Function at 0x405020
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x3b0
mov esi, dword [ebp + 0xc]
mov byte [esp + 0x1f], 0
mov dword [esp + 0xdc], 0
mov dword [esp + 0xd8], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa8], 0
mov dword [0x586564], 0x8000
mov dword [0x58656c], 0x1000000
mov dword [0x586574], 0xf00000
mov dword [0x586578], 0x100
mov dword [0x58657c], 0x800
mov dword [0x586bd0], 0
mov dword [0x586bcc], 0x1100000
lea eax, [esp + 0x22c]
push 0x180
push 0x55b354
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
push str.ANDROID_SERIAL
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov dword [0x586548], eax
xor ecx, ecx
mov dword [esp + 0xe0], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc0], 0
jmp case.0x405162.119
mov byte [0x58654e], 1
mov ecx, ebx
nop
mov ebx, ecx
mov edi, 1
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x230]
push eax
push str.a::hls:S:vw
push esi
push dword [ebp + 8]
call fcn.0046e530
add esp, 0x14
lea edx, [eax - 0x3f]
cmp edx, 0x38
ja case.default.0x405162
mov cl, 1
jmp dword [edx*4 + section..rdata]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x586550
mov eax, dword [0x55f5cc]
push dword [eax]
call fcn.0040ee10
add esp, 0x14
mov ecx, ebx
test al, al
jne case.0x405162.119
jmp 0x40807d
test eax, eax
mov byte [esp + 0xbc], bl
jne 0x405a4d
mov eax, dword [esp + 0xd8]
shl eax, 4
mov esi, dword [esp + eax + 0x22c]
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf8], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x408071
mov ebx, eax
cmp eax, 0xb
jae 0x405254
mov eax, ebx
add al, bl
mov byte [esp + 0xf0], al
lea edi, [esp + 0xf1]
test ebx, ebx
jne 0x40528d
jmp 0x405298
mov eax, dword [0x55f5cc]
mov eax, dword [eax]
mov cl, 1
mov dword [esp + 0xc4], ecx
mov ecx, ebx
test eax, eax
je case.0x405162.119
lea ecx, [esp + 0xa0]
push eax
call fcn.0041e510
mov ecx, ebx
jmp case.0x405162.119
mov eax, dword [0x55f5cc]
mov eax, dword [eax]
mov dword [0x586548], eax
mov ecx, ebx
jmp case.0x405162.119
call fcn.00424090
mov ecx, ebx
jmp case.0x405162.119
mov dword [esp + 0x9c], esi
mov esi, ebx
add esi, 0x10
and esi, 0xfffffff0
push esi
call fcn.0041a1e0
add esp, 4
mov edi, eax
mov dword [esp + 0xf8], eax
or esi, 1
mov dword [esp + 0xf0], esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xf4], ebx
push ebx
push esi
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [edi + ebx], 0
movzx eax, byte [esp + 0xf0]
mov edi, eax
shr edi, 1
mov edx, eax
and dl, 1
mov ecx, dword [esp + 0xf4]
mov esi, ecx
cmove esi, edi
cmp esi, 4
lea ebx, [esp + 0xf0]
jne 0x4052f7
mov ecx, ebx
push 4
push str.base
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405847
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 7
jne 0x405335
mov ecx, ebx
push 7
push str.cmdline
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405864
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0x14
jne 0x405373
mov ecx, ebx
push 0x14
push str.disable_verification
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x40587a
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0xe
jne 0x4053b1
mov ecx, ebx
push 0xe
push str.disable_verity
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405886
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 5
jne 0x4053ef
mov ecx, ebx
push 5
push str.force
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405892
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0xa
jne 0x40542d
mov ecx, ebx
push 0xa
push str.fs_options
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x40589c
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0xe
jne 0x40546b
mov ecx, ebx
push 0xe
push str.header_version
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4058b4
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 3
mov esi, dword [ebp + 0xc]
jne 0x4054ac
mov ecx, ebx
push 3
push 0x55b329
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4058d1
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
cmovne edi, ecx
cmp edi, 0xd
jne 0x4054df
mov ecx, ebx
push 0xd
push str.kernel_offset
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4058e7
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov dh, al
shr dh, 1
mov dl, al
and dl, 1
movzx edi, dh
mov esi, ecx
cmove esi, edi
cmp esi, 0xe
jne 0x405527
mov ecx, ebx
push 0xe
push str.os_patch_level
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405904
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0xa
jne 0x405565
mov ecx, ebx
push 0xa
push str.os_version
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x40591a
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 9
jne 0x4055a3
mov ecx, ebx
push 9
push str.page_size
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405930
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0xe
jne 0x4055e1
mov ecx, ebx
push 0xe
push str.ramdisk_offset
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405956
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov esi, ecx
cmove esi, edi
cmp esi, 0xb
mov esi, dword [ebp + 0xc]
jne 0x405622
mov ecx, ebx
push 0xb
push str.skip_reboot
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405973
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
cmovne edi, ecx
cmp edi, 0xe
jne 0x405655
mov ecx, ebx
push 0xe
push str.skip_secondary
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x40597e
movzx eax, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, eax
shr dl, 1
and al, 1
movzx edx, dl
mov esi, ecx
cmove esi, edx
cmp esi, 4
jne 0x405697
mov ecx, ebx
push 4
push str.slot
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4059b9
movzx edx, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov eax, edx
and al, 1
shr edx, 1
test al, al
mov esi, ecx
cmove esi, edx
cmp esi, 0xa
jne 0x4056d2
mov ecx, ebx
push 0xa
push str.dtb_offset
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4059c5
movzx edx, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov eax, edx
and al, 1
shr edx, 1
test al, al
mov esi, ecx
cmove esi, edx
cmp esi, 0xb
jne 0x40570d
mov ecx, ebx
push 0xb
push str.tags_offset
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4059e9
movzx edx, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov eax, edx
and al, 1
shr edx, 1
test al, al
mov esi, ecx
cmove esi, edx
cmp esi, 0xa
jne 0x405748
mov ecx, ebx
push 0xa
push str.unbuffered
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405a03
movzx edx, byte [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov eax, edx
and al, 1
shr edx, 1
test al, al
cmovne edx, ecx
cmp edx, 7
jne 0x40808e
mov ecx, ebx
push 7
push str.version
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
jne 0x40808e
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov edi, eax
lea eax, [esp + 0x160]
push eax
call fcn.004014f0
add esp, 4
test byte [esp + 0x160], 1
lea eax, [esp + 0x161]
mov esi, dword [ebp + 0xc]
je 0x4057a8
mov eax, dword [esp + 0x168]
push eax
push str.33.0.2
push str.fastboot_version__s__s_n
push edi
call fcn.0040de00
add esp, 0x10
test byte [esp + 0x160], 1
je 0x4057d5
push dword [esp + 0x168]
call fcn.0041a380
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov edi, eax
lea eax, [esp + 0x160]
push eax
call fcn.00423c20
add esp, 4
test byte [esp + 0x160], 1
lea eax, [esp + 0x161]
je 0x40580a
mov eax, dword [esp + 0x168]
push eax
push str.Installed_as__s_n
push edi
call fcn.0040de00
add esp, 0xc
test byte [esp + 0x160], 1
je 0x405832
push dword [esp + 0x168]
call fcn.0041a380
add esp, 4
xor ebx, ebx
test byte [esp + 0xf0], 1
jne 0x405993
jmp 0x4059a2
push 0x10
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x5862e0], eax
jmp 0x405a35
mov ecx, 0x586520
mov eax, dword [0x55f5cc]
push dword [eax]
call fcn.0041e510
jmp 0x405a35
mov byte [0x58654c], 1
jmp 0x405a35
mov byte [0x58654d], 1
jmp 0x405a35
mov byte [esp + 0x1f], 1
jmp 0x405a35
mov eax, dword [0x55f5cc]
push dword [eax]
call 0x4081d0
mov dword [esp + 0xdc], eax
jmp 0x405a35
push 0
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x586580], eax
jmp 0x405a35
mov ecx, 0x58652c
mov eax, dword [0x55f5cc]
push dword [eax]
call fcn.0041e510
jmp 0x405987
push 0x10
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x586564], eax
jmp 0x405987
mov eax, dword [0x55f5cc]
push dword [eax]
push 0x586558
call 0x408460
jmp 0x405a35
mov eax, dword [0x55f5cc]
push dword [eax]
push 0x586558
call 0x408510
jmp 0x405a35
push 0
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x58657c], eax
mov bl, 1
test eax, eax
mov esi, dword [ebp + 0xc]
jne 0x405989
jmp 0x4080b3
push 0x10
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x58656c], eax
jmp 0x405a35
mov al, 1
mov dword [esp + 0xe0], eax
jmp 0x405987
mov al, 1
mov dword [esp + 0xc0], eax
mov bl, 1
test byte [esp + 0xf0], 1
je 0x4059a2
push dword [esp + 0xf8]
call fcn.0041a380
add esp, 4
movzx eax, byte [esp + 0xbc]
mov ecx, eax
test bl, bl
jne case.0x405162.119
jmp 0x407f15
lea ecx, [esp + 0x88]
jmp 0x405869
push 0x10
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x586bcc], eax
mov dword [0x586bd0], 0
jmp 0x405a35
push 0x10
push 0
mov eax, dword [0x55f5cc]
push dword [eax]
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x586578], eax
jmp 0x405a35
push 1
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call esi
add esp, 4
push 0
push 4
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_setvbuf
add esp, 0x10
push 2
call esi
add esp, 4
push 0
push 4
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_setvbuf
add esp, 0x10
mov bl, 1
mov esi, dword [ebp + 0xc]
test byte [esp + 0xf0], 1
jne 0x405993
jmp 0x4059a2
cmp eax, 0xffffffff
jne case.0x405162.64
mov eax, dword [0x55f5d0]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
sub eax, ecx
jne 0x405a76
test bl, bl
jne 0x405a76
cmp byte [esp + 0xc4], 0
je 0x4080a9
lea ebx, [esi + ecx*4]
test eax, eax
jle 0x405aab
mov esi, dword [ebx]
push str.devices
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x405c2e
push str.help
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je case.0x405162.104
call fcn.004087f0
test eax, eax
je case.0x405162.63
mov dword [esp + 0x9c], ebx
xorps xmm0, xmm0
movups xmmword [esp + 0x168], xmm0
movups xmmword [esp + 0x178], xmm0
movups xmmword [esp + 0x188], xmm0
movups xmmword [esp + 0x198], xmm0
mov dword [esp + 0x160], 0x55f3c4
mov dword [esp + 0x164], 0x408b40
lea ecx, [esp + 0x160]
mov dword [esp + 0x170], ecx
lea ecx, [esp + 0x178]
mov dword [esp + 0x178], 0x55f50c
mov dword [esp + 0x17c], 0x408b90
mov dword [esp + 0x188], ecx
lea ecx, [esp + 0x190]
mov dword [esp + 0x190], 0x55f3c4
mov dword [esp + 0x194], 0x408c50
mov dword [esp + 0x1a0], ecx
movaps xmmword [esp + 0x140], xmm0
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
lea ebx, [esp + 0x1e0]
mov dword [esp + 0x1f0], ebx
mov dword [esp + 0x1e0], 0x55f3c4
mov dword [esp + 0x1e4], 0x408b40
lea esi, [esp + 0x1f8]
mov dword [esp + 0x208], esi
mov dword [esp + 0x1f8], 0x55f50c
mov dword [esp + 0x1fc], 0x408b90
lea edi, [esp + 0x210]
mov dword [esp + 0x220], edi
mov dword [esp + 0x210], 0x55f3c4
mov dword [esp + 0x214], 0x408c50
lea ecx, [esp + 0xf0]
push 0
push ebx
push eax
call fcn.004634f0
mov ecx, dword [esp + 0x220]
cmp edi, ecx
je 0x405c42
mov eax, 5
test ecx, ecx
jne 0x405c47
jmp 0x405c4c
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.usage:_fastboot__OPTION...__COMMAND..._n_nflashing:_n_update_ZIP_________________Flash_all_partitions_from_an_update.zip_package._n_flashall___________________Flash_all_partitions_from__ANDROID_PRODUCT_OUT._n____________________________On_A_B_devices__flashed_slot_is_set_as_active._n____________________________Secondary_images_may_be_flashed_to_inactive_slot._n_flash_PARTITION__FILENAME__Flash_given_partition__using_the_image_from_n_____________________________ANDROID_PRODUCT_OUT_if_no_filename_is_given._n_nbasics:_n_devices___l________________List_devices_in_bootloader___l:_with_device_paths_._n_getvar_NAME________________Display_given_bootloader_variable._n_reboot__bootloader_________Reboot_device._n_nlocking_unlocking:_n_flashing_lockunlock_______Lock_unlock_partitions_for_flashing_n_flashing_lock_criticalunlock_critical_n____________________________Lock_unlock_critical_bootloader_partitions._n_flashing_get_unlock_ability_n____________________________Check_whether_unlocking_is_allowed__1__or_not_0_._n_nadvanced:_n_erase_PARTITION____________Erase_a_flash_partition._n_format_:FS_TYPE_:SIZE___PARTITION_n____________________________Format_a_flash_partition._n_set_active_SLOT____________Set_the_active_slot._n_oem__COMMAND...____________Execute_OEM_specific_command._n_gsi_wipedisable___________Wipe_or_disable_a_GSI_installation__fastbootd_only_._n_wipe_super__SUPER_EMPTY____Wipe_the_super_partition._This_will_reset_it_to_n____________________________contain_an_empty_set_of_default_dynamic_partitions._n_create_logical_partition_NAME_SIZE_n____________________________Create_a_logical_partition_with_the_given_name_and_n____________________________size__in_the_super_partition._n_delete_logical_partition_NAME_n____________________________Delete_a_logical_partition_with_the_given_name._n_resize_logical_partition_NAME_SIZE_n____________________________Change_the_size_of_the_named_logical_partition._n_snapshot_update_cancel_____On_devices_that_support_snapshot_based_updates__cancel_n____________________________an_in_progress_update._This_may_make_the_device_n____________________________unbootable_until_it_is_reflashed._n_snapshot_update_merge______On_devices_that_support_snapshot_based_updates__finish_n____________________________an_in_progress_update_if_it_is_in_the__merging__n____________________________phase._n_fetch_PARTITION_OUT_FILE___Fetch_a_partition_image_from_the_device._nboot_image:_n_boot_KERNEL__RAMDISK__SECOND___n____________________________Download_and_boot_kernel_from_RAM._n_flash:raw_PARTITION_KERNEL__RAMDISK__SECOND___n____________________________Create_boot_image_and_flash_it._n___dtb_DTB__________________Specify_path_to_DTB_for_boot_image_header_version_2._n___cmdline_CMDLINE__________Override_kernel_command_line._n___base_ADDRESS_____________Set_kernel_base_address__default:_0x10000000_._n___kernel_offset____________Set_kernel_offset__default:_0x00008000_._n___ramdisk_offset___________Set_ramdisk_offset__default:_0x01000000_._n___tags_offset______________Set_tags_offset__default:_0x00000100_._n___dtb_offset_______________Set_dtb_offset__default:_0x01100000_._n___page_size_BYTES__________Set_flash_page_size__default:_2048_._n___header_version_VERSION___Set_boot_image_header_version._n___os_version_MAJOR_.MINOR_.PATCH___n____________________________Set_boot_image_OS_version__default:_0.0.0_._n___os_patch_level_YYYY_MM_DD_n____________________________Set_boot_image_OS_security_patch_level._n_nAndroid_Things:_n_stage_IN_FILE______________Sends_given_file_to_stage_for_the_next_command._n_get_staged_OUT_FILE________Writes_data_staged_by_the_last_command_to_a_file._n_noptions:_n__w_________________________Wipe_userdata._n__s_SERIAL__________________Specify_a_USB_device._n__s_tcpudp:HOST_:PORT______Specify_a_network_device._n__S_SIZE_KMG______________Break_into_sparse_files_no_larger_than_SIZE._n___force____________________Force_a_flash_operation_that_may_be_unsafe._n___slot_SLOT________________Use_SLOT__all_for_both_slots__other_for_n____________________________non_current_slot__default:_current_active_sl
push eax
call fcn.0040de00
add esp, 8
jmp 0x407f15
push 0
push 0x40b2c0
call fcn.0046ec20
add esp, 8
jmp 0x407f15
mov eax, 4
mov edx, dword [ecx]
call dword [edx + eax*4]
mov ecx, dword [esp + 0x208]
cmp esi, ecx
je 0x405c65
mov eax, 5
test ecx, ecx
mov esi, dword [ebp + 0xc]
jne 0x405c6d
jmp 0x405c72
mov eax, 4
mov esi, dword [ebp + 0xc]
mov edx, dword [ecx]
call dword [edx + eax*4]
mov ecx, dword [esp + 0x1f0]
cmp ebx, ecx
je 0x405c8f
mov eax, 5
test ecx, ecx
mov edi, dword [esp + 0x9c]
jne 0x405c9b
jmp 0x405ca0
mov eax, 4
mov edi, dword [esp + 0x9c]
mov edx, dword [ecx]
call dword [edx + eax*4]
lea eax, [esp + 0xf0]
mov dword [0x586538], eax
call fcn.00423fc0
fstp qword [esp + 0x1c8]
movzx eax, byte [esp + 0x88]
test al, 1
je 0x405ccd
mov eax, dword [esp + 0x8c]
jmp 0x405ccf
shr eax, 1
movsd xmm0, qword [esp + 0x1c8]
movsd qword [esp + 0x1b8], xmm0
test eax, eax
jne 0x405d00
lea ecx, [esp + 0x88]
push 0
push 0x55b100
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405d67
lea ecx, [esp + 0x40]
lea edx, [esp + 0x88]
push 1
call fcn.00408c80
add esp, 4
test byte [esp + 0x88], 1
je 0x405d4d
mov eax, dword [esp + 0x90]
mov byte [eax], 0
mov dword [esp + 0x8c], 0
test byte [esp + 0x88], 1
je 0x405d4d
push dword [esp + 0x90]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 0x90], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0x88], xmm0
movzx eax, byte [esp + 0xa0]
test al, 1
je 0x405d80
mov eax, dword [esp + 0xa4]
test eax, eax
jne 0x405da1
jmp 0x405d86
shr eax, 1
test eax, eax
jne 0x405da1
lea ecx, [esp + 0xa0]
push 0
push 0x55b100
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x405e08
lea ecx, [esp + 0x40]
lea edx, [esp + 0xa0]
push 0
call fcn.00408c80
add esp, 4
test byte [esp + 0xa0], 1
je 0x405dee
mov eax, dword [esp + 0xa8]
mov byte [eax], 0
mov dword [esp + 0xa4], 0
test byte [esp + 0xa0], 1
je 0x405dee
push dword [esp + 0xa8]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 0xa8], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0xa0], xmm0
cmp byte [esp + 0xc4], 0
je 0x405ef5
movzx eax, byte [esp + 0xa0]
test al, 1
je 0x405e2b
mov eax, dword [esp + 0xa4]
jmp 0x405e2d
shr eax, 1
test eax, eax
jne 0x405ef5
lea ecx, [esp + 0xa0]
push 0
push 0x55b100
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
jne 0x405ef5
movzx eax, byte [esp + 0x88]
test al, 1
je 0x405e69
mov eax, dword [esp + 0x8c]
jmp 0x405e6b
shr eax, 1
test eax, eax
jne 0x405e8e
lea ecx, [esp + 0x88]
push 0
push 0x55b100
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x407f55
lea ecx, [esp + 0x40]
lea edx, [esp + 0x88]
push 0
call fcn.00408c80
add esp, 4
test byte [esp + 0xa0], 1
je 0x405edb
mov eax, dword [esp + 0xa8]
mov byte [eax], 0
mov dword [esp + 0xa4], 0
test byte [esp + 0xa0], 1
je 0x405edb
push dword [esp + 0xa8]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 0xa8], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0xa0], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov eax, dword [ebp + 8]
lea eax, [esi + eax*4]
lea ecx, [esp + 0x30]
push eax
push edi
call fcn.0040de20
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x4079e8
lea eax, [esp + 0x11]
mov dword [esp + 0xc8], eax
lea eax, [esp + 1]
mov dword [esp + 0x9c], eax
mov dword [esp + 0xd0], 0
lea esi, [esp + 0x10]
lea edi, [esp + 0x30]
mov ebx, esp
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd4], 0
mov dword [esp + 0x98], 0
jmp 0x405f8e
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x407a14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov ecx, esi
mov edx, edi
call fcn.00408ed0
movzx edx, byte [esp + 0x10]
mov eax, edx
shr eax, 1
and dl, 1
mov ecx, dword [esp + 0x14]
mov edi, ecx
cmove edi, eax
cmp edi, 6
lea esi, [esp + 0x40]
jne 0x405ff9
lea ecx, [esp + 0x10]
push 6
push str.getvar
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x40649b
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
shr eax, 1
test dl, dl
mov edi, ecx
cmove edi, eax
cmp edi, 5
jne 0x406031
lea ecx, [esp + 0x10]
push 5
push str.erase
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406505
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
shr eax, 1
lea edi, [esp + 0x11]
test dl, dl
je 0x40603f
mov edi, dword [esp + 0x18]
mov eax, ecx
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b0], edi
mov dword [esp + 0x1a8], str.format
mov dword [esp + 0x1ac], 6
sub esp, 0x10
movsd xmm0, qword [esp + 0x1b8]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [esp + 0x1c0]
movsd qword [esp], xmm0
call fcn.00462460
add esp, 0x10
test al, al
je 0x406140
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov word [esp + 0x40], 0x3a02
push esi
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00462070
add esp, 0xc
test byte [esp + 0x40], 1
je 0x4060eb
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp]
mov ecx, dword [esp + 4]
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, 1
lea edi, [esp + 0x30]
jbe 0x4064e5
test byte [eax + 0xc], 1
je 0x40656b
mov eax, dword [eax + 0x14]
jmp 0x40656e
movzx eax, byte [esp + 0x10]
mov edi, eax
shr edi, 1
mov edx, eax
and dl, 1
mov ecx, dword [esp + 0x14]
mov ebx, ecx
cmove ebx, edi
cmp ebx, 9
jne 0x40618a
lea ecx, [esp + 0x10]
push 9
push str.signature
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4065c0
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov ebx, ecx
cmove ebx, edi
cmp ebx, 6
jne 0x4061c4
lea ecx, [esp + 0x10]
push 6
push 0x55b5d6
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406775
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov ebx, ecx
cmove ebx, edi
cmp ebx, 0x11
jne 0x4061fe
lea ecx, [esp + 0x10]
push 0x11
push str.reboot_bootloader
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4069d0
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov ebx, ecx
cmove ebx, edi
cmp ebx, 0xf
mov ebx, esp
jne 0x40623a
lea ecx, [esp + 0x10]
push 0xf
push str.reboot_recovery
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4069db
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
cmovne edi, ecx
cmp edi, 0xf
jne 0x406268
lea ecx, [esp + 0x10]
push 0xf
push str.reboot_fastboot
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4069e6
mov al, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dh, al
shr dh, 1
mov dl, al
and dl, 1
movzx edi, dh
mov ebx, ecx
cmove ebx, edi
cmp ebx, 8
jne 0x4062ac
lea ecx, [esp + 0x10]
push 8
push str.continue
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406a04
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov ebx, ecx
cmove ebx, edi
cmp ebx, 4
jne 0x4062e6
lea ecx, [esp + 0x10]
push 4
push str.boot
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406a1f
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov ebx, ecx
cmove ebx, edi
cmp ebx, 5
mov ebx, esp
jne 0x406322
lea ecx, [esp + 0x10]
push 5
push str.flash
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406b2a
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
cmovne edi, ecx
cmp edi, 9
jne 0x406350
lea ecx, [esp + 0x10]
push 9
push str.flash:raw
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406b82
mov al, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dh, al
shr dh, 1
mov dl, al
and dl, 1
movzx edi, dh
mov ebx, ecx
cmove ebx, edi
cmp ebx, 8
jne 0x406394
lea ecx, [esp + 0x10]
push 8
push str.flashall
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406cd6
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
mov ebx, ecx
cmove ebx, edi
cmp ebx, 6
mov ebx, esp
jne 0x4063d0
lea ecx, [esp + 0x10]
push 6
push str.update
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406daf
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
and dl, 1
mov edi, eax
shr edi, 1
test dl, dl
cmovne edi, ecx
cmp edi, 0xa
jne 0x4063fe
lea ecx, [esp + 0x10]
push 0xa
push str.set_active
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x406ee0
mov al, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
shr dl, 1
and al, 1
movzx edx, dl
mov edi, ecx
cmove edi, edx
cmp edi, 5
lea edi, [esp + 0x30]
jne 0x406440
lea ecx, [esp + 0x10]
push 5
push str.stage
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x407000
movzx edx, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, edx
and al, 1
shr edx, 1
test al, al
cmovne edx, ecx
cmp edx, 0xa
jne 0x406466
lea ecx, [esp + 0x10]
push 0xa
push str.get_staged
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4072c1
push 0x55b739
lea esi, [esp + 0x14]
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x406cf2
lea esi, [esp + 0x40]
mov ecx, esi
push 0x55b739
call fcn.0040dd10
mov ecx, esi
mov edx, edi
call fcn.00409840
jmp 0x4064c9
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ecx, esi
lea edi, [esp + 0x30]
mov edx, edi
call fcn.00408ed0
mov ecx, esi
mov edx, esi
call fcn.00408fb0
test byte [esp + 0x40], 1
je 0x4069b0
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
jmp 0x4069b0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0
jmp 0x406882
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
lea edi, [esp + 0x30]
mov edx, edi
call fcn.00408ed0
mov dword [esp + 0x40], 0x55e1a4
mov dword [esp + 0x50], esi
mov ecx, ebx
lea edx, [esp + 0x88]
push 1
push esi
call fcn.004041d0
add esp, 8
mov ecx, dword [esp + 0x50]
cmp esi, ecx
je 0x406754
mov eax, 5
test ecx, ecx
lea esi, [esp + 0x10]
jne 0x40675d
jmp 0x406762
add eax, 0xd
lea ecx, [esp + 0x20]
push eax
call fcn.0041e510
mov eax, dword [esp]
mov ecx, dword [esp + 4]
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0
cmp ecx, 3
jb 0x406882
test byte [eax + 0x18], 1
je 0x406875
mov eax, dword [eax + 0x20]
jmp 0x406878
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ecx, esi
lea edx, [esp + 0x30]
call fcn.00408ed0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ebx, esp
push ebx
push esi
call fcn.004015c0
add esp, 8
test al, al
je 0x4080bd
mov eax, dword [esp + 4]
sub eax, dword [esp]
cmp eax, 0x100
jne 0x4080ca
mov ecx, dword [0x586538]
mov dword [esp + 0x28], 0
mov byte [esp + 0x20], 0x12
lea eax, [esp + 0x21]
mov byte [eax + 8], 0x65
mov dword [eax + 4], 0x72757461
mov dword [eax], 0x6e676973
push 0
push 0
push ebx
lea eax, [esp + 0x2c]
push eax
call fcn.00464480
test byte [esp + 0x20], 1
je 0x40666a
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
mov edi, dword [0x586538]
mov dword [esp + 0x28], 0
mov byte [esp + 0x20], 0x12
lea eax, [esp + 0x21]
mov byte [eax + 8], 0x65
mov dword [eax + 4], 0x72757461
mov dword [eax], 0x6e676973
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0
push 0x20
call fcn.0041a1e0
add esp, 4
mov dword [esp + 0x80], eax
mov dword [esp + 0x78], 0x21
mov dword [esp + 0x7c], 0x14
movupd xmm0, xmmword [str.installing_signature]
movupd xmmword [eax], xmm0
mov dword [eax + 0x10], 0x65727574
mov byte [eax + 0x14], 0
mov ecx, edi
push 0
push 0
push 0
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00463700
test byte [esp + 0x78], 1
je 0x406715
push dword [esp + 0x80]
call fcn.0041a380
add esp, 4
test byte [esp + 0x20], 1
je 0x406728
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
mov eax, dword [esp]
test eax, eax
lea edi, [esp + 0x30]
je 0x406740
mov dword [esp + 4], eax
push eax
call fcn.0041a380
add esp, 4
test byte [esp + 0x40], 1
lea esi, [esp + 0x10]
je 0x4069b4
jmp 0x406ecf
mov eax, 4
lea esi, [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + eax*4]
test byte [esp], 1
je 0x4069b4
push dword [esp + 8]
jmp 0x406ed3
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, ecx
sub edx, eax
mov bl, 1
mov dword [esp + 0x98], ebx
cmp edx, 0xc
jne 0x4069f1
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ecx, esi
lea edx, [esp + 0x30]
call fcn.00408ed0
movzx eax, byte [esp + 0x40]
mov edx, eax
shr edx, 1
mov ebx, eax
and bl, 1
mov ecx, dword [esp + 0x44]
mov edi, ecx
cmove edi, edx
cmp edi, 0xa
jne 0x4067fe
mov ecx, esi
push 0xa
push str.bootloader
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x407127
movzx eax, byte [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebx, eax
and bl, 1
mov edx, eax
shr edx, 1
test bl, bl
cmovne edx, ecx
cmp edx, 8
lea edi, [esp + 0x30]
lea esi, [esp + 0x10]
mov ebx, esp
jne 0x406836
lea ecx, [esp + 0x40]
push 8
push str.recovery
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4073a2
mov al, byte [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov edx, eax
shr dl, 1
and al, 1
movzx edx, dl
cmovne edx, ecx
cmp edx, 8
jne 0x408105
lea ecx, [esp + 0x40]
push 8
push str.fastboot
push 0xffffffffffffffff
push 0
call fcn.0041f610
mov cl, 1
mov dword [esp + 0xd0], ecx
test eax, eax
je 0x4073ab
jmp 0x4080ff
add eax, 0x19
lea ecx, [esp + 0x78]
push eax
call fcn.0041e510
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb8], 0
lea ebx, [esp + 0xb0]
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
mov dword [esp + 0x40], 0x55e2cc
lea eax, [esp + 0x20]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x48], eax
lea eax, [esp + 0xdc]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], esi
mov ecx, ebx
lea edx, [esp + 0x88]
push 1
push esi
call fcn.004041d0
add esp, 8
mov ecx, dword [esp + 0x50]
cmp esi, ecx
je 0x406901
mov eax, 5
test ecx, ecx
jne 0x406906
jmp 0x40690b
mov eax, 4
mov edx, dword [ecx]
call dword [edx + eax*4]
test byte [esp + 0xb0], 1
mov ebx, esp
jne 0x40696c
test byte [esp + 0x78], 1
jne 0x406982
test byte [esp + 0x20], 1
je 0x406931
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
mov edi, dword [esp]
test edi, edi
je 0x4069ac
mov eax, dword [esp + 4]
cmp eax, edi
jne 0x406956
mov eax, edi
jmp 0x40699f
mov eax, ebx
cmp ebx, edi
je 0x40699a
lea ebx, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x406950
push dword [eax - 4]
call fcn.0041a380
add esp, 4
jmp 0x406950
push dword [esp + 0xb8]
call fcn.0041a380
add esp, 4
test byte [esp + 0x78], 1
je 0x40691e
push dword [esp + 0x80]
call fcn.0041a380
add esp, 4
test byte [esp + 0x20], 1
jne 0x406925
jmp 0x406931
mov eax, dword [esp]
mov ebx, esp
mov dword [esp + 4], edi
push eax
call fcn.0041a380
add esp, 4
lea edi, [esp + 0x30]
lea esi, [esp + 0x10]
test byte [esp + 0x10], 1
je 0x405f80
push dword [esp + 0x18]
call fcn.0041a380
add esp, 4
jmp 0x405f80
mov al, 1
mov dword [esp + 0xd4], eax
jmp 0x406a13
mov al, 1
mov dword [esp + 0xcc], eax
jmp 0x4069ac
mov al, 1
mov dword [esp + 0xd0], eax
jmp 0x4069ac
lea edi, [esp + 0x30]
lea esi, [esp + 0x10]
mov ebx, esp
cmp eax, ecx
je 0x4069b4
jmp 0x4080d5
mov ecx, dword [0x586538]
push 0
push 0
call fcn.00463760
lea edi, [esp + 0x30]
lea esi, [esp + 0x10]
mov ebx, esp
jmp 0x4069b4
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ecx, esi
lea edi, [esp + 0x30]
mov edx, edi
call fcn.00408ed0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x406dcb
lea ecx, [esp + 0x20]
mov edx, edi
call fcn.00408ed0
test byte [esp], 1
lea esi, [esp + 0x10]
mov ebx, esp
je 0x406aa1
mov eax, dword [esp + 8]
mov byte [eax], 0
mov dword [esp + 4], 0
test byte [esp], 1
je 0x406aa1
push dword [esp + 8]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
movsd xmm0, qword [esp + 0x20]
movsd qword [esp], xmm0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
cmp eax, dword [esp + 0x34]
je 0x406de9
lea ecx, [esp + 0x78]
mov edx, edi
call fcn.00408ed0
test byte [esp + 0x20], 1
je 0x406b0e
mov eax, dword [esp + 0x28]
mov byte [eax], 0
mov dword [esp + 0x24], 0
test byte [esp + 0x20], 1
je 0x406b0e
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x80]
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x78]
movsd qword [esp + 0x20], xmm0
jmp 0x406de9
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
lea edi, [esp + 0x30]
mov edx, edi
call fcn.00408ed0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x406f3a
mov ecx, esi
mov edx, edi
call fcn.00408ed0
jmp 0x406f43
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
lea edi, [esp + 0x30]
mov edx, edi
call fcn.00408ed0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x20]
mov edx, edi
call fcn.00408ed0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x4071ac
mov ecx, esi
mov edx, edi
call fcn.00408ed0
test byte [esp + 0x78], 1
lea esi, [esp + 0x10]
je 0x406c2e
mov eax, dword [esp + 0x80]
mov byte [eax], 0
mov dword [esp + 0x7c], 0
test byte [esp + 0x78], 1
je 0x406c2e
push dword [esp + 0x80]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 0x80], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0x78], xmm0
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb8], 0
cmp eax, dword [esp + 0x34]
je 0x4071d1
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.00408ed0
test byte [esp + 0xb0], 1
je 0x406cb7
mov eax, dword [esp + 0xb8]
mov byte [eax], 0
mov dword [esp + 0xb4], 0
test byte [esp + 0xb0], 1
je 0x406cb7
push dword [esp + 0xb8]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 0xb8], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0xb0], xmm0
jmp 0x4071d1
movzx eax, byte [esp + 0x88]
test al, 1
je 0x4070c1
mov eax, dword [esp + 0x8c]
jmp 0x4070c3
push str.flashing
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x40713f
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
je 0x408170
sub ecx, eax
cmp ecx, 0xc
lea esi, [esp + 0x10]
jne 0x40817e
push str.unlock
push eax
call fcn.0040dcc0
add esp, 8
test al, al
jne 0x406d91
push str.lock
push dword [esp + 0x34]
call fcn.0040dcc0
add esp, 8
test al, al
jne 0x406d91
push str.unlock_critical
push dword [esp + 0x34]
call fcn.0040dcc0
add esp, 8
test al, al
jne 0x406d91
push str.lock_critical
push dword [esp + 0x34]
call fcn.0040dcc0
add esp, 8
test al, al
jne 0x406d91
push str.get_unlock_ability
push dword [esp + 0x34]
call fcn.0040dcc0
add esp, 8
test al, al
je 0x40817a
lea ecx, [esp + 0x40]
push str.flashing
call fcn.0040dd10
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.00409840
jmp 0x406ec4
movzx eax, byte [esp + 0x88]
test al, 1
je 0x4072f7
mov eax, dword [esp + 0x8c]
jmp 0x4072f9
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
lea esi, [esp + 0x10]
mov ebx, esp
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x80], 0
lea ecx, [esp + 0x78]
lea edx, [esp + 0x40]
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00409110
add esp, 8
mov ecx, dword [0x586538]
mov dword [esp + 0xb8], 0
mov byte [esp + 0xb0], 0x10
mov dword [esp + 0xb1], 0x746f6f62
mov dword [esp + 0xb5], 0x676d692e
push 0
push 0
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0xbc]
push eax
call fcn.00464480
test byte [esp + 0xb0], 1
je 0x406e7b
push dword [esp + 0xb8]
call fcn.0041a380
add esp, 4
mov ecx, dword [0x586538]
push 0
push 0
call fcn.00463640
mov eax, dword [esp + 0x78]
test eax, eax
je 0x406e9f
mov dword [esp + 0x7c], eax
push eax
call fcn.0041a380
add esp, 4
test byte [esp + 0x20], 1
je 0x406eb2
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
test byte [esp], 1
je 0x406ec4
push dword [esp + 8]
call fcn.0041a380
add esp, 4
test byte [esp + 0x40], 1
je 0x4069b4
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
jmp 0x4069b4
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ecx, ebx
lea edi, [esp + 0x30]
mov edx, edi
call fcn.00408ed0
mov ecx, esi
mov edx, ebx
push 0
call fcn.00408c80
add esp, 4
test byte [esp], 1
je 0x406f25
push dword [esp + 8]
call fcn.0041a380
add esp, 4
mov ecx, dword [0x586538]
push 0
push 0
push esi
call fcn.00464280
jmp 0x406740
mov ecx, esi
mov edx, ebx
call fcn.00409460
test byte [esp + 0x20], 1
lea esi, [esp + 0x10]
je 0x406f70
mov eax, dword [esp + 0x28]
mov byte [eax], 0
mov dword [esp + 0x24], 0
test byte [esp + 0x20], 1
je 0x406f70
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0x20], xmm0
movzx eax, byte [esp + 0x20]
test al, 1
je 0x406f93
mov eax, dword [esp + 0x24]
jmp 0x406f95
shr eax, 1
test eax, eax
je 0x40811e
mov dword [esp + 0x40], 0x55e3b4
lea eax, [esp + 0x1f]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x48], eax
lea ebx, [esp + 0x40]
mov dword [esp + 0x50], ebx
mov ecx, esp
lea edx, [esp + 0x88]
push 1
push ebx
call fcn.004041d0
add esp, 8
mov ecx, dword [esp + 0x50]
cmp ebx, ecx
je 0x406fe4
mov eax, 5
test ecx, ecx
jne 0x406fe9
jmp 0x406fee
mov eax, 4
mov edx, dword [ecx]
call dword [edx + eax*4]
test byte [esp + 0x20], 1
mov ebx, esp
je 0x406762
jmp 0x4072b0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
xorpd xmm0, xmm0
movapd xmmword [esp + 0x50], xmm0
movapd xmmword [esp + 0x40], xmm0
mov dword [esp + 0x50], 0xffffffff
test byte [esp], 1
lea ecx, [esp + 1]
je 0x407046
mov ecx, dword [esp + 8]
mov edx, esi
call fcn.00409710
test al, al
je 0x40814e
cmp dword [esp + 0x40], 0
jne 0x40814e
mov ecx, dword [0x586538]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x15c], edi
mov edx, dword [esp + 0x15c]
push 0
push 0
push eax
push edx
push ebx
call fcn.00464550
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [eax]
cmp edi, 0xffffffff
je 0x40709e
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__close
add esp, 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], ebx
test byte [esp], 1
je 0x406a13
push dword [esp + 8]
call fcn.0041a380
add esp, 4
jmp 0x406a13
shr eax, 1
mov ebx, esp
cmp eax, 3
jne 0x4070e9
lea ecx, [esp + 0x88]
push 3
push 0x55b171
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4075bc
xor eax, eax
cmp byte [esp + 0xbc], 0
setne al
mov ecx, dword [esp + 0xc0]
and cl, 1
movzx edi, byte [esp + 0x1f]
movzx edx, cl
lea ecx, [esp + 0x88]
push edi
push eax
call fcn.004095d0
add esp, 8
mov al, 1
mov dword [esp + 0x98], eax
jmp 0x4069ac
mov al, 1
mov dword [esp + 0xd4], eax
lea edi, [esp + 0x30]
lea esi, [esp + 0x10]
mov ebx, esp
jmp 0x4073ab
push str.create_logical_partition
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x407570
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
lea esi, [esp + 0x40]
mov ecx, esi
mov edx, edi
call fcn.00408ed0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
mov ecx, dword [0x586538]
push ebx
push esi
call fcn.00463830
jmp 0x407689
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb8], 0
lea esi, [esp + 0x10]
mov dword [esp + 0x154], 0
mov dword [esp + 0x150], 0
mov dword [esp + 0x158], 0
lea ebx, [esp + 0x150]
mov ecx, ebx
lea edx, [esp + 0x20]
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.00409110
add esp, 8
mov dword [esp + 0x40], 0x55e580
mov dword [esp + 0x44], ebx
lea ebx, [esp + 0x40]
mov dword [esp + 0x50], ebx
mov ecx, esp
lea edx, [esp + 0x88]
push 1
push ebx
call fcn.004041d0
add esp, 8
mov ecx, dword [esp + 0x50]
cmp ebx, ecx
je 0x40724f
mov eax, 5
test ecx, ecx
jne 0x407254
jmp 0x407259
mov eax, 4
mov edx, dword [ecx]
call dword [edx + eax*4]
mov eax, dword [esp + 0x150]
test eax, eax
mov ebx, esp
je 0x407276
mov dword [esp + 0x154], eax
push eax
call fcn.0041a380
add esp, 4
test byte [esp + 0xb0], 1
je 0x40728f
push dword [esp + 0xb8]
call fcn.0041a380
add esp, 4
test byte [esp + 0x78], 1
je 0x4072a5
push dword [esp + 0x80]
call fcn.0041a380
add esp, 4
test byte [esp + 0x20], 1
je 0x406762
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
jmp 0x406762
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ecx, esi
mov edx, edi
call fcn.00408ed0
mov ecx, dword [0x586538]
push 0
push 0
push esi
call fcn.00465b70
jmp 0x4064c9
shr eax, 1
lea edi, [esp + 0x30]
cmp eax, 3
jne 0x407321
lea ecx, [esp + 0x88]
push 3
push 0x55b171
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4075fe
mov dword [esp + 0x98], 0
mov byte [esp], 0x14
lea eax, [esp + 1]
mov word [eax + 8], 0x7069
mov dword [eax + 4], 0x7a2e6574
mov dword [eax], 0x61647075
mov byte [esp + 0xb], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x4073de
mov ecx, esi
mov edx, edi
call fcn.00408ed0
test byte [esp], 1
je 0x40738a
mov eax, dword [esp + 8]
mov byte [eax], 0
mov dword [esp + 4], 0
test byte [esp], 1
je 0x40738a
push dword [esp + 8]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp], xmm0
mov al, byte [esp]
jmp 0x4073e0
mov al, 1
mov dword [esp + 0xcc], eax
test byte [esp + 0x40], 1
je 0x4073be
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x98], 0
cmp eax, ecx
je 0x4069b4
jmp 0x4080d5
mov al, 0x14
lea edi, [esp + 1]
test al, 1
je 0x4073ec
mov edi, dword [esp + 8]
mov bl, byte [esp + 0x1f]
mov dword [esp + 0x78], 0
lea eax, [esp + 0x78]
push eax
push edi
call fcn.0046a7c0
add esp, 8
test eax, eax
jne 0x40812a
mov eax, dword [esp + 0xc0]
mov bh, al
and bh, 1
or bh, byte [esp + 0x98]
lea edi, [esp + 0x44]
xorpd xmm0, xmm0
movupd xmmword [edi + 0x20], xmm0
movupd xmmword [edi + 0x10], xmm0
movupd xmmword [edi], xmm0
mov dword [edi + 0x30], 0
mov eax, dword [esp + 0x78]
mov dword [esp + 0x20], 0x55b9c4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x40], eax
mov ecx, edi
lea eax, [esp + 0x88]
push eax
call fcn.0041d7e0
mov byte [esp + 0x50], bh
mov byte [esp + 0x51], 0
mov byte [esp + 0x52], bl
xorpd xmm0, xmm0
movupd xmmword [edi + 0x20], xmm0
movupd xmmword [edi + 0x10], xmm0
mov dword [edi + 0x30], 0
mov ecx, esi
call fcn.004025c0
push dword [esp + 0x78]
call fcn.0046a9d0
add esp, 4
mov edi, dword [esp + 0x6c]
test edi, edi
mov ebx, esp
je 0x4074df
mov eax, dword [esp + 0x70]
cmp eax, edi
jne 0x4074b6
mov eax, edi
jmp 0x4074d2
mov eax, ebx
cmp ebx, edi
je 0x4074cc
lea ebx, [eax - 0x10]
test byte [eax - 0xc], 1
je 0x4074b0
push dword [eax - 4]
call fcn.0041a380
add esp, 4
jmp 0x4074b0
mov eax, dword [esp + 0x6c]
mov ebx, esp
mov dword [esp + 0x70], edi
push eax
call fcn.0041a380
add esp, 4
mov edi, dword [esp + 0x60]
test edi, edi
je 0x407522
mov eax, dword [esp + 0x64]
cmp eax, edi
jne 0x4074f9
mov eax, edi
jmp 0x407515
mov eax, ebx
cmp ebx, edi
je 0x40750f
lea ebx, [eax - 0x10]
test byte [eax - 0xc], 1
je 0x4074f3
push dword [eax - 4]
call fcn.0041a380
add esp, 4
jmp 0x4074f3
mov eax, dword [esp + 0x60]
mov ebx, esp
mov dword [esp + 0x64], edi
push eax
call fcn.0041a380
add esp, 4
test byte [esp + 0x54], 1
je 0x407535
push dword [esp + 0x5c]
call fcn.0041a380
add esp, 4
test byte [esp + 0x44], 1
lea edi, [esp + 0x30]
je 0x40754c
push dword [esp + 0x4c]
call fcn.0041a380
add esp, 4
test byte [esp], 1
lea esi, [esp + 0x10]
je 0x407562
push dword [esp + 8]
call fcn.0041a380
add esp, 4
mov al, 1
mov dword [esp + 0x98], eax
jmp 0x4069b4
push str.delete_logical_partition
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x407625
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
lea esi, [esp + 0x40]
mov ecx, esi
mov edx, edi
call fcn.00408ed0
mov ecx, dword [0x586538]
push esi
call fcn.004639e0
jmp 0x4064c9
xor ebx, ebx
cmp byte [esp + 0xbc], 0
setne bl
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
push eax
call fcn.0040de00
add esp, 8
movzx eax, byte [esp + 0x1f]
lea ecx, [esp + 0x88]
mov edx, 1
push eax
push ebx
lea ebx, [esp + 8]
jmp 0x407111
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
push eax
call fcn.0040de00
add esp, 8
mov al, 1
mov dword [esp + 0x98], eax
jmp 0x40732c
push str.resize_logical_partition
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x40769c
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
lea esi, [esp + 0x40]
mov ecx, esi
mov edx, edi
call fcn.00408ed0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
mov ecx, dword [0x586538]
push ebx
push esi
call fcn.004640d0
test byte [esp], 1
je 0x406740
push dword [esp + 8]
jmp 0x406738
push 0x55b807
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x40770b
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
lea esi, [esp + 0x40]
mov ecx, esi
mov edx, edi
call fcn.00408ed0
push str.wipe
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x407795
mov edi, dword [0x586538]
mov ecx, ebx
push str.gsi:wipe
call fcn.0040dd10
lea esi, [esp + 0x20]
mov ecx, esi
push str.wiping_GSI
jmp 0x4077c8
push str.wipe_super
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x40780a
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x407903
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
test byte [esp + 0x40], 1
je 0x407779
mov eax, dword [esp + 0x48]
mov byte [eax], 0
mov dword [esp + 0x44], 0
test byte [esp + 0x40], 1
je 0x407779
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
movsd xmm0, qword [esp]
movsd qword [esp + 0x40], xmm0
lea esi, [esp + 0x10]
jmp 0x407975
push str.disable
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x408196
mov edi, dword [0x586538]
mov ecx, ebx
push str.gsi:disable
call fcn.0040dd10
lea esi, [esp + 0x20]
mov ecx, esi
push str.disabling_GSI
call fcn.0040dd10
mov ecx, edi
push 0
push 0
push 0
push esi
push ebx
call fcn.00463700
test byte [esp + 0x20], 1
je 0x4077ef
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
test byte [esp], 1
je 0x407801
push dword [esp + 8]
call fcn.0041a380
add esp, 4
lea edi, [esp + 0x30]
jmp 0x406740
push str.snapshot_update
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x407894
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x40798a
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
test byte [esp + 0x40], 1
je 0x407874
mov eax, dword [esp + 0x48]
mov byte [eax], 0
mov dword [esp + 0x44], 0
test byte [esp + 0x40], 1
je 0x407874
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
movsd xmm0, qword [esp]
movsd qword [esp + 0x40], xmm0
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
mov cl, byte [esp + 0x40]
mov eax, dword [esp + 0x44]
jmp 0x40798e
push str.fetch
push esi
call fcn.0040dcc0
add esp, 8
test al, al
je 0x4081a0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.00408ed0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, ebx
mov edx, edi
call fcn.00408ed0
lea ecx, [esp + 0x40]
lea edx, [esp + 0x88]
push ebx
call fcn.0040a2a0
jmp 0x406eaf
lea esi, [esp + 0x20]
mov ecx, esi
push str.super_empty.img
call fcn.0040dd10
mov ecx, ebx
mov edx, esi
call fcn.00404e00
test byte [esp + 0x40], 1
je 0x407945
mov eax, dword [esp + 0x48]
mov byte [eax], 0
mov dword [esp + 0x44], 0
test byte [esp + 0x40], 1
je 0x407945
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
movsd xmm0, qword [esp]
movsd qword [esp + 0x40], xmm0
test byte [esp + 0x20], 1
je 0x40796b
push dword [esp + 0x28]
call fcn.0041a380
add esp, 4
lea edi, [esp + 0x30]
lea esi, [esp + 0x10]
mov ebx, esp
lea ecx, [esp + 0x40]
lea edx, [esp + 0x88]
call fcn.004099b0
jmp 0x406ec4
xor eax, eax
xor ecx, ecx
mov edx, ecx
shr dl, 1
test cl, 1
movzx ecx, dl
cmovne ecx, eax
test ecx, ecx
je 0x4079cf
push str.cancel
lea eax, [esp + 0x44]
push eax
call fcn.0040ddc0
add esp, 8
test al, al
je 0x4079cf
push str.merge
lea eax, [esp + 0x44]
push eax
call fcn.0040ddc0
add esp, 8
test al, al
jne 0x4081c3
mov ecx, dword [0x586538]
push 0
push 0
lea eax, [esp + 0x48]
push eax
call fcn.00464380
jmp 0x406ec4
mov dword [esp + 0x98], 0
mov dword [esp + 0xd4], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
cmp byte [esp + 0xbc], 0
je 0x407c99
cmp byte [esp + 0x1f], 0
je 0x407a2e
call fcn.004039b0
mov dword [esp + 0x48], 0
mov byte [esp + 0x40], 0x10
mov eax, 0x6174656d
add eax, 0x10f10e08
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], 0x61746164
lea esi, [esp + 0x4c]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov byte [esp + 0x4c], 0xa
mov dword [esp + 0x4d], 0x68636163
mov byte [esp + 0x51], 0x65
lea edi, [esp + 0x58]
mov dword [esp + 0x60], 0
mov byte [esp + 0x58], 0x10
mov dword [esp + 0x59], 0x6174656d
mov dword [esp + 0x5d], 0x61746164
push 0x24
call fcn.0041a1e0
add esp, 4
mov ebx, eax
lea eax, [esp + 0x40]
mov ecx, ebx
push eax
call fcn.0041d7e0
lea ecx, [ebx + 0xc]
mov dword [esp + 0xc0], ecx
push esi
call fcn.0041d7e0
lea ecx, [ebx + 0x18]
mov dword [esp + 0xc8], ecx
push edi
call fcn.0041d7e0
test byte [esp + 0x58], 1
jne 0x407d13
test byte [esp + 0x4c], 1
jne 0x407d2a
test byte [esp + 0x40], 1
je 0x407af9
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
xor esi, esi
mov dword [esp + 0x9c], ebx
jmp 0x407b1c
add esi, 0xc
cmp esi, 0x24
je 0x407c52
lea eax, [ebx + esi]
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ebx, dword [0x586538]
mov dword [esp + 0xbc], eax
push eax
push str.partition_type:
lea edi, [esp + 0x18]
push edi
call fcn.00421fc0
add esp, 0xc
mov ecx, ebx
push 0
lea eax, [esp + 0x44]
push eax
push edi
call fcn.00463ce0
mov ebx, eax
test byte [esp + 0x10], 1
je 0x407b7b
push dword [esp + 0x18]
call fcn.0041a380
add esp, 4
test ebx, ebx
mov ebx, dword [esp + 0x9c]
je 0x407ba0
test byte [esp + 0x40], 1
je 0x407b10
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
jmp 0x407b10
movzx eax, byte [esp + 0x40]
test al, 1
je 0x407bb3
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x407bb9
jmp 0x407b86
shr eax, 1
test eax, eax
je 0x407b86
mov ecx, dword [0x586538]
push 0
push 0
mov edi, dword [esp + 0xc4]
push edi
call fcn.00463ae0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, edi
mov edx, 1
push dword [esp + 0xdc]
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0040a370
add esp, 0x10
test byte [esp], 1
je 0x407c36
push dword [esp + 8]
call fcn.0041a380
add esp, 4
test byte [esp + 0x10], 1
je 0x407b86
push dword [esp + 0x18]
call fcn.0041a380
add esp, 4
jmp 0x407b86
mov eax, dword [esp + 0xc8]
test byte [eax], 1
je 0x407c69
push dword [ebx + 0x20]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0xc0]
test byte [eax], 1
je 0x407c80
push dword [ebx + 0x14]
call fcn.0041a380
add esp, 4
test byte [ebx], 1
je 0x407c90
push dword [ebx + 8]
call fcn.0041a380
add esp, 4
push ebx
call fcn.0041a380
add esp, 4
test byte [esp + 0xc4], 1
je 0x407cba
mov ecx, dword [0x586538]
push 0
push 0
lea eax, [esp + 0xa8]
push eax
call fcn.00464280
test byte [esp + 0x98], 1
je 0x407ce3
mov eax, dword [esp + 0xe0]
and al, 1
jne 0x407ce3
mov ecx, dword [0x586538]
push 0
push 0
call fcn.00463f60
jmp 0x407dde
test byte [esp + 0xd4], 1
jne 0x407d46
test byte [esp + 0xcc], 1
jne 0x407da0
test byte [esp + 0xd0], 1
je 0x407de9
call fcn.00404890
jmp 0x407de9
push dword [esp + 0x60]
call fcn.0041a380
add esp, 4
test byte [esp + 0x4c], 1
je 0x407ae6
push dword [esp + 0x54]
call fcn.0041a380
add esp, 4
test byte [esp + 0x40], 1
jne 0x407aed
jmp 0x407af9
mov ecx, dword [0x586538]
mov byte [esp + 0xe4], 0x14
mov dword [esp + 0xe5], 0x746f6f62
mov dword [esp + 0xe9], 0x64616f6c
mov word [esp + 0xed], 0x7265
mov byte [esp + 0xef], 0
lea eax, [esp + 0xe4]
push 0
push 0
push eax
call fcn.00464020
test byte [esp + 0xe4], 1
je 0x407dde
push dword [esp + 0xec]
jmp 0x407dd6
mov esi, dword [0x586538]
lea edi, [esp + 0x1d4]
mov ecx, edi
push str.recovery
call fcn.0040dd10
mov ecx, esi
push 0
push 0
push edi
call fcn.00464020
test byte [esp + 0x1d4], 1
je 0x407dde
push dword [esp + 0x1dc]
call fcn.0041a380
add esp, 4
mov ecx, dword [0x586538]
call fcn.00466650
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov esi, eax
call fcn.00423fc0
fstp qword [esp + 0x1c0]
movsd xmm0, qword [esp + 0x1c0]
subsd xmm0, qword [esp + 0x1b8]
sub esp, 0x10
mov dword [esp], esi
movsd qword [esp + 8], xmm0
mov dword [esp + 4], str.Finished._Total_time:__.3fs_n
call fcn.0040de00
add esp, 0x10
mov ecx, dword [0x586538]
push 0
call fcn.00466990
test eax, eax
je 0x407e48
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x407e8d
mov eax, dword [esp + 0x34]
cmp eax, esi
jne 0x407e66
mov eax, esi
jmp 0x407e80
mov eax, edi
cmp edi, esi
je 0x407e7c
lea edi, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x407e60
push dword [eax - 4]
call fcn.0041a380
add esp, 4
jmp 0x407e60
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], esi
push eax
call fcn.0041a380
add esp, 4
lea ecx, [esp + 0xf0]
call fcn.004635c0
mov ecx, dword [esp + 0x1a0]
lea eax, [esp + 0x190]
cmp eax, ecx
je 0x407ebd
mov eax, 5
test ecx, ecx
lea esi, [esp + 0x178]
jne 0x407ec9
jmp 0x407ece
mov eax, 4
lea esi, [esp + 0x178]
mov edx, dword [ecx]
call dword [edx + eax*4]
mov ecx, dword [esp + 0x188]
cmp esi, ecx
je 0x407ee4
mov eax, 5
test ecx, ecx
jne 0x407ee9
jmp 0x407eee
mov eax, 4
mov edx, dword [ecx]
call dword [edx + eax*4]
mov ecx, dword [esp + 0x170]
lea eax, [esp + 0x160]
cmp eax, ecx
je 0x407f0b
mov eax, 5
test ecx, ecx
jne 0x407f10
jmp 0x407f15
mov eax, 4
mov edx, dword [ecx]
call dword [edx + eax*4]
xor edi, edi
test byte [esp + 0xa0], 1
je 0x407f30
push dword [esp + 0xa8]
call fcn.0041a380
add esp, 4
test byte [esp + 0x88], 1
je 0x407f49
push dword [esp + 0x90]
call fcn.0041a380
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov ebx, dword [0x586538]
lea edi, [esp + 0x30]
mov ecx, edi
push str.current_slot
call fcn.0040dd10
lea eax, [esp + 0x40]
mov ecx, ebx
push 0
push eax
push edi
call fcn.00463ce0
mov edi, eax
test byte [esp + 0x30], 1
je 0x407fa7
push dword [esp + 0x38]
call fcn.0041a380
add esp, 4
test edi, edi
je 0x407fc2
mov dword [esp + 0xc4], 0
mov edi, dword [esp + 0x9c]
jmp 0x408050
test byte [esp + 0x40], 1
mov edi, dword [esp + 0x9c]
je 0x407fd6
mov eax, dword [esp + 0x48]
jmp 0x407fda
lea eax, [esp + 0x41]
cmp byte [eax], 0x5f
jne 0x407fec
lea ecx, [esp + 0x40]
push 1
push 0
call fcn.0041eb70
lea ecx, [esp + 0x30]
lea edx, [esp + 0x40]
push 0
call fcn.00408c80
add esp, 4
test byte [esp + 0xa0], 1
je 0x408036
mov eax, dword [esp + 0xa8]
mov byte [eax], 0
mov dword [esp + 0xa4], 0
test byte [esp + 0xa0], 1
je 0x408036
push dword [esp + 0xa8]
call fcn.0041a380
add esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp + 0xa8], eax
movsd xmm0, qword [esp + 0x30]
movsd qword [esp + 0xa0], xmm0
test byte [esp + 0x40], 1
je 0x405ef5
push dword [esp + 0x48]
call fcn.0041a380
add esp, 4
jmp 0x405ef5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea ecx, [esp + 0xf0]
call fcn.0041d590
mov eax, dword [0x55f5cc]
push dword [eax]
push str.invalid_sparse_limit__s
call fcn.00424010
mov eax, dword [esp + 0xd8]
shl eax, 4
push dword [esp + eax + 0x22c]
push str.unknown_option__s
call fcn.00424010
push str.no_command
call fcn.00408790
push str.invalid_page_size
call fcn.00424010
test byte [esp + 0x40], 1
je 0x4080df
mov esi, dword [esp + 0x48]
jmp 0x4080e3
push eax
push str.signature_must_be_256_bytes__got__zu_
call fcn.00424010
push str.junk_after_reboot_command
call fcn.00408790
lea esi, [esp + 0x41]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push esi
push str.could_not_load__s:__s
call fcn.00424010
mov al, byte [esp + 0x40]
and al, 1
test al, al
je 0x40810f
mov eax, dword [esp + 0x48]
jmp 0x408113
lea eax, [esp + 0x41]
push eax
push str.unknown_reboot_target__s
call fcn.00408790
test byte [esp], 1
je 0x40813f
mov eax, dword [esp + 8]
jmp 0x408143
push eax
call fcn.0046da70
add esp, 4
push eax
push edi
push str.failed_to_open_zip_file__s:__s
call fcn.00424010
lea eax, [esp + 1]
push eax
push str.cannot_determine_image_filename_for__s
call fcn.00424010
test byte [esp], 1
je 0x40815f
mov eax, dword [esp + 8]
mov dword [esp + 0x9c], eax
push dword [esp + 0x9c]
push str.cannot_load__s
call fcn.00424010
push str.missing_flashing_command
call fcn.00408790
mov eax, dword [esp + 0x30]
test byte [eax], 1
je 0x408188
mov eax, dword [eax + 8]
jmp 0x40818b
add eax, 1
push eax
push str.unknown_flashing_command__s
call fcn.00408790
push str.expected_wipe_or_disable
call fcn.00408790
test byte [esp + 0x10], 1
je 0x4081b2
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc8], eax
push dword [esp + 0xc8]
push str.unknown_command__s
call fcn.00408790
push str.expected:_snapshot_update__cancelmerge_
call fcn.00408790
nop dword [eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
push dword [ebp + 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x408441
mov ebx, eax
cmp eax, 0xb
jae 0x408238
mov eax, ebx
add al, bl
mov byte [esp + 0x10], al
lea esi, [esp + 0x11]
test ebx, ebx
jne 0x40825a
jmp 0x408267
mov edi, ebx
add edi, 0x10
and edi, 0xfffffff0
push edi
call fcn.0041a1e0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], eax
or edi, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
push ebx
push dword [ebp + 8]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [esi + ebx], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov word [esp + 0x28], 0x2c02
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
mov edx, esp
push eax
push ecx
push edx
call fcn.00462070
add esp, 0xc
test byte [esp + 0x28], 1
je 0x4082b2
push dword [esp + 0x30]
call fcn.0041a380
add esp, 4
test byte [esp + 0x10], 1
je 0x4082c5
push dword [esp + 0x18]
call fcn.0041a380
add esp, 4
mov edi, dword [esp]
cmp dword [esp + 4], edi
je 0x40844a
xor ebx, ebx
xor edx, edx
xor esi, esi
jmp 0x40830b
mov ecx, 1
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
or esi, ecx
add edx, 1
mov edi, dword [esp]
mov eax, dword [esp + 4]
mov ecx, eax
sub ecx, edi
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
add ebx, 0xc
cmp edx, ecx
jae 0x4083cc
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], esi
movzx eax, byte [edi + ebx]
mov ecx, eax
shr ecx, 1
and al, 1
mov esi, dword [edi + ebx + 4]
mov edx, esi
cmove edx, ecx
cmp edx, 8
jne 0x408354
add edi, ebx
mov ecx, edi
push 8
push 0x55b98a
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4082da
mov edi, dword [esp]
movzx ecx, byte [edi + ebx]
mov esi, dword [edi + ebx + 4]
mov eax, ecx
and al, 1
shr ecx, 1
test al, al
mov edx, esi
cmove edx, ecx
cmp edx, 6
jne 0x408389
add edi, ebx
mov ecx, edi
push 6
push str.projid
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x4083c2
mov edi, dword [esp]
movzx ecx, byte [edi + ebx]
mov esi, dword [edi + ebx + 4]
mov eax, ecx
and al, 1
shr ecx, 1
test al, al
cmovne ecx, esi
cmp ecx, 8
jne 0x408426
add edi, ebx
mov ecx, edi
push 8
push str.compress
push 0xffffffffffffffff
push 0
call fcn.0041f610
mov ecx, 4
test eax, eax
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
je 0x4082e7
jmp 0x40841e
mov ecx, 2
jmp 0x4082df
test edi, edi
je 0x408412
cmp eax, edi
je 0x408403
mov ebx, esi
jmp 0x4083e6
mov eax, esi
cmp esi, edi
je 0x4083fc
lea esi, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x4083e0
push dword [eax - 4]
call fcn.0041a380
add esp, 4
jmp 0x4083e0
mov eax, dword [esp]
mov esi, ebx
jmp 0x408405
mov eax, edi
mov dword [esp + 4], edi
push eax
call fcn.0041a380
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edi, dword [esp]
mov al, byte [edi + ebx]
and al, 1
test al, al
je 0x408430
mov eax, dword [edi + ebx + 8]
jmp 0x408436
lea eax, [edi + ebx]
add eax, 1
push eax
push str.unsupported_options:__s
call fcn.00408790
lea ecx, [esp + 0x10]
call fcn.0041d590
push dword [ebp + 8]
push str.bad_options:__s
call fcn.00408790
nop word [eax + eax]
push esi
sub esp, 0xc
mov esi, dword [esp + 0x18]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
lea edx, [esp + 4]
push eax
push ecx
push edx
push str._u__u__u
push esi
call fcn.0040df40
add esp, 0x14
cmp eax, 3
jne 0x4084e3
mov eax, dword [esp + 4]
lea ecx, [eax - 0x850]
cmp ecx, 0xffffff7f
jbe 0x4084ee
mov ecx, dword [esp]
lea edx, [ecx - 0xd]
cmp edx, 0xfffffff3
jbe 0x4084f9
mov edx, dword [esp + 0x14]
mov esi, 0xfffff800
and esi, dword [edx + 0x2c]
shl eax, 4
add eax, 0x300
and eax, 0x7f0
or eax, ecx
or eax, esi
mov dword [edx + 0x2c], eax
add esp, 0xc
pop esi
ret 8
push esi
push str.OS_patch_level_should_be_YYYY_MM_DD:__s
call fcn.00408790
push eax
push str.year_out_of_range:__d
call fcn.00408790
push ecx
push str.month_out_of_range:__d
call fcn.00408790
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x408781
mov ebx, eax
cmp eax, 0xb
jae 0x408591
mov eax, ebx
add al, bl
mov byte [esp + 0x10], al
lea esi, [esp + 0x11]
test ebx, ebx
jne 0x4085b8
jmp 0x4085c3
mov edi, ebx
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
call fcn.0041a1e0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], eax
or ebx, 1
mov dword [esp + 0x10], ebx
mov ebx, edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], ebx
push ebx
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [esi + ebx], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov word [esp + 0x28], 0x2e02
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
mov edx, esp
push eax
push ecx
push edx
call fcn.00462070
add esp, 0xc
test byte [esp + 0x28], 1
je 0x40860e
push dword [esp + 0x30]
call fcn.0041a380
add esp, 4
test byte [esp + 0x10], 1
je 0x408621
push dword [esp + 0x18]
call fcn.0041a380
add esp, 4
mov eax, dword [esp]
mov ecx, dword [esp + 4]
sub ecx, eax
je 0x408776
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, 3
ja 0x408776
test byte [eax], 1
je 0x40864c
mov eax, dword [eax + 8]
jmp 0x40864f
add eax, 1
lea ecx, [esp + 0x1c]
push 0
push 0xffffffffffffffff
push ecx
push eax
call fcn.00419ed0
add esp, 0x10
test al, al
je 0x408776
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, ecx
sub edx, eax
sar edx, 2
imul edx, edx, 0xaaaaaaab
cmp edx, 2
jb 0x4086b1
test byte [eax + 0xc], 1
je 0x40868d
mov eax, dword [eax + 0x14]
jmp 0x408690
add eax, 0xd
lea ecx, [esp + 0x24]
push 0
push 0xffffffffffffffff
push ecx
push eax
call fcn.00419ed0
add esp, 0x10
test al, al
je 0x408776
mov eax, dword [esp]
mov ecx, dword [esp + 4]
sub ecx, eax
cmp ecx, 0x24
jne 0x4086e0
test byte [eax + 0x18], 1
je 0x4086c3
mov eax, dword [eax + 0x20]
jmp 0x4086c6
add eax, 0x19
lea ecx, [esp + 0x20]
push 0
push 0xffffffffffffffff
push ecx
push eax
call fcn.00419ed0
add esp, 0x10
test al, al
je 0x408776
mov eax, dword [esp + 0x1c]
cmp eax, 0x7f
ja 0x408776
mov ecx, dword [esp + 0x24]
cmp ecx, 0x7f
ja 0x408776
mov edx, dword [esp + 0x20]
cmp edx, 0x80
jae 0x408776
mov esi, dword [ebp + 8]
mov edi, 0x7ff
and edi, dword [esi + 0x2c]
shl eax, 0x19
and ecx, 0x7f
shl ecx, 0x12
or ecx, eax
and edx, 0x7f
shl edx, 0xb
or edx, ecx
or edx, edi
mov dword [esi + 0x2c], edx
mov esi, dword [esp]
test esi, esi
je 0x40876c
mov eax, dword [esp + 4]
cmp eax, esi
jne 0x408746
mov eax, esi
jmp 0x40875f
mov eax, edi
cmp edi, esi
je 0x40875c
lea edi, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x408740
push dword [eax - 4]
call fcn.0041a380
add esp, 4
jmp 0x408740
mov eax, dword [esp]
mov dword [esp + 4], esi
push eax
call fcn.0041a380
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push edi
push str.bad_OS_version:__s
call fcn.00408790
lea ecx, [esp + 0x10]
call fcn.0041d590
nop word [eax + eax]