Function at 0x401cc0
Capabilities:
Execute command
Get common file path
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404207
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0x23
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.00402910
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x11c]
mov eax, edx
mov ecx, dword [ebp - 0x120]
sub eax, ecx
push 0xd
push str._ac_files_adb
cmp eax, 0xd
jb 0x401d62
cmp edx, 0xf
lea esi, [ebp - 0x130]
lea eax, [ecx + 0xd]
cmova esi, dword [ebp - 0x130]
add esi, ecx
mov dword [ebp - 0x120], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xd], 0
jmp 0x401d7c
mov byte [ebp - 0x118], 0
lea ecx, [ebp - 0x130]
push dword [ebp - 0x118]
push 0xd
call fcn.00402f40
cmp dword [ebp - 0x11c], 0xf
lea eax, [ebp - 0x130]
cmova eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp - 0x11c]
mov eax, edx
mov ecx, dword [ebp - 0x120]
sub eax, ecx
cmp eax, 1
jb 0x401dcd
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x130]
cmova eax, dword [ebp - 0x130]
mov word [eax + ecx], 0x5c
jmp 0x401dee
push 1
push 0x40523c
mov byte [ebp - 0x118], 0
lea ecx, [ebp - 0x130]
push dword [ebp - 0x118]
push 1
call fcn.00402f40
mov ecx, dword [ebp - 0x120]
mov esi, 0x7fffffff
mov eax, esi
sub eax, ecx
cmp eax, 0x16
jb 0x4023e0
cmp dword [ebp - 0x11c], 0xf
lea eax, [ebp - 0x130]
push 0x16
cmova eax, dword [ebp - 0x130]
push str.reset_guest_global.bat
push ecx
push eax
push ecx
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1a8]
call fcn.00403110
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp - 0x120]
sub eax, ecx
cmp eax, 0x16
jb 0x4023e5
cmp dword [ebp - 0x11c], 0xf
lea eax, [ebp - 0x130]
push 0x16
cmova eax, dword [ebp - 0x130]
push str.reset_guest_taiwan.bat
push ecx
push eax
push ecx
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x190]
call fcn.00403110
mov byte [ebp - 4], 2
mov eax, esi
mov ecx, dword [ebp - 0x120]
sub eax, ecx
cmp eax, 0x13
jb 0x4023ea
cmp dword [ebp - 0x11c], 0xf
lea eax, [ebp - 0x130]
push 0x13
cmova eax, dword [ebp - 0x130]
push str.reset_guest_vng.bat
push ecx
push eax
push ecx
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x178]
call fcn.00403110
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x120]
sub esi, ecx
cmp esi, 0x15
jb 0x4023ef
cmp dword [ebp - 0x11c], 0xf
lea eax, [ebp - 0x130]
push 0x15
cmova eax, dword [ebp - 0x130]
push str.reset_guest_korea.bat
push ecx
push eax
push ecx
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x160]
call fcn.00403110
push 0x405210
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 4
call fcn.00402910
mov byte [ebp - 4], 5
mov ecx, edi
mov eax, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
cmp eax, 0xf
jbe 0x401f2c
mov ecx, dword [edi]
cmp edx, 0xe
jne 0x401fc9
mov ebx, edx
mov esi, str.com.tencent.ig
sub ebx, 4
jb 0x401f52
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x401f57
add ecx, 4
add esi, 4
sub ebx, 4
jae 0x401f41
cmp ebx, 0xfffffffc
je 0x401f8b
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x401f84
cmp ebx, 0xfffffffd
je 0x401f8b
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x401f84
cmp ebx, 0xfffffffe
je 0x401f8b
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x401f84
cmp ebx, 0xffffffff
je 0x401f8b
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
je 0x401f8b
sbb eax, eax
or eax, 1
jmp 0x401f8d
xor eax, eax
test eax, eax
jne 0x401fc6
cmp dword [ebp - 0x194], 0xf
lea eax, [ebp - 0x1a8]
push dword [ebp - 0x198]
cmova eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x148]
push eax
call fcn.00402a20
mov ebx, str.echo_off_r_nSetLocal_EnableExtensions_EnableDelayedExpansion_r_nadb_kill_server_r_nadb_start_server_r_ngoto_RoutineX_r_n:resume1_r_nadb_push__TEMP_device_id.xml__data_data_com.tencent.ig_shared_prefs_r_nadb_push__TEMP_device_id.xml__data_data_com.tencent.ig_1_shared_prefs_r_n::Handle_AndroidID_here__Change_r_necho__Your_Old_Device_ID_:__r_nadb_shell_settings_get_secure_android_id_r_nset__IDD__r_nfor__L___i_in__1_1_16__do_call_:Pseudo_r_nadb_shell_settings_put_secure_android_id__IDD__r_nadb_shell_content_insert___uri_content:__settings_secure___bind_name:s:android_id___bind_value:s:_IDD__r_n_r_nadb_shell_setprop_ro.mac_address__IDD__r_nadb_shell_setprop_ro.product.device__IDD__r_nadb_shell_setprop_ro.product.brand__IDD__r_nadb_shell_setprop_ro.product.model__IDD__r_nadb_shell_setprop_ro.product.name__IDD__r_nadb_shell_setprop_ro.product.manufacturer__IDD__r_nadb_shell_setprop_ro.android_id__IDD__r_nadb_shell_setprop_net.hostname__IDD__r_nadb_shell_setprop_gaid__IDD__r_nadb_shell_setprop_android.device.id__IDD__r_nadb_shell_setprop_ro.serialno__IDD__r_nadb_shell_setprop_ro.runtime.firstboot__IDD__r_n_r_necho__Your_New_Device_ID_:__r_necho__IDD__r_ngoto_EmptyRecords_r_n:resume2_r_necho_Done_r_ntimeout__t_3_r_ngoto_:eof_r_n:EmptyRecords_r_necho_Cleaning_ID_related_files_please_wait_2_minutes_r_nadb_kill_server___nul_2_1_r_nadb_start_server___nul_2_1_r_nadb_remount___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_files_itop_login.txt___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_shared_prefs_itop.xml___nul_2_1_r_nadb_shell_rm__rf__storage_emulated_0_com.activision.callofduty.shooter___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_rawdata___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.tencent.ig_1_
mov edi, 0x3b6f
jmp 0x4021b8
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp eax, 0xf
jbe 0x401fd2
mov ecx, dword [edi]
cmp edx, 0xf
jne 0x40206f
mov ebx, edx
mov esi, str.com.rekoo.pubgm
sub ebx, 4
jb 0x401ff8
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x401ffd
add ecx, 4
add esi, 4
sub ebx, 4
jae 0x401fe7
cmp ebx, 0xfffffffc
je 0x402031
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x40202a
cmp ebx, 0xfffffffd
je 0x402031
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x40202a
cmp ebx, 0xfffffffe
je 0x402031
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x40202a
cmp ebx, 0xffffffff
je 0x402031
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
je 0x402031
sbb eax, eax
or eax, 1
jmp 0x402033
xor eax, eax
test eax, eax
jne 0x40206c
cmp dword [ebp - 0x17c], 0xf
lea eax, [ebp - 0x190]
push dword [ebp - 0x180]
cmova eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x148]
push eax
call fcn.00402a20
mov ebx, str.echo_off_r_nSetLocal_EnableExtensions_EnableDelayedExpansion_r_nadb_kill_server_r_nadb_start_server_r_ngoto_RoutineX_r_n:resume1_r_nadb_push__TEMP_device_id.xml__data_data_com.rekoo.pubgm_shared_prefs_r_nadb_push__TEMP_device_id.xml__data_data_com.rekoo.pubgm_1_shared_prefs_r_n::Handle_AndroidID_here__Change_r_necho__Your_Old_Device_ID_:__r_nadb_shell_settings_get_secure_android_id_r_nset__IDD__r_nfor__L___i_in__1_1_16__do_call_:Pseudo_r_nadb_shell_settings_put_secure_android_id__IDD__r_nadb_shell_content_insert___uri_content:__settings_secure___bind_name:s:android_id___bind_value:s:_IDD__r_n_r_nadb_shell_setprop_ro.mac_address__IDD__r_nadb_shell_setprop_ro.product.device__IDD__r_nadb_shell_setprop_ro.product.brand__IDD__r_nadb_shell_setprop_ro.product.model__IDD__r_nadb_shell_setprop_ro.product.name__IDD__r_nadb_shell_setprop_ro.product.manufacturer__IDD__r_nadb_shell_setprop_ro.android_id__IDD__r_nadb_shell_setprop_net.hostname__IDD__r_nadb_shell_setprop_gaid__IDD__r_nadb_shell_setprop_android.device.id__IDD__r_nadb_shell_setprop_ro.serialno__IDD__r_nadb_shell_setprop_ro.runtime.firstboot__IDD__r_n_r_necho__Your_New_Device_ID_:__r_necho__IDD__r_ngoto_EmptyRecords_r_n:resume2_r_necho_Done_r_ntimeout__t_3_r_ngoto_:eof_r_n:EmptyRecords_r_necho_Cleaning_ID_related_files_please_wait_2_minutes_r_nadb_kill_server___nul_2_1_r_nadb_start_server___nul_2_1_r_nadb_remount___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_files_itop_login.txt___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_shared_prefs_itop.xml___nul_2_1_r_nadb_shell_rm__rf__storage_emulated_0_com.activision.callofduty.shooter___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.rekoo.pubgm_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_rawdata___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_dat
mov edi, 0x3bdc
jmp 0x4021b8
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp eax, 0xf
jbe 0x402078
mov ecx, dword [edi]
cmp edx, 0x12
jne 0x402118
mov ebx, edx
mov esi, str.com.vng.pubgmobile
sub ebx, 4
jb 0x4020a1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4020a6
add ecx, 4
add esi, 4
sub ebx, 4
jae 0x402090
cmp ebx, 0xfffffffc
je 0x4020da
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x4020d3
cmp ebx, 0xfffffffd
je 0x4020da
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x4020d3
cmp ebx, 0xfffffffe
je 0x4020da
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4020d3
cmp ebx, 0xffffffff
je 0x4020da
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
je 0x4020da
sbb eax, eax
or eax, 1
jmp 0x4020dc
xor eax, eax
test eax, eax
jne 0x402115
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
push dword [ebp - 0x168]
cmova eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x148]
push eax
call fcn.00402a20
mov ebx, str.echo_off_r_nSetLocal_EnableExtensions_EnableDelayedExpansion_r_nadb_kill_server_r_nadb_start_server_r_ngoto_RoutineX_r_n:resume1_r_nadb_push__TEMP_device_id.xml__data_data_com.vng.pubgmobile_shared_prefs_r_nadb_push__TEMP_device_id.xml__data_data_com.vng.pubgmobile_1_shared_prefs_r_n::Handle_AndroidID_here__Change_r_necho__Your_Old_Device_ID_:__r_nadb_shell_settings_get_secure_android_id_r_nset__IDD__r_nfor__L___i_in__1_1_16__do_call_:Pseudo_r_nadb_shell_settings_put_secure_android_id__IDD__r_nadb_shell_content_insert___uri_content:__settings_secure___bind_name:s:android_id___bind_value:s:_IDD__r_n_r_nadb_shell_setprop_ro.mac_address__IDD__r_nadb_shell_setprop_ro.product.device__IDD__r_nadb_shell_setprop_ro.product.brand__IDD__r_nadb_shell_setprop_ro.product.model__IDD__r_nadb_shell_setprop_ro.product.name__IDD__r_nadb_shell_setprop_ro.product.manufacturer__IDD__r_nadb_shell_setprop_ro.android_id__IDD__r_nadb_shell_setprop_net.hostname__IDD__r_nadb_shell_setprop_gaid__IDD__r_nadb_shell_setprop_android.device.id__IDD__r_nadb_shell_setprop_ro.serialno__IDD__r_nadb_shell_setprop_ro.runtime.firstboot__IDD__r_n_r_necho__Your_New_Device_ID_:__r_necho__IDD__r_ngoto_EmptyRecords_r_n:resume2_r_necho_Done_r_ntimeout__t_3_r_ngoto_:eof_r_n:EmptyRecords_r_necho_Cleaning_ID_related_files_please_wait_2_minutes_r_nadb_kill_server___nul_2_1_r_nadb_start_server___nul_2_1_r_nadb_remount___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_files_itop_login.txt___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_shared_prefs_itop.xml___nul_2_1_r_nadb_shell_rm__rf__storage_emulated_0_com.activision.callofduty.shooter___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.vng.pubgmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_r
mov edi, 0x3d23
jmp 0x4021b8
mov eax, dword [edi + 0x14]
cmp eax, 0xf
jbe 0x40211f
mov edi, dword [edi]
cmp edx, 0x11
jne 0x4021b4
mov ecx, str.com.pubg.krmobile
sub edx, 4
jb 0x402143
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x402148
add edi, 4
add ecx, 4
sub edx, 4
jae 0x402132
cmp edx, 0xfffffffc
je 0x40217c
mov al, byte [edi]
cmp al, byte [ecx]
jne 0x402175
cmp edx, 0xfffffffd
je 0x40217c
mov al, byte [edi + 1]
cmp al, byte [ecx + 1]
jne 0x402175
cmp edx, 0xfffffffe
je 0x40217c
mov al, byte [edi + 2]
cmp al, byte [ecx + 2]
jne 0x402175
cmp edx, 0xffffffff
je 0x40217c
mov al, byte [edi + 3]
cmp al, byte [ecx + 3]
je 0x40217c
sbb eax, eax
or eax, 1
jmp 0x40217e
xor eax, eax
test eax, eax
jne 0x4021b4
cmp dword [ebp - 0x14c], 0xf
lea eax, [ebp - 0x160]
push dword [ebp - 0x150]
cmova eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x148]
push eax
call fcn.00402a20
mov ebx, str.echo_off_r_nSetLocal_EnableExtensions_EnableDelayedExpansion_r_nadb_kill_server_r_nadb_start_server_r_ngoto_RoutineX_r_n:resume1_r_nadb_push__TEMP_device_id.xml__data_data_com.pubg.krmobile_shared_prefs_r_nadb_push__TEMP_device_id.xml__data_data_com.pubg.krmobile_1_shared_prefs_r_n::Handle_AndroidID_here__Change_r_necho__Your_Old_Device_ID_:__r_nadb_shell_settings_get_secure_android_id_r_nset__IDD__r_nfor__L___i_in__1_1_16__do_call_:Pseudo_r_nadb_shell_settings_put_secure_android_id__IDD__r_nadb_shell_content_insert___uri_content:__settings_secure___bind_name:s:android_id___bind_value:s:_IDD__r_n_r_nadb_shell_setprop_ro.mac_address__IDD__r_nadb_shell_setprop_ro.product.device__IDD__r_nadb_shell_setprop_ro.product.brand__IDD__r_nadb_shell_setprop_ro.product.model__IDD__r_nadb_shell_setprop_ro.product.name__IDD__r_nadb_shell_setprop_ro.product.manufacturer__IDD__r_nadb_shell_setprop_ro.android_id__IDD__r_nadb_shell_setprop_net.hostname__IDD__r_nadb_shell_setprop_gaid__IDD__r_nadb_shell_setprop_android.device.id__IDD__r_nadb_shell_setprop_ro.serialno__IDD__r_nadb_shell_setprop_ro.runtime.firstboot__IDD__r_n_r_necho__Your_New_Device_ID_:__r_necho__IDD__r_ngoto_EmptyRecords_r_n:resume2_r_necho_Done_r_ntimeout__t_3_r_ngoto_:eof_r_n:EmptyRecords_r_necho_Cleaning_ID_related_files_please_wait_2_minutes_r_nadb_kill_server___nul_2_1_r_nadb_start_server___nul_2_1_r_nadb_remount___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_files_itop_login.txt___nul_2_1_r_nadb_shell_rm__rf__data_data_com.activision.callofduty.shooter_shared_prefs_itop.xml___nul_2_1_r_nadb_shell_rm__rf__storage_emulated_0_com.activision.callofduty.shooter___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_Logs___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_UpdateInfo___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_TableDatas___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_conversation.ini___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_GameErrorNoRecords___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_StatEventReportedFlag___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_ImageDownload___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_1_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_MMKV___nul_2_1_r_nadb_shell_rm__rf__sdcard_Android_data_com.pubg.krmobile_files_UE4Game_ShadowTrackerExtra_ShadowTrackerExtra_Saved_rawdata___nul_2_1_r
mov edi, 0x3cb6
jmp 0x4021b8
xor ebx, ebx
xor edi, edi
cmp dword [ebp - 0x134], 0xf
lea eax, [ebp - 0x148]
cmova eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
add esp, 4
lea eax, [ebp - 0x148]
cmp dword [ebp - 0x134], 0xf
cmova eax, dword [ebp - 0x148]
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402212
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402235
push 0
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x134], 0xf
lea eax, [ebp - 0x148]
cmova eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x134]
add esp, 4
cmp ecx, 0xf
jbe 0x40228d
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402283
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b4
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
cmp ecx, 0xf
jbe 0x4022e2
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4022d8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b4
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x164]
cmp ecx, 0xf
jbe 0x40231c
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402312
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b4
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x17c]
cmp ecx, 0xf
jbe 0x402352
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402348
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b4
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x194]
cmp ecx, 0xf
jbe 0x402388
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40237e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b4
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xf
jbe 0x4023c4
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4023ba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4023ba
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004033e1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004033a3
mov esp, ebp
pop ebp
ret
call fcn.00401160
call fcn.00401160
call fcn.00401160
call fcn.00401160
int3