Function at 0x401590
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x258
lea eax, [esp + 0x114]
mov dword [0x4ce078], 0x8000
mov dword [0x4ce080], 0x1000000
mov dword [0x4ce088], 0xf00000
mov dword [0x4ce08c], 0x100
mov dword [esp + 0x50], 0x4b8fbc
mov dword [esp + 0x6c], 0x4b8fbc
mov dword [0x4ce090], 0x800
push 0x140
push 0x4ba228
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push str.ANDROID_SERIAL
call sub.msvcrt.dll_getenv
add esp, 4
mov dword [0x4ce6dc], eax
lea edi, [esp + 0xd4]
lea esi, [esp + 0x20]
xor eax, eax
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0xd0], 0
jmp case.0x401680.119
mov eax, dword [0x4d01e0]
mov dword [0x4ce6dc], eax
movzx eax, byte [esp + 0x60]
nop dword [eax]
mov byte [esp + 0x60], al
push edi
lea eax, [esp + 0x118]
push eax
push str.a::hls:S:vw
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push ebx
call fcn.004419c0
add esp, 0x14
lea ecx, [eax - 0x3f]
cmp ecx, 0x38
ja case.default.0x401680
mov ebx, 1
mov al, 1
jmp dword [ecx*4 + section..rdata]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4ce6e8
push dword [0x4d01e0]
call fcn.004093c0
add esp, 0x14
test al, al
movzx eax, byte [esp + 0x60]
jne case.0x401680.119
jmp 0x4050ad
cmp eax, 0xffffffff
je 0x401aae
test eax, eax
jne case.0x401680.64
mov eax, dword [esp + 0xd4]
lea ebx, [esp + 0x30]
lea edx, [esp + 0xa8]
mov ecx, ebx
shl eax, 4
push edx
push dword [esp + eax + 0x118]
call fcn.00480b10
mov ecx, ebx
push str.base
call fcn.00457890
test eax, eax
je 0x4018e5
mov ecx, ebx
push str.cmdline
call fcn.00457890
test eax, eax
je 0x401901
mov ecx, ebx
push str.disable_verification
call fcn.00457890
test eax, eax
je 0x401921
mov ecx, ebx
push str.disable_verity
call fcn.00457890
test eax, eax
je 0x40192d
mov ecx, ebx
push str.header_version
call fcn.00457890
test eax, eax
je 0x401939
mov ecx, ebx
push str.kernel_offset
call fcn.00457890
test eax, eax
je 0x401952
mov ecx, ebx
push str.os_patch_level
call fcn.00457890
test eax, eax
je 0x40196b
mov ecx, ebx
push str.os_version
call fcn.00457890
test eax, eax
je 0x40197d
mov ecx, ebx
push str.page_size
call fcn.00457890
test eax, eax
je 0x40198f
mov ecx, ebx
push str.ramdisk_offset
call fcn.00457890
test eax, eax
je 0x4019b1
mov ecx, ebx
push str.skip_reboot
call fcn.00457890
test eax, eax
je 0x4019ef
mov ecx, ebx
push str.skip_secondary
call fcn.00457890
test eax, eax
je 0x4019fc
mov ecx, ebx
push str.slot
call fcn.00457890
test eax, eax
je 0x401a09
mov ecx, ebx
push str.tags_offset
call fcn.00457890
test eax, eax
je 0x401a21
mov ecx, ebx
push str.unbuffered
call fcn.00457890
test eax, eax
je 0x401a3a
mov ecx, ebx
push str.version
call fcn.00457890
test eax, eax
jne 0x4050bd
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push str.28.0.1_4986621
push str.fastboot_version__s_n
push eax
call fcn.00409350
add esp, 0xc
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0xa8]
add ebx, 0x20
push eax
call fcn.0042cb10
add esp, 4
push dword [esp + 0xa8]
push str.Installed_as__s_n
push ebx
call fcn.00409350
add esp, 0xc
mov eax, dword [esp + 0xa8]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x401a91
xor ebx, ebx
jmp 0x4019ca
mov ebx, dword [0x4d01e0]
mov al, 1
mov dword [esp + 0x88], eax
movzx eax, byte [esp + 0x60]
test ebx, ebx
je case.0x401680.119
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
lea ecx, [esp + 0x6c]
push eax
push ebx
call fcn.0047fc60
movzx eax, byte [esp + 0x60]
jmp case.0x401680.119
call fcn.0040bbe0
movzx eax, byte [esp + 0x60]
jmp case.0x401680.119
movzx eax, byte [esp + 0x60]
mov byte [0x4ce6e2], 1
jmp case.0x401680.119
push 0x10
push 0
push dword [0x4d01e0]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x4b3008], eax
jmp 0x4019c8
mov ebx, dword [0x4d01e0]
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
mov ecx, 0x4ce064
push eax
push ebx
call fcn.0047fc60
jmp 0x4019c8
mov byte [0x4ce6e0], 1
jmp 0x4019c8
mov byte [0x4ce6e1], 1
jmp 0x4019c8
push 0
push 0
push dword [0x4d01e0]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x4ce094], eax
jmp 0x4019c8
push 0x10
push 0
push dword [0x4d01e0]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x4ce078], eax
jmp 0x4019c8
push dword [0x4d01e0]
push 0x4ce06c
call 0x405240
jmp 0x4019c8
push dword [0x4d01e0]
push 0x4ce06c
call 0x4052d0
jmp 0x4019c8
push 0
push 0
push dword [0x4d01e0]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov bl, 1
test eax, eax
mov dword [0x4ce090], eax
jne 0x4019ca
jmp 0x4050d8
push 0x10
push 0
push dword [0x4d01e0]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x4ce080], eax
mov bl, 1
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x401a6d
movzx eax, byte [esp + 0x60]
test bl, bl
jne case.0x401680.119
jmp 0x402017
mov al, 1
mov bl, 1
mov dword [esp + 0xd0], eax
jmp 0x4019ca
mov al, 1
mov bl, 1
mov dword [esp + 0x84], eax
jmp 0x4019ca
mov ebx, dword [0x4d01e0]
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
lea ecx, [esp + 0x50]
jmp 0x401915
push 0x10
push 0
push dword [0x4d01e0]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x4ce08c], eax
jmp 0x4019c8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0
push 4
push 0
push eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0
push 4
push 0
push eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
jmp 0x4019c8
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4019dd
lea eax, [esp + 0xa8]
push eax
call fcn.0047f3e0
jmp 0x4019dd
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401884
push esi
call fcn.0047f3e0
jmp 0x401884
mov edx, dword [0x4b3390]
mov cl, byte [esp + 0x60]
mov eax, ebx
sub eax, edx
or cl, byte [esp + 0x88]
jne 0x401acd
test eax, eax
je 0x4050ec
mov ecx, dword [ebp + 0xc]
test eax, eax
mov dword [esp + 0x64], edx
lea ecx, [ecx + edx*4]
mov dword [esp + 0x68], ecx
jle 0x401b11
mov eax, dword [esp + 0x68]
mov edi, dword [eax]
push str.devices
push edi
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
je 0x401c75
push str.help
push edi
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
je case.0x401680.104
mov edi, dword [0x4ce6f0]
test edi, edi
jne 0x401e1b
mov eax, dword [0x4ce6dc]
mov dword [esp + 0x20], 0x4b8fbc
mov dword [esp + 4], 0
test eax, eax
je 0x401c83
lea edi, [esp + 0x30]
lea ebx, [esp + 0x58]
mov ecx, edi
push ebx
push eax
call fcn.00480b10
push str.tcp:
push edi
call fcn.0042e7b0
add esp, 8
mov edi, dword [esp + 0x30]
lea esi, [esp + 0x20]
lea ecx, [edi - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40208b
xor ecx, ecx
test al, al
jne 0x401bc2
lea edi, [esp + 0x30]
mov ecx, edi
push ebx
push dword [0x4ce6dc]
call fcn.00480b10
push str.udp:
push edi
call fcn.0042e7b0
add esp, 8
mov ebx, eax
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x4020dc
mov ecx, 1
test bl, bl
mov dword [esp + 0x18], 0
je 0x401c8f
mov edi, dword [0x4ce6dc]
lea ebx, [esp + 0xa8]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x98]
mov dword [esp + 4], 0x15b2
mov dword [esp + 0x30], 0x4b8fbc
mov ecx, ebx
add edi, 4
push eax
push edi
call fcn.00480b10
lea eax, [esp + 4]
lea ecx, [esp + 0x30]
push ecx
push 0
push eax
push esi
push ebx
call fcn.0042df40
add esp, 0x14
mov ebx, eax
mov eax, dword [esp + 0xa8]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x4020bb
mov eax, dword [esp + 0x30]
test bl, bl
je 0x405225
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x401c8f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401c8f
lea eax, [esp + 0xa8]
push eax
call fcn.0047f3e0
jmp 0x401c8f
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push str.usage:_fastboot__OPTION...__COMMAND..._n_nflashing:_n_update_ZIP_________________Flash_all_partitions_from_an_update.zip_package._n_flashall___________________Flash_all_partitions_from__ANDROID_PRODUCT_OUT._n____________________________On_A_B_devices__flashed_slot_is_set_as_active._n____________________________Secondary_images_may_be_flashed_to_inactive_slot._n_flash_PARTITION__FILENAME__Flash_given_partition__using_the_image_from_n_____________________________ANDROID_PRODUCT_OUT_if_no_filename_is_given._n_nbasics:_n_devices___l________________List_devices_in_bootloader___l:_with_device_paths_._n_getvar_NAME________________Display_given_bootloader_variable._n_reboot__bootloader_________Reboot_device._n_nlocking_unlocking:_n_flashing_lockunlock_______Lock_unlock_partitions_for_flashing_n_flashing_lock_criticalunlock_critical_n____________________________Lock_unlock_critical_bootloader_partitions._n_flashing_get_unlock_ability_n____________________________Check_whether_unlocking_is_allowed__1__or_not_0_._n_nadvanced:_n_erase_PARTITION____________Erase_a_flash_partition._n_format_:FS_TYPE_:SIZE___PARTITION_n____________________________Format_a_flash_partition._n_set_active_SLOT____________Set_the_active_slot._n_oem__COMMAND...____________Execute_OEM_specific_command._n_nboot_image:_n_boot_KERNEL__RAMDISK__SECOND___n____________________________Download_and_boot_kernel_from_RAM._n_flash:raw_PARTITION_KERNEL__RAMDISK__SECOND___n____________________________Create_boot_image_and_flash_it._n___cmdline_CMDLINE__________Override_kernel_command_line._n___base_ADDRESS_____________Set_kernel_base_address__default:_0x10000000_._n___kernel_offset____________Set_kernel_offset__default:_0x00008000_._n___ramdisk_offset___________Set_ramdisk_offset__default:_0x01000000_._n___tags_offset______________Set_tags_offset__default:_0x00000100_._n___page_size_BYTES__________Set_flash_page_size__default:_2048_._n___header_version_VERSION___Set_boot_image_header_version._n___os_version_MAJOR_.MINOR_.PATCH___n____________________________Set_boot_image_OS_version__default:_0.0.0_._n___os_patch_level_YYYY_MM_DD_n____________________________Set_boot_image_OS_security_patch_level._n_nAndroid_Things:_n_stage_IN_FILE______________Sends_given_file_to_stage_for_the_next_command._n_get_staged_OUT_FILE________Writes_data_staged_by_the_last_command_to_a_file._n_noptions:_n__w_________________________Wipe_userdata._n__s_SERIAL__________________Specify_a_USB_device._n__s_tcpudp:HOST_:PORT______Specify_a_network_device._n__S_SIZE_KMG______________Break_into_sparse_files_no_larger_than_SIZE._n___slot_SLOT________________Use_SLOT__all_for_both_slots__other_for_n____________________________non_current_slot__default:_current_active_slot_._n___set_active_SLOT_________Sets_the_active_slot_before_rebooting._n___skip_secondary___________Dont_flash_secondary_slots_in_flashall_update._n___skip_reboot______________Dont_reboot_device_after_flashing._n___disable_verity___________Sets_disable_verity_when_flashing_vbmeta._n___disable_verification_____Sets_disable_verification_when_flashing_vbmeta._n___unbuffered_______________Dont_buffer_input_or_output._n___verbose___v______________Verbose_output._n___version__________________Display_version._n___help___h_________________Show_this_message._n
push eax
call fcn.00409350
add esp, 8
xor ebx, ebx
jmp case.0x401680.63
push 0
push 0x406cb0
call fcn.004131c0
jmp 0x401c6b
mov dword [esp + 0x18], 0
lea esi, [esp + 0x20]
mov bl, 1
jmp 0x401ceb
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0xf4240
sub esp, 0x10
movsd xmm0, qword [esp + 0xb8]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [esp + 0x40]
movsd qword [esp], xmm0
call fcn.00484480
add esp, 0x10
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], 0
je 0x401d20
cmp dword [esp + 0x18], 0
mov dword [esp + 0x30], 0x4b8fbc
je 0x401d40
je 0x401d70
lea eax, [esp + 0x30]
push eax
push dword [esp + 8]
push esi
lea eax, [esp + 0xb4]
push eax
call fcn.0040b790
jmp 0x401d57
push 0
push 0x406df0
call fcn.004131c0
add esp, 8
mov edi, eax
mov dword [0x4ce6f0], eax
test edi, edi
je 0x401db3
jmp 0x401e08
lea eax, [esp + 0x30]
push eax
push dword [esp + 8]
push esi
lea eax, [esp + 0xb4]
push eax
call fcn.0040ab00
add esp, 0x10
mov eax, dword [esp + 0xa8]
mov dword [0x4ce6f0], eax
jmp 0x401d75
mov eax, dword [0x4ce6f0]
mov ecx, ebx
test cl, 1
je 0x401d9a
test eax, eax
jne 0x401d9a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push dword [esp + 0x30]
push str.error:__s_n
push eax
call fcn.00409350
add esp, 0xc
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x401deb
mov edi, dword [0x4ce6f0]
test edi, edi
jne 0x401e08
mov eax, ebx
test al, 1
je 0x401ca0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, dword [0x4ce6dc]
mov edx, str.any_device
add eax, 0x40
test ecx, ecx
cmove ecx, edx
push ecx
push str.__waiting_for__s___n
push eax
call fcn.00409350
add esp, 0xc
xor ebx, ebx
jmp 0x401ca0
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401da9
lea eax, [esp + 0xa8]
push eax
call fcn.0047f3e0
jmp 0x401da9
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40206a
push 1
call fcn.004af380
add esp, 4
mov dword [esp + 0xd8], eax
lea ebx, [esp + 0xa8]
lea eax, [esp + 0xd8]
mov dword [esp + 0xe4], 0x409530
mov dword [esp + 0xe0], 0x409540
mov ecx, ebx
push 0
mov esi, eax
push eax
push edi
call fcn.0040bc70
mov eax, dword [esp + 0xe0]
test eax, eax
je 0x401e71
push 3
push esi
push esi
call eax
add esp, 0xc
push ebx
call fcn.00413680
add esp, 4
call fcn.0040bb40
fstp qword [esp + 0x108]
lea ecx, [esp + 0x50]
movsd xmm0, qword [esp + 0x108]
movsd qword [esp + 0xe8], xmm0
push 0x4ba407
call fcn.00457890
mov ebx, dword [esp + 0x68]
test eax, eax
lea esi, [esp + 0x20]
je 0x401ee7
lea esi, [esp + 0x30]
lea edi, [esp + 0x50]
mov ecx, esi
mov edx, edi
push 1
call 0x405640
add esp, 4
mov ecx, edi
push esi
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40201e
lea esi, [esp + 0x20]
lea ecx, [esp + 0x6c]
push 0x4ba407
call fcn.00457890
test eax, eax
je 0x401f2e
lea eax, [esp + 0x30]
lea edi, [esp + 0x6c]
mov ecx, eax
mov edx, edi
push 0
call 0x405640
add esp, 4
mov ecx, edi
lea eax, [esp + 0x30]
push eax
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40203f
cmp byte [esp + 0x88], 0
je 0x40214e
lea ecx, [esp + 0x6c]
push 0x4ba407
call fcn.00457890
test eax, eax
jne 0x40214e
lea ecx, [esp + 0x50]
push 0x4ba407
call fcn.00457890
test eax, eax
je 0x401f87
lea edi, [esp + 0x30]
lea edx, [esp + 0x50]
mov ecx, edi
push 0
call 0x405640
add esp, 4
lea ecx, [esp + 0x6c]
push edi
call fcn.0047f670
jmp 0x40213b
lea eax, [esp + 0x58]
mov ecx, esi
mov dword [esp + 0x30], 0x4b8fbc
push eax
push str.current_slot
call fcn.00480b10
lea eax, [esp + 0x30]
push eax
push esi
call fcn.004136f0
add esp, 8
mov edi, dword [esp + 0x20]
lea ecx, [edi - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402100
test al, al
je 0x402130
mov ecx, esi
lea edx, [esp + 0x30]
push 0
call 0x405640
add esp, 4
lea ecx, [esp + 0x6c]
push esi
call fcn.0047f670
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x40213b
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40213b
lea eax, [esp + 4]
push eax
call fcn.0047f3e0
jmp 0x40213b
xor ebx, ebx
jmp case.0x401680.63
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401ee3
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x401ee3
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401f2e
push esi
call fcn.0047f3e0
cmp byte [esp + 0x88], 0
jne 0x401f3c
jmp 0x40214e
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401e1b
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x401e1b
mov byte [esp + 0x18], al
mov edx, 0xffffffff
lock xadd dword [edi - 4], edx
mov al, byte [esp + 0x18]
test edx, edx
jg 0x401b72
lea eax, [esp + 0xa8]
push eax
call fcn.0047f3e0
mov al, byte [esp + 0x18]
jmp 0x401b72
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401c24
lea eax, [esp + 0x58]
push eax
call fcn.0047f3e0
jmp 0x401c24
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x401bad
lea eax, [esp + 0xa8]
push eax
call fcn.0047f3e0
jmp 0x401bad
mov byte [esp + 0x18], al
mov edx, 0xffffffff
lock xadd dword [edi - 4], edx
mov al, byte [esp + 0x18]
test edx, edx
jg 0x401fc1
lea eax, [esp + 4]
push eax
call fcn.0047f3e0
mov al, byte [esp + 0x18]
test al, al
jne 0x401fc9
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40508b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
lea eax, [ecx + eax*4]
sub eax, ebx
mov edi, eax
sar edi, 2
test eax, eax
je 0x402191
cmp edi, 0x40000000
jae 0x4050f6
push eax
call fcn.004af380
add esp, 4
jmp 0x402193
xor eax, eax
lea ecx, [eax + edi*4]
mov dword [esp + 4], eax
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x64]
cmp ecx, ebx
jne 0x4021b2
mov dword [esp + 8], eax
jmp 0x402244
lea edx, [ebx*4 - 4]
shl ecx, 2
mov esi, dword [esp + 0x68]
shl ebx, 2
mov edi, eax
mov dword [esp + 0x18], eax
sub edx, ecx
sub ebx, ecx
shr edx, 2
inc edx
mov dword [esp + 0x64], edx
nop word cs:[eax + eax]
nop
lea eax, [esp + 0x30]
mov ecx, edi
push eax
push dword [esi]
call fcn.00480b10
add esi, 4
add edi, 4
add ebx, 0xfffffffc
jne 0x4021e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
lea esi, [esp + 0x20]
lea ecx, [eax + ecx*4]
mov eax, dword [esp + 4]
mov dword [esp + 8], ecx
cmp eax, ecx
je 0x402244
lea edi, [esp + 0x14]
lea ebx, [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x80], 0
jmp 0x403f50
mov dword [esp + 0x80], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x18], 0
jmp 0x4049de
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
mov ecx, esi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4026fc
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4026fe
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4022a5
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x4026fe
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403a92
mov eax, dword [esp + 4]
lea esi, [esp + 0x20]
mov dword [esp + 0x20], 0x4b8fbc
cmp eax, dword [esp + 8]
je 0x402347
mov ecx, ebx
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402402
mov esi, eax
sub esi, edx
test esi, esi
jle 0x402404
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x402324
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x402404
mov dword [esp + 0x58], 0x4b8fbc
jmp 0x4027d8
lea eax, [esp + 0x50]
mov ecx, eax
push 0x4ba581
call fcn.00457890
test eax, eax
je 0x4029d9
mov eax, dword [esp + 0x84]
and al, 1
movzx edx, al
jmp 0x4029f4
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403af5
mov eax, dword [esp + 4]
lea esi, [esp + 0x20]
mov dword [esp + 0x58], 0x4b8fbc
cmp eax, dword [esp + 8]
je 0x4024a2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402773
mov esi, eax
sub esi, edx
test esi, esi
jle 0x402775
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4023df
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x402775
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403b16
lea esi, [esp + 0x20]
mov ecx, esi
push ebx
call fcn.0047f670
mov eax, dword [esp + 0x58]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403b37
mov eax, dword [esp + 4]
mov dword [esp + 0x58], 0x4b8fbc
cmp eax, dword [esp + 8]
je 0x4027d8
lea ecx, [esp + 0x10]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x40279a
mov esi, eax
sub esi, edx
test esi, esi
jle 0x40279c
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x40247f
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x40279c
mov eax, dword [0x4b300c]
test eax, eax
je 0x4024bb
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x402bda
mov eax, dword [0x4b3020]
test eax, eax
je 0x4024d4
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x402bfe
mov eax, dword [str.dtbo]
test eax, eax
je 0x4024ed
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x402e0c
mov eax, dword [0x4b3048]
test eax, eax
je 0x402506
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x402e76
mov eax, dword [0x4b305c]
test eax, eax
je 0x40251f
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x402fa9
mov eax, dword [str.product]
test eax, eax
je 0x402538
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x4030ad
mov eax, dword [0x4b3084]
test eax, eax
je 0x402551
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x4030ec
mov eax, dword [str.recovery]
test eax, eax
je 0x40256a
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x40360e
mov eax, dword [str.super]
test eax, eax
je 0x402583
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x40367e
mov eax, dword [0x4b30c0]
test eax, eax
je 0x40259c
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x4036e2
mov eax, dword [0x4b30d4]
test eax, eax
je 0x4025b5
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x4036ec
mov eax, dword [str.vbmeta]
test eax, eax
je 0x4025ce
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x403828
mov eax, dword [str.vendor]
test eax, eax
je 0x4025e7
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x403870
mov eax, dword [0x4b3110]
test eax, eax
je 0x402600
mov ecx, esi
push eax
call fcn.00457890
test eax, eax
je 0x4038cc
mov ecx, esi
push str.userdata
call fcn.00457890
test eax, eax
je 0x4038a4
lea ecx, [esp + 0x20]
push str.cache
call fcn.00457890
test eax, eax
je 0x4039f4
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push dword [esp + 0x20]
push str.unknown_partition__s_n
push eax
call fcn.00409350
add esp, 0xc
lea esi, [esp + 0x30]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0x4ba407
call fcn.00480b10
jmp 0x403a2a
lea ecx, [esp + 0x50]
push 0x4ba581
call fcn.00457890
test eax, eax
mov dword [esp + 0x18], eax
jne 0x40268a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
push eax
call fcn.00409350
add esp, 8
lea edi, [esp + 0x30]
lea ecx, [esp + 0xa0]
push edi
push str.update.zip
call fcn.00480b10
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x402ca9
mov ecx, edi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402c66
mov edi, eax
sub edi, edx
test edi, edi
jle 0x402c68
shr edi, 2
inc edi
lea esi, [ecx + 4]
sub esp, 4
mov dword [esp], esi
call fcn.0047f670
dec edi
mov ecx, esi
cmp edi, 1
jg 0x4026d9
mov eax, dword [esp + 8]
lea esi, [esp + 0x20]
jmp 0x402c68
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403b9a
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
mov ecx, ebx
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4028b1
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4028b3
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x402750
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x4028b3
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403bbb
mov ecx, ebx
lea eax, [esp + 0x30]
push eax
jmp 0x403914
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403bdc
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
call fcn.0047f670
mov eax, dword [esp + 0x10]
lea esi, [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403bfd
lea ecx, [esp + 0x30]
lea eax, [esp + 0x98]
mov edx, esi
push eax
push ebx
call fcn.00405ad0
add esp, 8
lea ebx, [esp + 0x10]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x54]
mov ecx, ebx
push eax
push str.boot.img
call fcn.00480b10
push dword [esp + 0x98]
push dword [esp + 0x78]
push ebx
call fcn.00414910
add esp, 0xc
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ab3
mov ecx, ebx
lea eax, [esp + 0x78]
push eax
push 0x4ba529
call fcn.00480b10
lea ebx, [esp + 0x1c]
lea eax, [esp + 0x8c]
mov ecx, ebx
push eax
push str.booting
call fcn.00480b10
push ebx
lea eax, [esp + 0x14]
push eax
call fcn.004148f0
add esp, 8
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ad4
mov eax, dword [esp + 0x10]
lea ebx, [esp + 0x58]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x40474f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40474f
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x40474f
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403c1e
mov eax, dword [esp + 4]
mov dword [esp + 0x10], 0x4b8fbc
cmp eax, dword [esp + 8]
je 0x40292e
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402a02
mov esi, eax
sub esi, edx
test esi, esi
jle 0x402a04
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x40290b
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x402a04
mov dword [esp + 0x1c], 0x4b8fbc
jmp 0x402b39
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403fbb
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x403fbb
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4049d0
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4049d0
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
mov ecx, esi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402dbc
mov esi, eax
sub esi, edx
test esi, esi
jle 0x402dbe
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4029b6
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x402dbe
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
push eax
call fcn.00409350
add esp, 8
mov edx, 1
lea ecx, [esp + 0x50]
call fcn.00405db0
jmp 0x403588
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403c81
lea ecx, [esp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ca2
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], 0x4b8fbc
cmp eax, dword [esp + 8]
je 0x402b39
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402afd
mov esi, eax
sub esi, edx
test esi, esi
jle 0x402aff
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x402a81
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x402aff
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
mov ecx, esi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x402f53
mov esi, eax
sub esi, edx
test esi, esi
jle 0x402f55
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x402ada
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x402f55
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403cc3
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ce4
lea esi, [esp + 0x98]
mov ecx, ebx
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push eax
call fcn.00405ad0
add esp, 8
mov dword [esp + 0x74], eax
push 8
call fcn.004af380
add esp, 4
lea ecx, [esp + 0x74]
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], 0x409290
mov dword [esp + 0x38], 0x4092b0
lea edx, [esp + 0x50]
mov dword [eax], ecx
mov dword [eax + 4], esi
lea ecx, [esp + 0x20]
push 1
lea esi, [esp + 0x34]
push esi
call fcn.00405820
add esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x402ba7
push 3
push esi
push esi
call eax
add esp, 0xc
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403c3f
mov eax, dword [esp + 0x10]
lea esi, [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403c60
mov eax, dword [esp + 0x58]
jmp 0x4039b1
xor eax, eax
jmp 0x4038d5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404378
push esi
call fcn.0047f3e0
jmp 0x404378
mov eax, 1
jmp 0x4038d5
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4030b7
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4030b9
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x402c43
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x4030b9
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403d68
lea ecx, [esp + 0xa0]
lea eax, [esp + 0x30]
push eax
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403d85
lea edi, [esp + 0x30]
cmp dword [esp + 0x18], 0
mov esi, dword [esp + 0xa0]
sete byte [esp + 0x18]
call fcn.00407380
mov ecx, edi
push ebx
push str.product
call fcn.00480b10
push 0x41
push 0x4ce020
push edi
call fcn.00414780
add esp, 0xc
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403d05
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00416bd0
add esp, 8
test eax, eax
lea edi, [esp + 0x14]
jne 0x4050fb
mov ecx, dword [esp + 0x10]
mov edx, str.android_info.txt
push ebx
call fcn.00408620
add esp, 4
test eax, eax
je 0x405110
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x58]
and cl, 1
or cl, byte [esp + 0x18]
mov byte [esp + 0x18], cl
mov ecx, eax
push dword [esp + 0x5c]
call fcn.004075d0
add esp, 4
cmp byte [esp + 0x18], 0
mov al, 1
mov dword [esp + 0x1c], 0x4b8fbc
mov dword [esp + 0xcc], eax
je 0x402d68
lea esi, [esp + 0x20]
jmp 0x403176
lea ecx, [esp + 0x50]
push 0x4ba407
call fcn.00457890
test eax, eax
lea esi, [esp + 0x20]
je 0x402e16
call fcn.00406e50
mov ecx, eax
test eax, eax
je 0x402fb3
mov eax, dword [esp + 0x50]
lea esi, [esp + 0x30]
movsx eax, byte [eax]
add eax, 0xffffffa0
cdq
idiv ecx
mov ecx, esi
add dl, 0x61
movsx eax, dl
lea edx, [esp + 0x20]
push edx
push eax
push 1
call fcn.00480d10
jmp 0x402fc8
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403da2
lea esi, [esp + 0x30]
lea edx, [esp + 0x20]
mov ecx, esi
push 0
call 0x405640
add esp, 4
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403dc3
push esi
call fcn.00413710
add esp, 4
jmp 0x40307f
mov eax, 2
jmp 0x4038d5
lea ecx, [esp + 0x30]
call fcn.00406f80
call fcn.00406e50
mov ecx, eax
test eax, eax
je 0x4030f6
mov eax, dword [esp + 0x30]
movsx eax, byte [eax]
add eax, 0xffffffa0
cdq
idiv ecx
mov ecx, esi
add dl, 0x61
movsx eax, dl
lea edx, [esp + 0x54]
push edx
push eax
push 1
call fcn.00480d10
jmp 0x403107
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40443a
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x40443a
mov eax, 3
jmp 0x4038d5
lea esi, [esp + 0x30]
mov ecx, esi
push ebx
push 0x4ba606
jmp 0x40306f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404034
push ebx
call fcn.0047f3e0
jmp 0x404034
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40452e
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x40452e
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4045a2
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4045a2
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4045b5
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4045b5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4045c8
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4045c8
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4045db
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4045db
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403de0
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x30]
call fcn.00406470
test al, al
lea esi, [esp + 0x20]
je 0x40511b
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x40511b
push dword [esp + 0x38]
push dword [esp + 0x44]
push esi
call fcn.00414a30
add esp, 0xc
jmp 0x4039c0
mov eax, 4
jmp 0x4038d5
lea esi, [esp + 0x30]
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push 0x4ba407
call fcn.00480b10
lea ecx, [esp + 0x1c]
push esi
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403e22
lea esi, [esp + 0x20]
jmp 0x403137
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp ecx, eax
je 0x405129
sub eax, ecx
cmp eax, 4
jne 0x405137
push str.unlock
call fcn.00457890
test eax, eax
je 0x403063
mov ecx, dword [esp + 4]
push str.lock
call fcn.00457890
test eax, eax
je 0x403063
mov ecx, dword [esp + 4]
push str.unlock_critical
call fcn.00457890
test eax, eax
je 0x403063
mov ecx, dword [esp + 4]
push str.lock_critical
call fcn.00457890
test eax, eax
je 0x403063
mov ecx, dword [esp + 4]
push str.get_unlock_ability
call fcn.00457890
test eax, eax
jne 0x405133
lea esi, [esp + 0x30]
mov ecx, esi
push ebx
push str.flashing
call fcn.00480b10
mov ecx, esi
lea edx, [esp + 4]
call fcn.00406510
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x4049b9
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4049b9
lea eax, [esp + 0x20]
jmp 0x4044a9
mov eax, 5
jmp 0x4038d5
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403e43
lea eax, [esp + 0x30]
push eax
call fcn.00414af0
add esp, 4
mov eax, dword [esp + 0x30]
lea esi, [esp + 0x20]
jmp 0x40438a
mov eax, 6
jmp 0x4038d5
lea eax, [esp + 0x54]
mov ecx, esi
push eax
push 0x4ba407
call fcn.00480b10
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403e64
lea ecx, [esp + 0x1c]
push esi
call fcn.0047f670
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403e85
lea ecx, [esp + 0x1c]
push 0x4ba407
call fcn.00457890
test eax, eax
je 0x403156
mov dword [esp + 0xcc], 0
jmp 0x403176
call fcn.00406e50
cmp eax, 2
jl 0x403176
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push str.Warning:_Could_not_determine_slot_for_secondary_images._Ignoring._n
push eax
call fcn.00409350
add esp, 8
xor eax, eax
mov dword [esp + 0x54], 0
jmp 0x403442
mov eax, dword [esp + 0x44]
shr eax, 0x14
push eax
mov dword [esp + 0xcc], esi
push esi
push str.extracting__s___u_MB__to_disk...
push ecx
call fcn.00409350
add esp, 0x10
call fcn.0040bb40
fstp qword [esp + 0x100]
movsd xmm0, qword [esp + 0x100]
mov esi, dword [esp + 0x18]
movsd qword [esp + 0x90], xmm0
push esi
lea eax, [esp + 0x34]
push eax
push edi
call fcn.00417b90
add esp, 0xc
test eax, eax
jne 0x405143
mov edi, esi
push 0
push 0
push 0
push esi
call fcn.00446d50
add esp, 0x10
or edx, eax
lea ebx, [esp + 0x58]
jne 0x40515e
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x40
call fcn.0040bb40
fstp qword [esp + 0xf8]
movsd xmm0, qword [esp + 0xf8]
subsd xmm0, qword [esp + 0x90]
sub esp, 0x10
mov dword [esp], esi
movsd qword [esp + 8], xmm0
mov dword [esp + 4], str._took__.3fs_n
call fcn.00409350
add esp, 0x10
mov eax, dword [esp + 0x54]
cmp edi, 0xffffffff
je 0x4033b3
lea eax, [eax + eax*4]
lea edi, [esp + 0x14]
cmp byte [eax*4 + 0x4b301d], 0
je 0x4032c8
lea esi, [esp + 0x30]
lea edx, [esp + 0x8c]
mov ecx, esi
push edx
push dword [eax*4 + 0x4b3018]
call fcn.00480b10
lea ecx, [esp + 0x20]
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x80]
call fcn.00480b10
mov ecx, esi
lea esi, [esp + 0x20]
mov edx, esi
call fcn.00407bc0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx - 0xc]
cmp ecx, 0x4b8fb0
jne 0x4033d6
mov ebx, dword [esp + 0x30]
lea ecx, [ebx - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40340e
test al, al
lea ebx, [esp + 0x58]
je 0x4034ef
mov ecx, dword [esp + 0x18]
lea esi, [esp + 0x30]
mov edx, esi
call fcn.00408700
test al, al
je 0x405180
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x70]
lea ecx, [esp + 0x78]
lea eax, [eax + eax*4]
push edx
push dword [eax*4 + 0x4b3018]
call fcn.00480b10
lea eax, [esp + 0x8c]
mov ecx, eax
lea eax, [esp + 0xa4]
push eax
push dword [esp + 0x80]
call fcn.00480b10
push 0xc
call fcn.004af380
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0x408ab0
mov dword [esp + 0x28], 0x408c30
lea edx, [esp + 0x8c]
mov dword [eax], ecx
lea ecx, [esp + 0x54]
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
lea ecx, [esp + 0x78]
push 0
lea esi, [esp + 0x24]
push esi
call fcn.00405820
add esp, 8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x403371
push 3
push esi
push esi
call eax
add esp, 0xc
mov eax, dword [esp + 0x8c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x4033c0
mov eax, dword [esp + 0x78]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x4034ef
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4034ef
push esi
call fcn.0047f3e0
jmp 0x4034ef
lea esi, [esp + 0x20]
lea edi, [esp + 0x14]
jmp 0x4034de
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403383
push esi
call fcn.0047f3e0
jmp 0x403383
mov byte [esp + 0x90], al
mov edx, 0xffffffff
lock xadd dword [ebx - 4], edx
movzx eax, byte [esp + 0x90]
test edx, edx
jg 0x4032a9
lea eax, [esp + 0x78]
push eax
call fcn.0047f3e0
movzx eax, byte [esp + 0x90]
jmp 0x4032a9
mov byte [esp + 0x90], al
mov edx, 0xffffffff
lock xadd dword [ebx - 4], edx
movzx eax, byte [esp + 0x90]
test edx, edx
jg 0x4032bc
push esi
call fcn.0047f3e0
movzx eax, byte [esp + 0x90]
jmp 0x4032bc
lea eax, [eax + eax*4]
cmp dword [eax*4 + 0x4b300c], 0
je 0x403455
mov ecx, dword [esp + 0x50]
jmp 0x403467
cmp byte [esp + 0xcc], 0
jne 0x4034ef
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov esi, dword [eax*4 + 0x4b3010]
mov dword [esp + 0x7c], ecx
call fcn.004085a0
lea ebx, [esp + 0x20]
mov dword [esp + 0x18], eax
mov ecx, ebx
push esi
call fcn.00417c30
lea eax, [esp + 0x30]
push eax
push ebx
push edi
call fcn.00416ec0
add esp, 0xc
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
test eax, eax
je 0x403185
push esi
push str.archive_does_not_contain__s_n
push ecx
call fcn.00409350
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x4034ce
mov edi, eax
push eax
call sub.msvcrt.dll__close
add esp, 4
mov eax, dword [esp + 0x54]
lea esi, [esp + 0x20]
lea edi, [esp + 0x14]
lea ebx, [esp + 0x58]
lea eax, [eax + eax*4]
cmp byte [eax*4 + 0x4b301c], 0
je 0x4051aa
mov eax, dword [esp + 0x54]
inc eax
cmp eax, 0xe
mov dword [esp + 0x54], eax
jb 0x403442
lea eax, [esp + 0x50]
mov ecx, eax
push 0x4ba581
call fcn.00457890
test eax, eax
je 0x403520
lea ecx, [esp + 0x50]
call fcn.00407f00
jmp 0x403553
lea esi, [esp + 0x30]
lea eax, [esp + 0x54]
mov ecx, esi
push eax
push 0x4bb52a
call fcn.00480b10
mov ecx, esi
call fcn.00407f00
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403e01
lea esi, [esp + 0x20]
push dword [esp + 0x10]
call fcn.00416d50
add esp, 4
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403d26
mov eax, dword [esp + 0xa0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403d47
mov al, 1
mov dword [esp + 0x18], eax
jmp 0x4049bd
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x40378f
mov esi, eax
sub esi, edx
test esi, esi
jle 0x403791
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4035ce
mov eax, dword [esp + 8]
jmp 0x403791
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404762
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x404762
mov eax, 7
jmp 0x4038d5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404689
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x404689
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4046c2
push ebx
call fcn.0047f3e0
cmp dword [esp + 0x74], 0
jne 0x4046cd
jmp 0x4051e1
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404723
push ebx
call fcn.0047f3e0
jmp 0x404723
mov eax, 8
jmp 0x4038d5
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x403877
mov esi, eax
sub esi, edx
test esi, esi
jle 0x403879
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4036c3
mov eax, dword [esp + 8]
jmp 0x403879
mov eax, 9
jmp 0x4038d5
mov eax, 0xa
jmp 0x4038d5
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ea6
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x20]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x403760
mov esi, eax
sub esi, edx
test esi, esi
jle 0x403762
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x403744
mov eax, dword [esp + 8]
jmp 0x403762
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ec7
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00414340
jmp 0x404843
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403ee4
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x20]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4037f9
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4037fb
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4037dd
mov eax, dword [esp + 8]
jmp 0x4037fb
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403f05
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00414030
jmp 0x404843
mov eax, 0xb
jmp 0x4038d5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4047c6
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x4047c6
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404896
push esi
call fcn.0047f3e0
jmp 0x404896
mov eax, 0xc
jmp 0x4038d1
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403f22
lea eax, [esp + 0x30]
push eax
call fcn.00414210
add esp, 4
jmp 0x404859
push str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
je 0x4051c9
cmp byte [eax], 0
je 0x4051c9
push str.userdata.img
jmp 0x403a17
mov eax, 0xd
lea edi, [esp + 0x14]
lea eax, [eax + eax*4]
mov esi, dword [eax*4 + 0x4b3010]
push str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
je 0x4051c9
cmp byte [eax], 0
je 0x4051c9
push esi
push eax
push str._s__s
lea esi, [esp + 0x3c]
push esi
call fcn.0042e590
add esp, 0x10
mov ecx, ebx
push esi
call fcn.0047f670
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403b79
mov eax, dword [esp + 0x58]
cmp dword [eax - 0xc], 0
lea eax, [esp + 0x10]
je 0x4051bb
mov esi, eax
mov ecx, eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24]
call fcn.00480b10
push 4
call fcn.004af380
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], 0x4091b0
mov dword [eax], ebx
mov dword [esp + 0x38], 0x409240
mov ecx, esi
lea edx, [esp + 0x50]
push 1
lea esi, [esp + 0x34]
push esi
call fcn.00405820
add esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x403996
push 3
push esi
push esi
call eax
add esp, 0xc
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403b58
mov eax, dword [esp + 0x58]
lea esi, [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403a71
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x4049bd
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4049bd
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4049bd
push str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
je 0x4051c9
cmp byte [eax], 0
je 0x4051c9
push str.cache.img
push eax
push str._s__s
lea esi, [esp + 0x3c]
push esi
call fcn.0042e590
add esp, 0x10
lea edi, [esp + 0x14]
jmp 0x403911
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40486c
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x40486c
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404859
push ebx
call fcn.0047f3e0
jmp 0x404859
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4039c0
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4039c0
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4022e3
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x4022e3
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40282f
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x40282f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402879
lea eax, [esp + 0x54]
push eax
call fcn.0047f3e0
jmp 0x402879
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402398
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x402398
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40241d
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x40241d
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40243c
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x40243c
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4039a9
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4039a9
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40392c
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x40392c
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402717
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x402717
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40278e
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x40278e
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4027b5
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x4027b5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4027d8
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x4027d8
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4028cc
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4028cc
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402bba
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x402bba
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402bd1
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x402bd1
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402a1d
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x402a1d
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402a3e
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x402a3e
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402b18
lea eax, [esp + 0x54]
push eax
call fcn.0047f3e0
jmp 0x402b18
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402b39
lea eax, [esp + 0x54]
push eax
call fcn.0047f3e0
jmp 0x402b39
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402cef
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x402cef
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403572
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x403572
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403588
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x403588
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402c81
push esi
call fcn.0047f3e0
jmp 0x402c81
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402ca5
push esi
call fcn.0047f3e0
jmp 0x402ca5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402dd7
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x402dd7
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402dfe
push ebx
call fcn.0047f3e0
jmp 0x402dfe
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402f6e
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x402f6e
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40354f
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x40354f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x402fe5
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x402fe5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4030d2
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x4030d2
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40311a
lea eax, [esp + 0x54]
push eax
call fcn.0047f3e0
jmp 0x40311a
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403137
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x403137
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403711
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x403711
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40377b
push ebx
call fcn.0047f3e0
jmp 0x40377b
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4037aa
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x4037aa
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403814
push ebx
call fcn.0047f3e0
jmp 0x403814
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x403892
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x403892
mov ecx, edi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x403fa0
mov esi, eax
sub esi, edx
test esi, esi
jle 0x403fa2
shr esi, 2
inc esi
nop word cs:[eax + eax]
nop dword [eax]
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x403f80
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x403fa2
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40293b
mov ecx, edi
push str.getvar
call fcn.00457890
test eax, eax
lea esi, [esp + 0x20]
je 0x4040b0
mov ecx, edi
push str.erase
call fcn.00457890
test eax, eax
je 0x404120
push str.format
push edi
call fcn.0042e7b0
add esp, 8
test al, al
je 0x404183
lea esi, [esp + 0x30]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0x4ba429
call fcn.00480b10
push esi
push edi
lea eax, [esp + 0x28]
push eax
call fcn.0042e5e0
add esp, 0xc
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402e91
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x58], 0x4b8fbc
sub ecx, eax
sar ecx, 2
cmp ecx, 1
jbe 0x4043b6
mov esi, dword [eax + 4]
push esi
call sub.msvcrt.dll_strlen
add esp, 4
mov ecx, ebx
push eax
push esi
call fcn.0047fc60
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], 0x4b8fbc
sub ecx, eax
sar ecx, 2
cmp ecx, 3
jb 0x4043be
mov esi, dword [eax + 8]
push esi
call sub.msvcrt.dll_strlen
add esp, 4
lea ecx, [esp + 0x10]
push eax
push esi
call fcn.0047fc60
jmp 0x4043be
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x404359
mov esi, eax
sub esi, edx
test esi, esi
jle 0x40435b
shr esi, 2
inc esi
nop dword [eax + eax]
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4040f0
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x40435b
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
mov ecx, esi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x40441f
mov esi, eax
sub esi, edx
test esi, esi
jle 0x404421
shr esi, 2
inc esi
nop dword [eax]
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x404160
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x404421
mov ecx, edi
push str.signature
call fcn.00457890
test eax, eax
je 0x4044b4
mov ecx, edi
push 0x4ba489
call fcn.00457890
test eax, eax
je 0x4045f0
mov ecx, edi
push str.reboot_bootloader
call fcn.00457890
test eax, eax
je 0x404663
mov ecx, edi
push str.reboot_recovery
call fcn.00457890
test eax, eax
je 0x404792
mov ecx, edi
push str.reboot_fastboot
call fcn.00457890
test eax, eax
je 0x40479d
mov ecx, edi
push 0x4ba512
call fcn.00457890
test eax, eax
je 0x404814
mov ecx, edi
push 0x4ba529
call fcn.00457890
test eax, eax
je 0x4048b3
mov ecx, edi
push str.flash
call fcn.00457890
test eax, eax
je 0x404911
mov ecx, edi
push str.flash:raw
call fcn.00457890
test eax, eax
je 0x40226c
mov ecx, edi
push str.flashall
call fcn.00457890
test eax, eax
je 0x402354
mov ecx, edi
push str.update
call fcn.00457890
test eax, eax
je 0x40265e
mov ecx, edi
push str.set_active
call fcn.00457890
test eax, eax
je 0x40297d
mov ecx, edi
push str.stage
call fcn.00457890
test eax, eax
je 0x402aa1
mov ecx, edi
push str.get_staged
call fcn.00457890
test eax, eax
je 0x402c08
mov ecx, edi
push 0x4ba606
call fcn.00457890
test eax, eax
je 0x402e80
mov ecx, edi
push str.flashing
call fcn.00457890
test eax, eax
je 0x402fee
mov ecx, edi
push str.create_logical_partition
call fcn.00457890
test eax, eax
je 0x403593
mov ecx, edi
push str.delete_logical_partition
call fcn.00457890
test eax, eax
je 0x403688
mov ecx, edi
push str.resize_logical_partition
call fcn.00457890
test eax, eax
jne 0x4051d3
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4036f6
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4036f8
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x40433a
mov eax, dword [esp + 8]
jmp 0x4036f8
mov eax, edx
lea ecx, [eax - 4]
lea esi, [esp + 0x20]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402be1
lea eax, [esp + 0x30]
push eax
push eax
call fcn.00414690
add esp, 8
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x4049bd
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4049bd
push esi
call fcn.0047f3e0
jmp 0x4049bd
mov dword [esp + 0x10], 0x4b8fbc
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x1c]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x404513
mov esi, eax
sub esi, edx
test esi, esi
jle 0x404515
shr esi, 2
inc esi
nop dword [eax]
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x404400
mov eax, dword [esp + 8]
jmp 0x404515
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402e55
push 1
call fcn.004af380
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], 0x408f10
mov dword [esp + 0x38], 0x409090
lea ecx, [esp + 0x20]
lea edx, [esp + 0x50]
push 1
lea esi, [esp + 0x34]
push esi
call fcn.00405820
add esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x404480
push 3
push esi
push esi
call eax
add esp, 0xc
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x4049b9
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4049b9
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x4049b9
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x40466e
mov esi, eax
sub esi, edx
test esi, esi
jle 0x404670
shr esi, 2
inc esi
nop
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4044f0
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x404670
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402eae
lea esi, [esp + 0x54]
lea eax, [esp + 0x78]
mov ecx, esi
push eax
push dword [esp + 0x20]
call fcn.00480b10
push 8
call fcn.004af380
add esp, 4
lea ecx, [esp + 0x10]
mov dword [eax], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], 0x4090e0
mov dword [esp + 0x38], 0x409150
lea edx, [esp + 0x50]
mov dword [eax + 4], ecx
mov ecx, esi
push 1
lea esi, [esp + 0x34]
push esi
call fcn.00405820
add esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40458f
push 3
push esi
push esi
call eax
add esp, 0xc
mov eax, dword [esp + 0x54]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402ecf
mov eax, dword [esp + 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402ef0
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402f11
mov eax, dword [esp + 0x58]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x402f32
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
cmp esi, edi
jne 0x404990
jmp 0x4049a8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
mov edx, ecx
sub edx, eax
cmp edx, 4
mov dl, 1
mov dword [esp + 0x18], edx
jne 0x4048a6
cmp eax, ecx
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4047ab
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4047ad
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x404640
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x4047ad
mov al, 1
mov dword [esp + 0x68], eax
jmp 0x4049bd
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403618
lea esi, [esp + 0x20]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push dword [esp + 0x34]
call fcn.00480b10
mov ecx, esi
lea edx, [esp + 0x98]
call fcn.00405a00
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403639
cmp dword [esp + 0x74], 0
je 0x4051e1
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov edx, eax
xor edx, 0x100
or edx, ecx
jne 0x405201
mov ecx, esi
lea eax, [esp + 0x10]
push eax
push str.signature
call fcn.00480b10
push dword [esp + 0x98]
push dword [esp + 0x78]
push esi
call fcn.00414910
add esp, 0xc
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403661
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push str.signature
call fcn.00480b10
lea eax, [esp + 0x54]
mov ecx, ebx
push eax
push str.installing_signature
call fcn.00480b10
push ebx
push esi
call fcn.004148f0
add esp, 8
mov eax, dword [esp + 0x58]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x4035ed
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x404386
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404386
push ebx
call fcn.0047f3e0
jmp 0x404386
mov al, 1
mov dword [esp + 0x64], eax
jmp 0x4049bd
mov al, 1
mov dword [esp + 0x80], eax
jmp 0x4049bd
mov eax, edx
lea ecx, [eax - 4]
mov dword [esp + 8], ecx
mov eax, dword [eax - 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403832
lea esi, [esp + 0x30]
mov ecx, esi
push str.bootloader
call fcn.00457890
test eax, eax
je 0x40480c
mov ecx, esi
push str.recovery
call fcn.00457890
test eax, eax
je 0x404879
mov ecx, esi
push str.fastboot
call fcn.00457890
mov cl, 1
test eax, eax
mov dword [esp + 0x80], ecx
je 0x40487f
jmp 0x40520d
mov al, 1
mov dword [esp + 0x68], eax
jmp 0x40487f
mov edi, esi
lea esi, [esp + 0x30]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0x4ba512
call fcn.00480b10
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push str.resuming_boot
call fcn.00480b10
push edi
push esi
call fcn.004148f0
add esp, 8
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403a54
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403a33
lea esi, [esp + 0x20]
lea edi, [esp + 0x14]
jmp 0x4049bd
mov al, 1
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x30]
lea esi, [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x403853
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], 0
cmp eax, ecx
je 0x4049bd
jmp 0x40521b
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
lea ecx, [esp + 0x30]
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x4022c8
mov esi, eax
sub esi, edx
test esi, esi
jle 0x4022ca
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x4048ee
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x4022ca
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
je 0x4050e2
mov ecx, esi
push eax
call fcn.00480bb0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
lea edx, [ecx + 4]
cmp edx, eax
je 0x40237d
mov esi, eax
sub esi, edx
test esi, esi
jle 0x40237f
shr esi, 2
inc esi
lea edi, [ecx + 4]
sub esp, 4
mov dword [esp], edi
call fcn.0047f670
dec esi
mov ecx, edi
cmp esi, 1
jg 0x40494a
mov eax, dword [esp + 8]
lea edi, [esp + 0x14]
jmp 0x40237f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40499d
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x40499d
mov eax, dword [esi]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40496d
add esi, 4
cmp edi, esi
jne 0x404990
mov esi, dword [esp + 0x20]
test esi, esi
lea edi, [esp + 0x14]
je 0x4049b9
push esi
call fcn.004af2d0
add esp, 4
lea esi, [esp + 0x20]
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40295c
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
jne 0x403f50
cmp byte [esp + 0x60], 0
lea ebx, [esp + 0x30]
je 0x404d42
lea eax, [esp + 0x58]
mov ecx, ebx
push eax
push str.userdata
call fcn.00480b10
lea edi, [esp + 0x34]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
push str.cache
call fcn.00480b10
lea ebx, [esp + 0x38]
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
push str.metadata
call fcn.00480b10
push 0xc
call fcn.004af380
add esp, 4
mov esi, eax
mov ecx, eax
lea eax, [esp + 0x30]
push eax
call fcn.00480bb0
lea ecx, [esi + 4]
mov dword [esp + 0x90], ecx
push edi
call fcn.00480bb0
lea ecx, [esi + 8]
mov dword [esp + 0x7c], ecx
push ebx
call fcn.00480bb0
mov eax, dword [esp + 0x38]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404f93
mov eax, dword [esp + 0x34]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404fb4
mov eax, dword [esp + 0x30]
lea ebx, [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404fd5
mov eax, 0xc
mov edi, esi
mov dword [esp + 0x84], esi
jmp 0x404b80
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404bda
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x404bda
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404bed
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x404bed
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404ce0
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x404ce0
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404c89
lea eax, [esp + 0x1c]
push eax
call fcn.0047f3e0
jmp 0x404c89
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404c9c
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x404c9c
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404caf
lea eax, [esp + 0x58]
push eax
call fcn.0047f3e0
jmp 0x404caf
mov esi, ebx
lea ebx, [esp + 0x58]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 0x4b8fbc
mov ecx, ebx
push eax
push str.partition_type:
call fcn.00480b10
mov ecx, ebx
push edi
call fcn.0047f9c0
mov ecx, dword [eax]
mov dword [esp + 0x20], ecx
mov dword [eax], 0x4b8fbc
push esi
lea eax, [esp + 0x24]
push eax
call fcn.004136f0
add esp, 8
mov ebx, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404aad
mov eax, dword [esp + 0x58]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404ace
mov eax, dword [esp + 0x30]
test bl, bl
lea ecx, [eax - 0xc]
je 0x404cd0
cmp dword [ecx], 0
je 0x404cd0
push edi
call fcn.00413970
add esp, 4
mov ecx, edi
push str.userdata
call fcn.00457890
lea esi, [esp + 0x20]
lea eax, [esp + 0x54]
mov ecx, esi
push eax
push 0x4ba407
call fcn.00480b10
lea ebx, [esp + 0x58]
lea eax, [esp + 0x78]
mov ecx, ebx
push eax
push 0x4ba407
call fcn.00480b10
lea ebx, [esp + 0x10]
lea eax, [esp + 0x8c]
mov ecx, ebx
push eax
push 0x4ba407
call fcn.00480b10
mov ecx, edi
mov edx, 1
push ebx
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.00406700
add esp, 0xc
mov eax, dword [esp + 0x10]
lea ebx, [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404b10
mov eax, dword [esp + 0x58]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404b31
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404b52
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
je 0x404ce0
jmp 0x404aef
cmp ecx, 0x4b8fb0
lea ebx, [esp + 0x30]
jne 0x404aef
mov eax, dword [esp + 0x60]
add edi, 4
add eax, 0xfffffffc
jne 0x404b80
mov edi, dword [esp + 0x84]
mov eax, dword [edi]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404ff6
mov eax, dword [esp + 0x90]
lea esi, [esp + 0x20]
mov eax, dword [eax]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x405013
mov eax, dword [esp + 0x7c]
mov eax, dword [eax]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x405030
push edi
call fcn.004af2d0
add esp, 4
test byte [esp + 0x88], 1
je 0x404d59
lea eax, [esp + 0x6c]
push eax
call fcn.00413710
add esp, 4
test byte [esp + 0xd0], 1
jne 0x404d75
mov eax, dword [esp + 0x18]
and al, 1
je 0x404d75
call fcn.00414860
jmp 0x404e21
test byte [esp + 0x68], 1
jne 0x404db0
test byte [esp + 0x64], 1
jne 0x404dcf
test byte [esp + 0x80], 1
je 0x404e26
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
push str.reboot_fastboot
call fcn.00480b10
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push str.rebooting_into_fastboot
jmp 0x404dec
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
push str.reboot_bootloader
call fcn.00480b10
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push str.rebooting_into_bootloader
jmp 0x404dec
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
push str.reboot_recovery
call fcn.00480b10
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push str.rebooting_into_recovery
call fcn.00480b10
push esi
push ebx
call fcn.004148f0
add esp, 8
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40504d
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40506e
call fcn.00414c80
call fcn.00414ce0
mov esi, dword [sym.imp.msvcrt.dll__iob]
xor ebx, ebx
or edx, eax
setne byte [esp + 0x60]
add esi, 0x40
call fcn.0040bb40
fstp qword [esp + 0xf0]
movsd xmm0, qword [esp + 0xf0]
subsd xmm0, qword [esp + 0xe8]
sub esp, 0x10
mov dword [esp], esi
movsd qword [esp + 8], xmm0
mov dword [esp + 4], str.Finished._Total_time:__.3fs_n
call fcn.00409350
add esp, 0x10
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
cmp esi, edi
jne 0x404f10
test esi, esi
je 0x404e94
push esi
call fcn.004af2d0
add esp, 4
mov eax, dword [esp + 0xb8]
test eax, eax
je 0x404eaf
lea ecx, [esp + 0xb0]
push 3
push ecx
push ecx
call eax
add esp, 0xc
mov eax, dword [esp + 0xac]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404f72
mov al, byte [esp + 0x60]
mov bl, al
mov eax, dword [esp + 0x6c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404f35
mov eax, dword [esp + 0x50]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404f52
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404f1d
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x404f1d
mov eax, dword [esi]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x404ef5
add esi, 4
cmp edi, esi
jne 0x404f10
mov esi, dword [esp + 4]
test esi, esi
jne 0x404e8b
jmp 0x404e94
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404eda
lea eax, [esp + 0x114]
push eax
call fcn.0047f3e0
jmp 0x404eda
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404ee9
lea eax, [esp + 0x114]
push eax
call fcn.0047f3e0
jmp 0x404ee9
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404ec5
lea eax, [esp + 0x30]
push eax
call fcn.0047f3e0
jmp 0x404ec5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404a70
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x404a70
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404a83
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x404a83
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404a9a
lea eax, [esp + 0x20]
push eax
call fcn.0047f3e0
jmp 0x404a9a
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404d08
push ebx
call fcn.0047f3e0
jmp 0x404d08
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404d24
push ebx
call fcn.0047f3e0
jmp 0x404d24
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404d39
push ebx
call fcn.0047f3e0
jmp 0x404d39
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404e0e
lea eax, [esp + 0x58]
push eax
call fcn.0047f3e0
jmp 0x404e0e
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404e21
push esi
call fcn.0047f3e0
jmp 0x404e21
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40214e
push esi
call fcn.0047f3e0
jmp 0x40214e
call sub.msvcrt.dll_abort
push dword [0x4d01e0]
push str.invalid_sparse_limit__s
call fcn.0040bb80
mov eax, dword [esp + 0xd4]
shl eax, 4
push dword [esp + eax + 0x114]
push str.unknown_option__s
call fcn.0040bb80
push str.invalid_page_size
call fcn.0040bb80
push str.expected_argument
call fcn.004055e0
push str.no_command
call fcn.004055e0
call fcn.004a9370
push eax
call fcn.00417be0
add esp, 4
push eax
push esi
push str.failed_to_open_zip_file__s:__s
call fcn.0040bb80
push esi
push str.update_package__s_has_no_android_info.txt
call fcn.0040bb80
push dword [esp + 0x20]
push str.cannot_load__s
call fcn.0040bb80
push str.missing_flashing_command
call fcn.004055e0
mov ecx, dword [esp + 4]
push dword [ecx]
push str.unknown_flashing_command__s
call fcn.004055e0
push eax
call fcn.00417be0
add esp, 4
push eax
push dword [esp + 0xcc]
push str._nfailed_to_extract__s:__s
call fcn.0040bb80
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 4
push eax
push dword [esp + 0xcc]
push str._nlseek_on_extracted_file__s_failed:__s
call fcn.0040bb80
mov eax, dword [esp + 0x54]
lea eax, [eax + eax*4]
mov esi, dword [eax*4 + 0x4b3010]
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 4
push eax
push esi
push str.cannot_load__s_from_flash:__s
call fcn.0040bb80
push dword [eax*4 + 0x4b3010]
push str.non_optional_file__s_missing
call fcn.0040bb80
push dword [esp + 0x20]
push str.cannot_determine_image_filename_for__s
call fcn.0040bb80
push str.ANDROID_PRODUCT_OUT_not_set
call fcn.0040bb80
push dword [esp + 0x14]
push str.unknown_command__s
call fcn.004055e0
mov esi, dword [esp + 0x30]
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 4
push eax
push esi
push str.could_not_load__s:__s
call fcn.0040bb80
push ecx
push eax
push str.signature_must_be_256_bytes__got__lld_
call fcn.0040bb80
push dword [esp + 0x30]
push str.unknown_reboot_target__s
call fcn.004055e0
push str.junk_after_reboot_command
call fcn.004055e0
push eax
push edi
push str.invalid_network_address__s:__s_n
call fcn.0040bb80
nop word cs:[eax + eax]
nop dword [eax + eax]
push esi
sub esp, 0xc
mov esi, dword [esp + 0x18]
lea eax, [esp + 8]
mov ecx, esp
lea edx, [esp + 4]
push eax
push ecx
push edx
push str._u__u__u
push esi
call fcn.00409370
add esp, 0x14
cmp eax, 3
jne 0x4052af
mov eax, dword [esp + 4]
lea ecx, [eax - 0x7d0]
cmp ecx, 0x80
jae 0x4052ba
mov ecx, dword [esp]
lea edx, [ecx - 1]
cmp edx, 0xc
jae 0x4052c5
mov edx, dword [esp + 0x14]
mov esi, 0xfffff800
shl eax, 4
and ecx, 0xf
add eax, 0x300
and eax, 0x7f0
or ecx, eax
and esi, dword [edx + 0x2c]
or ecx, esi
mov dword [edx + 0x2c], ecx
add esp, 0xc
pop esi
ret 8
push esi
push str.OS_patch_level_should_be_YYYY_MM_DD:__s
call fcn.004055e0
push eax
push str.year_out_of_range:__d
call fcn.004055e0
push ecx
push str.month_out_of_range:__d
call fcn.004055e0
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, esp
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push dword [esp + 0x40]
call fcn.00480b10
lea edi, [esp + 0x20]
lea eax, [esp + 8]
mov ecx, edi
push eax
push 0x4ba7d4
call fcn.00480b10
lea eax, [esp + 0x14]
push edi
push esi
push eax
call fcn.0042e5e0
add esp, 0xc
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40558e
mov eax, dword [esp]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x4055af
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
sub ecx, eax
je 0x4055cc
sar ecx, 2
cmp ecx, 3
ja 0x4055cc
mov edi, dword [eax]
mov esi, 0xa
cmp byte [edi], 0x30
jne 0x405375
mov al, byte [edi + 1]
mov esi, 0x10
cmp al, 0x78
je 0x405375
cmp al, 0x58
mov eax, 0x10
mov esi, 0xa
cmove esi, eax
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], 0
push esi
lea eax, [esp + 4]
push eax
push edi
call fcn.00445e10
add esp, 0xc
mov ebp, eax
mov esi, edx
call ebx
cmp dword [eax], 0
jne 0x4055cc
mov eax, dword [esp]
cmp eax, edi
je 0x4055cc
test esi, esi
jne 0x4055cc
mov al, byte [eax]
test al, al
jne 0x4055cc
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov dword [esp + 4], ebp
mov eax, esi
sub eax, edi
sar eax, 2
cmp eax, 2
jb 0x405455
mov edi, dword [edi + 4]
mov esi, 0xa
cmp byte [edi], 0x30
jne 0x405400
mov al, byte [edi + 1]
mov esi, 0x10
cmp al, 0x78
je 0x405400
cmp al, 0x58
mov eax, 0x10
mov esi, 0xa
cmove esi, eax
mov ebp, dword [sym.imp.msvcrt.dll__errno]
call ebp
mov dword [eax], 0
push esi
lea eax, [esp + 4]
push eax
push edi
call fcn.00445e10
add esp, 0xc
mov ebx, eax
mov esi, edx
call ebp
cmp dword [eax], 0
jne 0x4055cc
mov eax, dword [esp]
cmp eax, edi
je 0x4055cc
test esi, esi
jne 0x4055cc
mov al, byte [eax]
test al, al
jne 0x4055cc
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 4]
mov eax, esi
sub eax, edi
cmp eax, 0xc
jne 0x4054ff
mov edi, dword [edi + 8]
mov esi, 0xa
cmp byte [edi], 0x30
jne 0x40548a
mov al, byte [edi + 1]
mov esi, 0x10
cmp al, 0x78
je 0x40548a
cmp al, 0x58
mov eax, 0x10
mov esi, 0xa
cmove esi, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0
push esi
lea eax, [esp + 4]
push eax
push edi
call fcn.00445e10
add esp, 0xc
mov ebp, eax
mov esi, edx
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0
jne 0x4055cc
mov eax, dword [esp]
cmp eax, edi
je 0x4055cc
cmp byte [eax], 0
setne al
test esi, esi
setne cl
xor edx, edx
or cl, al
cmovne ebp, edx
test cl, cl
jne 0x4055cc
mov eax, ebx
or eax, dword [esp + 4]
or eax, ebp
cmp eax, 0x7f
ja 0x4055cc
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
and ebp, 0x7f
shl ebp, 0xb
jmp 0x405510
mov eax, ebx
or eax, ebp
cmp eax, 0x80
jae 0x4055cc
xor ebp, ebp
mov eax, dword [esp + 0x38]
mov ecx, 0x7ff
mov edx, dword [esp + 4]
and ebx, 0x7f
shl ebx, 0x12
and ecx, dword [eax + 0x2c]
shl edx, 0x19
or ebx, edx
or ecx, ebp
or ebx, ecx
cmp edi, esi
mov dword [eax + 0x2c], ebx
jne 0x405570
test esi, esi
je 0x405543
push esi
call fcn.004af2d0
add esp, 4
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40557d
mov eax, esp
push eax
call fcn.0047f3e0
jmp 0x40557d
mov eax, dword [edi]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b8fb0
jne 0x40554d
add edi, 4
cmp esi, edi
jne 0x405570
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x40553a
jmp 0x405543
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405320
lea eax, [esp + 0x10]
push eax
call fcn.0047f3e0
jmp 0x405320
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405332
push edi
call fcn.0047f3e0
jmp 0x405332
push dword [esp + 0x3c]
push str.bad_OS_version:__s
call fcn.004055e0
nop word [eax + eax]