuration via ipconfig
Execute command
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [0x140006594]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Saturn_Free_Temp___discord.gg_saturniv_n_n__1__Randomize_Serials_n__2__Spoof_MAC_n__3__Fix_MAC_Lag_n__4__Check_Serials_n__5__Deep_Clean_n_n__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004530
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov edx, dword [rsp + 0x50]
sub edx, 1
je 0x140002a62
sub edx, 1
je 0x140002951
sub edx, 1
je 0x1400028fe
sub edx, 1
je 0x1400027fb
cmp edx, 1
jne 0x140002a6c
lea rcx, [0x140006594]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_E
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov ecx, 0x20
call fcn.140004ca0
mov rdx, rax
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [0x140006ad0]
movdqu xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32clean.bat]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140006850]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140006858]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14000685c]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
mov r8d, 0x327f99
lea rdx, str._echo_r_n::_BatchGotAdmin_r_n:______________________________________r_n_r_nREM_____Check_for_permissions_r_nIF___PROCESSOR_ARCHITECTURE___EQU__amd64____r_n_nul_2_1___SYSTEMROOT_SysWOW64cacls.exe____SYSTEMROOT_SysWOW64config_system__r_n__ELSE___r_n_nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__r_n__r_n_r_ntitle_Saturn_Deep_Cleaner___Made_By_Payson___discord.gg_saturniv_r_ncolor_E_r_nREM_____If_error_flag_set__we_do_not_have_admin._r_nif__errorlevel__NEQ_0___r_necho_Requesting_Admin..._r_ngoto_UACPrompt_r_n__else___goto_gotAdmin___r_n_r_n:UACPrompt_r_necho_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__r_nset_params___r_necho_UAC.ShellExecute__cmd.exe_____c____s0____params:____________runas___1______temp_getadmin.vbs__r_n_r_n__temp_getadmin.vbs__r_ndel___temp_getadmin.vbs__r_nexit__B_r_n_r_n:gotAdmin_r_npushd___CD___r_nCD__D___dp0__r_n_r_ntaskkill__f__im_epicgameslauncher.exe___nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping_EAC.exe___nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping_BE.exe___nul_r_ntaskkill__f__im_FortniteLauncher.exe___nul_r_ntaskkill__f__im_OneDrive.exe___nul_r_ntaskkill__f__im_FortniteClient_Win64_Shipping.exe___nul_r_ntaskkill__f__im_EpicGamesLauncher.exe___nul_r_ntaskkill__f__im_UnrealCEFSubProcess.exe___nul_r_ntaskkill__f__im_CEFProcess.exe___nul_r_ntaskkill__f__im_EasyAntiCheat.exe___nul_r_ntaskkill__f__im_BEService.exe___nul_r_ntaskkill__f__im_BEServices.exe___nul_r_ntaskkill__f__im_BattleEye.exe___nul_r_n_r_nSc_stop_EasyAntiCheat_r_nSc_stop_FortniteClient_Win64_Shipping_EAC_r_nSc_stop_BattleEye_r_nSc_stop_FortniteClient_Win64_Shipping_BE_r_n_r_n_echo_off_r_nsc_config_winmgmt_start_disabled_r_nnet_stop_winmgmt__y_r_n_systemdrive__r_ncd__windir__system32wbem_r_nfor__f___s_in__dir__b_.dll__do_regsvr32__s___s_r_nwmiprvse__regserver_r_nwinmgmt__regserver_r_nsc_config_winmgmt_start_auto_r_nnet_start_winmgmt_r_nfor__f___s_in__dir__s__b_.mof_.mfl__do_mofcomp___s_r_nreg_delete__HKEY_CURRENT_USERSoftwareMicrosoftDirect3D___v_WHQLClass__f_r_nreg_delete__HKLMSYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2532382528_581214834_2534474248_1001DeviceHarddiskVolume3Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64FortniteClient_Win64_Shipping_EAC.exe:__B1_8A_B0_E9_8D_13_D5_01_00_00_00_00_00_00_00_00_00_00_00_00_02_00_00_00___f__r_nreg_delete__HKLMSYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2532382528_581214834_2534474248_1001DeviceHarddiskVolume3Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64EasyAntiCheatEasyAntiCheat_Setup.exe:__73_D5_4B_11_8D_13_D5_01_00_00_00_00_00_00_00_00_00_00_00_00_02_00_00_00___f__r_nreg_delete__HKLMSYSTEMCurrentControlSetServices_bamStateUserSettingsS_1_5_21_2532382528_581214834_2534474248_1001DeviceHarddiskVolume3Program_FilesEpic_GamesFortniteFortniteGameBinariesWin64FortniteClient_Win64_Shipping.exe:__E7_CB_84_E9_8D_13_D5_01_00_00_00_00_00_00_00_00_00_00_00_00_02_00_00_00___f__r_nreg_delete__HKU.Dreg_delete__HKEY_CURRENT_USERSoftwareEpic_Games___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareEpic_GamesUnreal_Engine___f_r_nreg_delete__HKEY_CURRENT_USERSoftwareWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREClassescom.epicgames.launcher___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREEpicGames___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpic_Games___f_r_nreg_delete__HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeEpicGames___f_r_nreg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheatDescription:__Provides_integrated_security_and_services_for_online_multiplayer_games.____f_r_nreg_delete__HKLMSYSTEMControlSet001ServicesEasyAntiCheatSecuritySecurity:__01_00_14_80_A0_00_00_00_AC_00_00_00_14_00_00_00_30_00_00_00_02_00_1C_00_01_00_00_00_02_80_14_00_FF_01_0F_00_01_01_00_00_00_00_00_01_00_00_00_00_02_00
lea rcx, [rsp + 0x28]
call fcn.140002330
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400027e9
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004f1c
lea rcx, str.C:WindowsSystem32clean.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002a67
lea rcx, [0x140006594]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rsp + 0x20], 0x230064
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor eax, eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], 0x220063
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
lea rcx, str.wmic_diskdrive_get_model__serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_CPU
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_cpu_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_BIOS
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_bios_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_Motherboard
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ECHO_smBIOS_UUID
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.wmic_path_win32_computersystemproduct_get_uuid
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.getmac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140006800]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004530
lea rcx, str.echo_Going_back_to_dashboard_in_8_seconds...
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002a67
lea rcx, [0x140006594]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__registerdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__release
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__renew
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002a67
lea rcx, [0x140006594]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Your_internet_will_turn_off_for_5_15_seconds...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004530
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140006594]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Spoofing..._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004530
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov ecx, 0x30
call fcn.140004ca0
mov rdx, rax
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [0x140006ae0]
movdqu xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [str.C:WindowsSystem32cleantheass.bat]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140006668]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140006678]
mov word [rax + 0x20], cx
movzx eax, byte [0x14000667a]
mov byte [rdx + 0x22], al
mov byte [rdx + 0x23], 0
mov r8d, 0x813
lea rdx, str._ECHO_OFF_r_n_SETLOCAL_ENABLEDELAYEDEXPANSION_r_n_SETLOCAL_ENABLEEXTENSIONS_r_n_r_n_::Generate_and_implement_a_random_MAC_address_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_CALL_:MAC_r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_NetworkAddress__t_REG_SZ__d__MAC____f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Disable_power_saving_mode_for_network_adapters_r_n_FOR__F__tokens1____a_IN__wmic_nic_where_physicaladaptertrue_get_deviceid__findstr__0_9___DO___r_n_FOR___b_IN__0_00_000__DO___r_n_REG_QUERY_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__NUL_2_NUL__REG_ADD_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318__b__a__v_PnPCapabilities__t_REG_DWORD__d_24__f__NUL_2_NUL_r_n___r_n___r_n_r_n_::Reset_NIC_adapters_so_the_new_MAC_address_is_implemented_and_the_power_saving_mode_is_disabled._r_n_FOR__F__tokens2_delims__skip2____a_IN___wmic_nic_where__netconnectionid_like_____get_netconnectionid_netconnectionstatus__format:csv___DO___r_n_netsh_interface_set_interface_name___a__disable__NUL_2_NUL_r_n_netsh_interface_set_interface_name___a__enable__NUL_2_NUL_r_n___r_n_r_n_GOTO_:EOF_r_n_:MAC_r_n_::Generates_semi_random_value_of_a_length_according_to_the__if__COUNT____line__minus_one__and_from_the_characters_in_the_GEN_variable_r_n_SET_COUNT0_r_n_SET_GENABCDEF0123456789_r_n_SET_GEN226AE_r_n_SET_MAC_r_n_:MACLOOP_r_n_SET__a_COUNT1_r_n_SET_RND_random__r_n_::__n__where_the_value_of_n_is_the_number_of_characters_in_the_GEN_variable_minus_one.__So_if_you_have_15_characters_in_GEN__set_the_number_as_14_r_n_SET__A_RNDRND__16_r_n_SET_RNDGEN_GEN:_RND__1__r_n_SET__A_RND2RND__4_r_n_SET_RNDGEN2_GEN2:_RND2__1__r_n_IF___COUNT____EQU__2___SET_MAC_MAC__RNDGEN2___ELSE__SET_MAC_MAC__RNDGEN___r_n_IF__COUNT___LEQ_11_GOTO_MACLOOP
lea rcx, [rsp + 0x28]
call fcn.140002330
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140002a53
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004f1c
lea rcx, str.C:WindowsSystem32cleantheass.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002a67
call fcn.1400024f0
call fcn.1400026a0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004c80
add rsp, 0x60
pop rbx
ret