Function at 0x407550
Capabilities:
Create directory
Delete file
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xd74
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0xd70], eax
push ebx
mov ebx, ecx
mov dword [esp + 0x44], 0
mov dword [esp + 0x60], ebx
push esi
push edi
test ebx, ebx
je 0x40a32f
mov ecx, dword [ebx]
mov eax, ecx
and eax, 0x108
cmp eax, 0x108
jne 0x40759d
push str.ERROR:_FLAG_LATEST_cannot_be_used_with_FLAG_CUSTOM._n
jmp 0x40a327
cmp dword [ebx + 0x30], 0
jne 0x4075b5
test ecx, 0x120
jne 0x4075b5
push str.ERROR:_no_ipsw_file_given_n
jmp 0x40a327
test cl, 2
je 0x4075da
push 1
call dword [sym.imp.imobiledevice.dll_idevice_set_debug_level]
add esp, 4
push 1
call dword [sym.imp.irecovery.dll_irecv_set_debug_level]
add esp, 4
mov dword [0x42c738], 1
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4075f6
push dword [ebx + 0x70]
xorps xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push 0
call eax
add esp, 0x10
push ebx
lea eax, [ebx + 0x74]
push 0x407370
push eax
call dword [sym.imp.irecovery.dll_irecv_device_event_subscribe]
add esp, 0xc
push ebx
push 0x407200
call dword [sym.imp.imobiledevice.dll_idevice_event_subscribe]
add esp, 8
mov dword [ebx + 0x78], 0x407200
lea esi, [ebx + 0x7c]
mov dword [esp + 0x54], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call edi
push 0x2710
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x4c]
mov ecx, 0x42c018
sub ecx, 8
mov dword [esp + 0x50], ecx
cmp eax, ecx
je 0x40a31f
test byte [ebx], 1
jne 0x40a31f
mov ecx, dword [ebx + 0x6c]
test ecx, ecx
je 0x40768b
push dword [ebx + 0x70]
movsd xmm0, qword [0x429960]
sub esp, 8
movsd qword [esp], xmm0
push 0
call ecx
mov eax, dword [ebx + 0x4c]
add esp, 0x10
push dword [eax + 4]
push str.Found_device_in__s_mode_n
call fcn.00403550
add esp, 8
push esi
call edi
mov eax, dword [ebx + 0x4c]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [sym.imp.irecovery.dll_irecv_close]
cmp dword [eax], 0
jne 0x4079d0
mov ecx, ebx
call fcn.00404530
test eax, eax
je 0x4076cb
push str.ERROR:_Could_not_open_device_in_WTF_mode_n
jmp 0x40a327
cmp dword [ebx + 0x38], 0
jne 0x4076e0
mov ecx, ebx
call fcn.00404530
test eax, eax
js 0x4079f9
mov eax, dword [ebx + 0x38]
push dword [eax]
call dword [sym.imp.irecovery.dll_irecv_get_device_info]
add esp, 4
test eax, eax
je 0x4079f9
mov eax, dword [eax]
test eax, eax
je 0x4079f9
push eax
lea eax, [esp + 0x17c]
push str.Firmware_dfu_WTF.s5l_04xxall.RELEASE.dfu
push eax
call fcn.00406ee0
mov ecx, dword [ebx + 0x30]
lea eax, [esp + 0x68]
add esp, 0xc
mov dword [esp + 0x48], 0
lea edx, [esp + 0x178]
mov dword [esp + 0x5c], 0
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0040f330
mov edi, dword [esp + 0x50]
add esp, 8
test edi, edi
jne 0x407904
mov ecx, ebx
call fcn.00406f50
push str.FirmwareURL
push 0x420eb0
push str.304218112
push 0x41ea2c
push str.RecoverySoftwareVersions
push 0x420eb0
push str.MobileDeviceSoftwareVersionsByVersion
push 7
push dword [ebx + 0xc]
mov dword [esp + 0x84], edi
call dword [sym.imp.plist.dll_plist_access_path]
mov esi, eax
add esp, 0x24
test esi, esi
je 0x4077b1
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 3
jne 0x4077b1
lea eax, [esp + 0x60]
push eax
push esi
call dword [sym.imp.plist.dll_plist_get_string_val]
add esp, 8
mov eax, dword [esp + 0x60]
test eax, eax
jne 0x4077d8
push str.Using_hardcoded_x12220000_5_Recovery.ipsw_URL_n
call fcn.00403550
add esp, 4
push str.http:__appldnld.apple.com.edgesuite.net_content.info.apple.com_iPhone_061_6618.20090617.Xse7Y_x12220000_5_Recovery.ipsw
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x60], eax
push 0x2f
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4077f1
mov esi, str.x12220000_5_Recovery.ipsw
jmp 0x4077f2
inc esi
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x407886
lea ecx, [esp + 0xb8]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jns 0x40781b
mov ecx, dword [ebx + 0x60]
call fcn.00403860
mov ecx, dword [ebx + 0x60]
lea edx, [esp + 0x978]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x407827
lea edi, [esp + 0x978]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x407840
mov ax, word [0x41e584]
mov edx, esi
mov word [edi], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x407855
lea edi, [esp + 0x978]
sub esi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407866
mov ecx, esi
mov dword [esp + 0x6c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x6c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40789d
lea ecx, [esp + 0x978]
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x407890
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x97c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
je 0x4078cf
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x978]
push 0
call fcn.004050b0
add esp, 4
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x4c]
push eax
lea edx, [esp + 0x180]
lea ecx, [esp + 0x980]
call fcn.0040f330
mov edi, dword [esp + 0x50]
add esp, 8
test edi, edi
jne 0x407904
push str.ERROR:_Could_not_extract_WTF_n
call fcn.004035a0
add esp, 4
lea esi, [ebx + 0x7c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x40795c
mov esi, dword [esp + 0x5c]
push esi
push str.Sending_data___d_bytes_..._n
call fcn.00403550
mov eax, dword [ebx + 0x38]
push 1
push esi
push edi
push dword [eax]
call dword [sym.imp.irecovery.dll_irecv_send_buffer]
add esp, 0x18
test eax, eax
je 0x407959
push eax
call dword [sym.imp.irecovery.dll_irecv_strerror]
add esp, 4
push eax
push str.ERROR:_Unable_to_send_data:__s_n
call fcn.004035a0
push str.ERROR:_Could_not_send_WTF..._n
call fcn.004035a0
add esp, 0xc
lea esi, [ebx + 0x7c]
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x40798a
mov ecx, dword [eax]
test ecx, ecx
je 0x40797f
push ecx
call dword [sym.imp.irecovery.dll_irecv_close]
mov eax, dword [ebx + 0x38]
add esp, 4
mov dword [eax], 0
mov eax, dword [ebx + 0x38]
push eax
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call eax
add esp, 4
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [ebx + 0x38], 0
call edi
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2710
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x4c], 0x42c020
jne 0x4079e8
test byte [ebx], 1
jne 0x4079e8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.irecovery.dll_irecv_close]
mov ecx, ebx
call fcn.0040a930
mov dword [ebx + 0x44], eax
test eax, eax
jne 0x407a52
push str.ERROR:_Unable_to_discover_device_type_n
jmp 0x40a327
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ERROR:_Failed_to_put_device_into_DFU_from_WTF_mode_n
jmp 0x40a327
push str.ERROR:_Could_not_get_CPID_for_WTF_mode_device_n
call fcn.004035a0
mov eax, dword [ebx + 0x38]
add esp, 4
test eax, eax
je 0x407a33
mov ecx, dword [eax]
test ecx, ecx
je 0x407a29
push ecx
call dword [sym.imp.irecovery.dll_irecv_close]
mov eax, dword [ebx + 0x38]
add esp, 4
mov dword [eax], 0
mov eax, dword [ebx + 0x38]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebx + 0x38], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x6c]
test ecx, ecx
je 0x407a76
push dword [ebx + 0x70]
movsd xmm0, qword [0x429968]
sub esp, 8
movsd qword [esp], xmm0
push 0
call ecx
mov eax, dword [ebx + 0x44]
add esp, 0x10
push dword [eax]
push dword [eax + 4]
push str.Identified_device_as__s___s_n
call fcn.00403550
mov eax, dword [ebx]
add esp, 0xc
test al, 0x20
je 0x407ba9
mov eax, dword [ebx + 0x4c]
cmp dword [eax], 1
je 0x407aa4
push str.ERROR:_you_need_to_put_your_device_into_DFU_mode_to_pwn_it._n
jmp 0x40a327
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x407ad0
mov ecx, dword [eax]
test ecx, ecx
je 0x407ac3
push ecx
call esi
mov eax, dword [ebx + 0x40]
add esp, 4
mov dword [eax], 0
mov eax, dword [ebx + 0x40]
push eax
call edi
add esp, 4
mov dword [ebx + 0x40], 0
mov eax, dword [ebx + 0x4c]
cmp dword [eax], 1
je 0x407ae2
push str.ERROR:_Device_needs_to_be_in_DFU_mode_for_this_option._n
jmp 0x40a327
push str.connecting_to_DFU_n
call fcn.00403550
add esp, 4
mov ecx, ebx
call fcn.00404530
test eax, eax
js 0x40a32f
push str.exploiting_with_limera1n..._n
call fcn.00403550
mov edx, dword [ebx + 0x38]
add esp, 4
mov ecx, dword [ebx + 0x44]
call fcn.00410a50
test eax, eax
je 0x407b59
push str.ERROR:_limera1n_exploit_failed_n
call fcn.004035a0
mov eax, dword [ebx + 0x38]
add esp, 4
test eax, eax
je 0x407a33
mov ecx, dword [eax]
test ecx, ecx
je 0x407b4a
push ecx
call esi
mov eax, dword [ebx + 0x38]
add esp, 4
mov dword [eax], 0
mov eax, dword [ebx + 0x38]
push eax
call edi
mov dword [ebx + 0x38], 0
jmp 0x40a32c
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x407b7e
mov ecx, dword [eax]
test ecx, ecx
je 0x407b78
push ecx
call esi
mov eax, dword [ebx + 0x38]
add esp, 4
mov dword [eax], 0
mov eax, dword [ebx + 0x38]
push eax
call edi
add esp, 4
push str.Device_should_be_in_pwned_DFU_state_now._n
mov dword [ebx + 0x38], 0
call fcn.00403550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
test eax, 0x100
je 0x407fb1
mov ecx, dword [ebx + 0x44]
lea edx, [esp + 0x48]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx]
call fcn.0040f6e0
mov esi, eax
test esi, esi
jns 0x407bfc
push str.ERROR:_Could_not_fetch_list_of_signed_firmwares._n
call fcn.004035a0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x48]
push edi
call dword [sym.imp.plist.dll_plist_array_get_size]
mov esi, eax
add esp, 4
mov dword [esp + 0x70], esi
test esi, esi
jne 0x407c48
push edi
call dword [sym.imp.plist.dll_plist_free]
mov eax, dword [ebx + 0x44]
add esp, 4
push dword [eax]
push str.ERROR:_No_firmwares_are_currently_being_signed_for__s__REALLY____n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
test dword [ebx], 0x200
je 0x407de4
mov eax, dword [ebx + 0x44]
push dword [eax]
push str.The_following_firmwares_are_currently_being_signed_for__s:_n
call fcn.00403550
add esp, 8
test esi, esi
je 0x407d05
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.plist.dll_plist_array_get_item]
mov esi, eax
push str.version
push esi
call dword [sym.imp.plist.dll_plist_dict_get_item]
push str.buildid
push esi
mov edi, eax
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
mov dword [esp + 0x78], 0
lea eax, [esp + 0x78]
mov dword [esp + 0x74], 0
push eax
push edi
mov edi, dword [sym.imp.plist.dll_plist_get_string_val]
call edi
lea eax, [esp + 0x7c]
push eax
push esi
call edi
push dword [esp + 0x84]
inc ebx
push dword [esp + 0x8c]
push ebx
push str.____d___s__build__s__n
call fcn.00403550
push dword [esp + 0x98]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
add esp, 0x3c
push dword [esp + 0x5c]
call esi
mov esi, dword [esp + 0x74]
add esp, 4
mov edi, dword [esp + 0x48]
cmp ebx, esi
jb 0x407c70
mov ebx, dword [esp + 0x68]
push str.Select_the_firmware_you_want_to_restore:
call fcn.00406ea0
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea ecx, [esp + 0xbc]
call fcn.00404090
add esp, 4
cmp byte [esp + 0xb8], 0
je 0x407e12
test byte [ebx], 1
jne 0x40a32f
push 0xa
lea eax, [esp + 0xbc]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
add esp, 0xc
test eax, eax
je 0x407d7c
cmp eax, esi
jbe 0x407de0
push esi
push str.Invalid_input_value._Must_be_in_range:_1.._u_n
call fcn.00406ea0
push str.Select_the_firmware_you_want_to_restore:
call fcn.00406ea0
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea ecx, [esp + 0xbc]
call fcn.00404090
add esp, 4
cmp byte [esp + 0xb8], 0
jne 0x407d56
push edi
call dword [sym.imp.plist.dll_plist_free]
jmp 0x40a32c
dec eax
push eax
jmp 0x407df3
push str.NOTE:_Running_non_interactively__automatically_selecting_latest_available_version_n
call fcn.00403550
add esp, 4
push 0
push edi
call dword [sym.imp.plist.dll_plist_array_get_item]
add esp, 8
mov dword [esp + 0x44], eax
test eax, eax
jne 0x407e1e
push str.ERROR:_failed_to_select_latest_firmware___n
call fcn.004035a0
add esp, 4
push edi
call dword [sym.imp.plist.dll_plist_free]
jmp 0x40a32c
mov edi, dword [sym.imp.plist.dll_plist_dict_get_item]
push str.version
push eax
call edi
push str.buildid
push dword [esp + 0x50]
mov esi, eax
call edi
mov edi, eax
mov dword [esp + 0x70], 0
lea eax, [esp + 0x70]
mov dword [esp + 0x6c], 0
push eax
push esi
mov esi, dword [sym.imp.plist.dll_plist_get_string_val]
call esi
lea eax, [esp + 0x74]
push eax
push edi
call esi
push dword [esp + 0x7c]
push dword [esp + 0x84]
push str.Selected_firmware__s__build__s__n
call fcn.00403550
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x2c
push dword [esp + 0x60]
call esi
add esp, 4
push dword [esp + 0x5c]
call esi
mov edi, dword [esp + 0x48]
add esp, 4
push 0x42135c
push edi
call dword [sym.imp.plist.dll_plist_dict_get_item]
push str.sha1sum
push edi
mov esi, eax
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov edi, eax
mov dword [esp + 0x68], 0
lea eax, [esp + 0x7c]
push eax
push esi
mov esi, dword [sym.imp.plist.dll_plist_get_string_val]
call esi
lea eax, [esp + 0x70]
push eax
push edi
call esi
mov edx, dword [esp + 0x78]
add esp, 0x20
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407ee0
sub ecx, esi
cmp ecx, 0x28
jne 0x407f34
xor esi, esi
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
push eax
lea eax, [esi + edx]
push str._02x
push eax
call fcn.00406f20
mov al, byte [esp + 0x7c]
mov ecx, esi
shr ecx, 1
add esi, 2
add esp, 0xc
mov byte [esp + ecx + 0xb8], al
cmp esi, 0x28
jge 0x407f2b
mov edx, dword [esp + 0x58]
jmp 0x407ef0
lea esi, [esp + 0xb8]
jmp 0x407f43
push str.ERROR:_unexpected_size_of_sha1sum_n
call fcn.004035a0
add esp, 4
xor esi, esi
push dword [esp + 0x48]
call dword [sym.imp.plist.dll_plist_free]
mov ecx, dword [esp + 0x70]
add esp, 4
test ecx, ecx
je 0x408018
test esi, esi
je 0x408018
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0
push eax
push dword [ebx + 0x60]
mov edx, esi
call fcn.0040fae0
mov esi, eax
add esp, 8
mov eax, dword [esp + 0x60]
test esi, esi
je 0x407fae
test eax, eax
je 0x407f97
push eax
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call eax
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x407fd2
push dword [ebx + 0x70]
movsd xmm0, qword [0x429988]
sub esp, 8
movsd qword [esp], xmm0
push 0
call eax
add esp, 0x10
mov ecx, dword [ebx]
test cl, 0x40
jne 0x407b92
mov eax, dword [ebx + 0x4c]
cmp dword [eax], 3
jne 0x40810a
test ecx, 0x400
je 0x408022
cmp dword [ebx + 0x64], 0
jne 0x40810a
push 0x41fe42
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], 0
jmp 0x40810a
push str.ERROR:_Missing_firmware_URL_or_SHA1_n
jmp 0x40a327
cmp dword [ebx + 0x3c], 0
jne 0x408042
mov ecx, ebx
call fcn.004130d0
test eax, eax
jns 0x408042
push str.ERROR:_Unable_to_open_device_in_restore_mode_n
call fcn.004035a0
add esp, 4
jmp 0x40809d
lea esi, [ebx + 0x7c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.Rebooting_restore_mode_device..._n
call fcn.00403550
mov eax, dword [ebx + 0x3c]
add esp, 4
push dword [eax + 0x20]
call dword [sym.imp.imobiledevice.dll_restored_reboot]
mov eax, dword [ebx + 0x3c]
add esp, 4
push dword [eax + 0x20]
call dword [sym.imp.imobiledevice.dll_restored_client_free]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 4
push esi
call edi
push 0x7530
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x4c], 0x42c030
push esi
jne 0x4080c4
call edi
push str.ERROR:_Unable_to_exit_restore_mode_n
call fcn.004035a0
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
call edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call edi
push 0xea60
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x4c]
cmp eax, dword [esp + 0x50]
je 0x40a31f
test byte [ebx], 1
jne 0x40a31f
push dword [eax + 4]
push str.Found_device_in__s_mode_n
call fcn.00403550
add esp, 8
push esi
call edi
push 0
push dword [ebx + 0x30]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
add esp, 8
test eax, eax
jns 0x408144
push dword [ebx + 0x30]
push str.ERROR:_Firmware_file__s_does_not_exist._n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
test byte [ebx], 8
mov dword [esp + 0x64], 0
je 0x4081e4
push str.Extracting_Restore.plist_from_IPSW_n
call fcn.00403550
mov ecx, dword [ebx + 0x30]
lea eax, [esp + 0x70]
add esp, 4
mov dword [esp + 0x6c], 0
mov edx, str.Restore.plist
mov dword [esp + 0x70], 0
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0040f330
add esp, 8
test eax, eax
jne 0x4081bc
mov esi, dword [esp + 0x70]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x70]
push esi
call dword [sym.imp.plist.dll_plist_from_xml]
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
push esi
call eax
mov dword [esp + 0x4c], 0
jmp 0x40828f
push dword [ebx + 0x30]
push str.ERROR:_Unable_to_extract_Restore.plist_from__s._Firmware_file_might_be_corrupt._n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push str.Extracting_BuildManifest_from_IPSW_n
call fcn.00403550
mov esi, dword [ebx + 0x30]
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 0
mov edx, str.BuildManifesto.plist
mov dword [esp + 0x44], 0
mov ecx, esi
mov dword [esp + 0x48], eax
call fcn.0040f270
test eax, eax
je 0x408237
lea eax, [esp + 0x5c]
mov edx, str.BuildManifesto.plist
push eax
lea eax, [esp + 0x48]
mov ecx, esi
push eax
call fcn.0040f330
add esp, 8
test eax, eax
je 0x408270
lea eax, [esp + 0x5c]
mov dword [esp + 0x44], 0
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x60], 0
push eax
mov edx, str.BuildManifest.plist
mov ecx, esi
call fcn.0040f330
add esp, 8
test eax, eax
jne 0x40a2f7
mov dword [esp + 0x48], 1
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x60]
push esi
call dword [sym.imp.plist.dll_plist_from_xml]
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
push esi
call eax
mov eax, dword [ebx + 0x6c]
add esp, 4
test eax, eax
je 0x4082b3
push dword [ebx + 0x70]
movsd xmm0, qword [0x429998]
sub esp, 8
movsd qword [esp], xmm0
push 0
call eax
add esp, 0x10
mov eax, dword [ebx + 0x44]
push str.SupportedProductTypes
push dword [esp + 0x68]
mov eax, dword [eax]
mov dword [esp + 0x78], eax
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
add esp, 8
mov dword [esp + 0x5c], esi
test esi, esi
je 0x40a2c0
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 4
jne 0x40a2c0
push esi
call dword [sym.imp.plist.dll_plist_array_get_size]
add esp, 4
mov dword [esp + 0x60], eax
xor edi, edi
test eax, eax
je 0x40a2f0
push edi
push esi
call dword [sym.imp.plist.dll_plist_array_get_item]
mov esi, eax
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 0xc
cmp eax, 3
jne 0x40836e
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], 0
push eax
push esi
call dword [sym.imp.plist.dll_plist_get_string_val]
mov esi, dword [esp + 0x74]
add esp, 8
test esi, esi
je 0x40836e
mov ecx, dword [esp + 0x70]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408365
test dl, dl
je 0x408361
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408365
add eax, 2
add ecx, 2
test dl, dl
jne 0x408345
xor eax, eax
jmp 0x40836a
sbb eax, eax
or eax, 1
test eax, eax
je 0x40837f
inc edi
cmp edi, dword [esp + 0x60]
jae 0x40a2f0
mov esi, dword [esp + 0x5c]
jmp 0x408307
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [esp + 0x68]
lea esi, [ebx + 0x54]
add esp, 4
mov dword [esp + 0x6c], eax
mov dword [ebx + 0x50], 0
mov dword [esi], 0
push str.ProductVersion
push eax
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov edi, eax
add esp, 8
test edi, edi
je 0x40841a
push edi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 3
jne 0x40841a
lea ecx, [ebx + 0x50]
push ecx
push edi
call dword [sym.imp.plist.dll_plist_get_string_val]
push str.ProductBuildVersion
push dword [esp + 0x78]
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x408413
push edi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 3
jne 0x408413
push esi
push edi
call dword [sym.imp.plist.dll_plist_get_string_val]
push 0xa
push 0
push dword [esi]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
add esp, 0x14
mov dword [ebx + 0x58], eax
jmp 0x408427
push str.ERROR:_Unable_to_find_ProductBuildVersion_node_n
jmp 0x40841f
push str.ERROR:_Unable_to_find_ProductVersion_node_n
call fcn.004035a0
add esp, 4
push dword [ebx + 0x50]
push str.Product_Version:__s_n
call fcn.00403550
push dword [ebx + 0x58]
push dword [esi]
push str.Product_Build:__s_Major:__d_n
call fcn.00403550
add esp, 0x14
mov ecx, ebx
call fcn.0040ab90
mov ecx, eax
mov edx, str.false
test ecx, ecx
mov dword [ebx + 0x20], ecx
mov eax, str.true
cmove eax, edx
push eax
push str.Device_supports_Image4:__s_n
call fcn.00403550
mov ecx, dword [ebx]
add esp, 8
test cl, 8
je 0x40848b
xor eax, eax
push str.Custom_firmware_requested._Disabled_TSS_request._n
mov dword [esp + 0x4c], eax
call fcn.00403550
mov ecx, dword [ebx]
add esp, 4
mov dword [ebx + 4], 0
lea eax, [ebx + 4]
mov dword [esp + 0x60], eax
test cl, 8
je 0x408b61
call dword [sym.imp.plist.dll_plist_new_dict]
mov dword [esp + 0x44], eax
lea edx, [esp + 0xa8]
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax + 4]
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x4084c0
mov al, byte [esp + 0xa8]
test al, al
je 0x4084fa
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea esi, [esp + 0xa8]
movsx eax, al
push eax
call edi
mov byte [esi], al
lea esi, [esi + 1]
mov al, byte [esi]
add esp, 4
test al, al
jne 0x4084e6
push str.production
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x100]
push str.Firmware_all_flash_all_flash._s._s
push eax
call fcn.00406ee0
add esp, 0x10
xor ecx, ecx
nop
mov al, byte [esp + ecx + 0xf8]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x177], al
test al, al
jne 0x408520
lea ecx, [esp + 0x178]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x408540
mov eax, dword [str._manifest]
lea edx, [esp + 0x178]
mov dword [ecx], eax
mov eax, dword [0x421620]
mov dword [ecx + 4], eax
mov ax, word [0x421624]
mov word [ecx + 8], ax
lea eax, [esp + 0x70]
mov ecx, dword [ebx + 0x30]
push eax
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
push eax
mov dword [esp + 0x78], 0
call fcn.0040f330
add esp, 8
test eax, eax
jns 0x4085c0
lea eax, [esp + 0x178]
push eax
push str.ERROR:_could_not_extract__s_from_IPSW_n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x6c]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
push 0x421650
push edi
call esi
add esp, 8
mov dword [esp + 0x5c], 0
test eax, eax
je 0x408612
xor ebx, ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov dword [esp + ebx*4 + 0xbc], eax
add esp, 4
inc ebx
cmp ebx, 0x10
jge 0x40860a
push 0x421650
push 0
call esi
add esp, 8
test eax, eax
jne 0x4085e3
mov dword [esp + 0x5c], ebx
mov ebx, dword [esp + 0x68]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, dword [sym.imp.plist.dll_plist_new_dict]
add esp, 4
call edi
xor esi, esi
mov dword [esp + 0x58], eax
mov dword [esp + 0x70], esi
cmp dword [esp + 0x5c], esi
jle 0x408790
mov ebx, dword [esp + 0x5c]
nop dword [eax]
call edi
mov dword [esp + 0x6c], eax
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0xf8]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x177], al
test al, al
jne 0x408650
lea edi, [esp + 0x178]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x408670
mov ax, word [0x41e584]
mov edx, dword [esp + esi*4 + 0xb8]
mov esi, edx
mov word [edi], ax
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x408690
lea edi, [esp + 0x178]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4086a1
mov ecx, edx
lea eax, [esp + 0x178]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.plist.dll_plist_new_string]
mov edi, dword [sym.imp.plist.dll_plist_dict_set_item]
add esp, 4
push eax
push str.Path
push dword [esp + 0x74]
call edi
mov eax, dword [sym.imp.plist.dll_plist_new_dict]
add esp, 0xc
call eax
push dword [esp + 0x6c]
mov esi, eax
push str.Info
push esi
call edi
mov ecx, dword [esp + 0x7c]
add esp, 0xc
mov edi, dword [esp + ecx*4 + 0xb8]
mov ecx, edi
call fcn.0040c400
test eax, eax
je 0x40874b
push esi
push eax
push dword [esp + 0x60]
call dword [sym.imp.plist.dll_plist_dict_set_item]
add esp, 0xc
push 0xa
push str.DeviceTree
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x408760
push esi
call dword [sym.imp.plist.dll_plist_copy]
add esp, 4
push eax
push str.RestoreDeviceTree
push dword [esp + 0x60]
call dword [sym.imp.plist.dll_plist_dict_set_item]
jmp 0x40875d
push edi
push str.WARNING:_unhandled_component__s_n
call fcn.004035a0
push esi
call dword [sym.imp.plist.dll_plist_free]
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [esp + 0x74]
add esp, 4
mov edi, dword [sym.imp.plist.dll_plist_new_dict]
mov dword [esp + esi*4 + 0xb8], 0
inc esi
mov dword [esp + 0x70], esi
cmp esi, ebx
jl 0x408640
mov ebx, dword [esp + 0x68]
push str.RELEASE
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x180]
push str.Firmware_dfu_iBSS._s._s.dfu
push eax
call fcn.00406ee0
call edi
mov edi, eax
lea eax, [esp + 0x188]
push eax
call dword [sym.imp.plist.dll_plist_new_string]
add esp, 0x14
push eax
push str.Path
push edi
call dword [sym.imp.plist.dll_plist_dict_set_item]
mov eax, dword [sym.imp.plist.dll_plist_new_dict]
add esp, 0xc
call eax
push edi
mov esi, eax
push str.Info
push esi
call dword [sym.imp.plist.dll_plist_dict_set_item]
add esp, 0xc
push esi
mov esi, dword [sym.imp.plist.dll_plist_dict_set_item]
push str.iBSS
push dword [esp + 0x60]
call esi
add esp, 0xc
lea eax, [esp + 0xa8]
push str.RELEASE
push eax
lea eax, [esp + 0x180]
push str.Firmware_dfu_iBEC._s._s.dfu
push eax
call fcn.00406ee0
call dword [sym.imp.plist.dll_plist_new_dict]
mov edi, eax
lea eax, [esp + 0x188]
push eax
call dword [sym.imp.plist.dll_plist_new_string]
add esp, 0x14
push eax
push str.Path
push edi
call esi
add esp, 0xc
call dword [sym.imp.plist.dll_plist_new_dict]
push edi
mov edi, dword [sym.imp.plist.dll_plist_dict_set_item]
mov esi, eax
push str.Info
push esi
call edi
add esp, 0xc
push esi
push str.iBEC
push dword [esp + 0x60]
call edi
mov edi, dword [sym.imp.plist.dll_plist_dict_get_item]
add esp, 0xc
push str.KernelCachesByTarget
push dword [esp + 0x68]
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x4088bd
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 5
jne 0x4088bd
push 3
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [esp + 0x6f], 0
lea eax, [esp + 0x6c]
push eax
push esi
jmp 0x4088c6
push str.RestoreKernelCaches
push dword [esp + 0x68]
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x40897c
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 5
jne 0x40897c
push str.Release
push esi
call edi
mov esi, dword [sym.imp.plist.dll_plist_get_node_type]
mov edi, eax
add esp, 8
test edi, edi
je 0x408a47
push edi
call esi
add esp, 4
cmp eax, 3
jne 0x408a47
call dword [sym.imp.plist.dll_plist_new_dict]
push edi
mov esi, eax
call dword [sym.imp.plist.dll_plist_copy]
add esp, 4
push eax
push str.Path
push esi
call dword [sym.imp.plist.dll_plist_dict_set_item]
add esp, 0xc
call dword [sym.imp.plist.dll_plist_new_dict]
push esi
mov esi, dword [sym.imp.plist.dll_plist_dict_set_item]
mov edi, eax
push str.Info
push edi
call esi
add esp, 0xc
push edi
push str.KernelCache
push dword [esp + 0x60]
call esi
add esp, 0xc
push edi
call dword [sym.imp.plist.dll_plist_copy]
add esp, 4
push eax
push str.RestoreKernelCache
push dword [esp + 0x60]
call esi
mov edi, dword [sym.imp.plist.dll_plist_dict_get_item]
add esp, 0xc
mov esi, dword [sym.imp.plist.dll_plist_get_node_type]
push str.RestoreRamDisks
push dword [esp + 0x68]
call edi
mov edi, eax
add esp, 8
test edi, edi
je 0x408a52
push edi
call esi
add esp, 4
cmp eax, 5
jne 0x408a52
test byte [ebx], 4
mov ecx, str.Update
mov eax, str.User
cmove eax, ecx
push eax
push edi
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4089eb
test byte [ebx], 4
jne 0x408a52
push str.User
push edi
call dword [sym.imp.plist.dll_plist_dict_get_item]
or dword [ebx], 4
mov esi, eax
add esp, 8
test esi, esi
je 0x408a52
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 3
jne 0x408a52
call dword [sym.imp.plist.dll_plist_new_dict]
push esi
mov edi, eax
call dword [sym.imp.plist.dll_plist_copy]
add esp, 4
push eax
push str.Path
push edi
call dword [sym.imp.plist.dll_plist_dict_set_item]
add esp, 0xc
call dword [sym.imp.plist.dll_plist_new_dict]
push edi
mov edi, dword [sym.imp.plist.dll_plist_dict_set_item]
mov esi, eax
push str.Info
push esi
call edi
add esp, 0xc
push esi
push str.RestoreRamDisk
push dword [esp + 0x60]
call edi
add esp, 0xc
jmp 0x408a58
mov edi, dword [sym.imp.plist.dll_plist_dict_get_item]
jmp 0x408982
mov edi, dword [sym.imp.plist.dll_plist_dict_set_item]
push str.SystemRestoreImages
push dword [esp + 0x68]
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
add esp, 8
test esi, esi
jne 0x408a7d
push str.ERROR:_missing_SystemRestoreImages_in_Restore.plist_n
call fcn.004035a0
add esp, 4
push str.User
push esi
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
add esp, 8
test esi, esi
jne 0x408aa1
push str.ERROR:_missing_filesystem_in_Restore.plist_n
call fcn.004035a0
add esp, 4
jmp 0x408aec
call dword [sym.imp.plist.dll_plist_new_dict]
push esi
mov edi, eax
call dword [sym.imp.plist.dll_plist_copy]
add esp, 4
push eax
push str.Path
push edi
call dword [sym.imp.plist.dll_plist_dict_set_item]
add esp, 0xc
call dword [sym.imp.plist.dll_plist_new_dict]
push edi
mov edi, dword [sym.imp.plist.dll_plist_dict_set_item]
mov esi, eax
push str.Info
push esi
call edi
add esp, 0xc
push esi
push 0x4217e4
push dword [esp + 0x60]
call edi
add esp, 0xc
call dword [sym.imp.plist.dll_plist_new_dict]
test byte [ebx], 4
mov esi, eax
mov ecx, str.Update
mov eax, str.Erase
cmove eax, ecx
push eax
call dword [sym.imp.plist.dll_plist_new_string]
add esp, 4
push eax
push str.RestoreBehavior
push esi
call edi
add esp, 0xc
mov ecx, str.Customer_Upgrade_Install__IPSW_
test byte [ebx], 4
mov eax, str.Customer_Erase_Install__IPSW_
cmove eax, ecx
push eax
call dword [sym.imp.plist.dll_plist_new_string]
add esp, 4
push eax
push str.Variant
push esi
call edi
add esp, 0xc
push esi
mov esi, dword [esp + 0x48]
push str.Info
push esi
call edi
add esp, 0xc
push dword [esp + 0x58]
push str.Manifest
push esi
call edi
add esp, 0xc
jmp 0x408bd3
mov eax, dword [ebx + 0x44]
test cl, 4
mov ecx, dword [esp + 0x64]
mov edx, dword [eax + 4]
je 0x408ba3
push str.Erase
call fcn.0040b170
mov esi, eax
add esp, 4
mov dword [esp + 0x44], esi
test esi, esi
jne 0x408bd3
push str.ERROR:_Unable_to_find_any_build_identities_n
call fcn.004035a0
add esp, 4
push dword [esp + 0x64]
call dword [sym.imp.plist.dll_plist_free]
jmp 0x40a32c
push str.Update
call fcn.0040b170
mov esi, eax
add esp, 4
mov dword [esp + 0x44], esi
test esi, esi
jne 0x408bd3
mov eax, dword [ebx + 0x44]
mov ecx, dword [esp + 0x64]
push esi
mov edx, dword [eax + 4]
call fcn.0040b170
mov esi, eax
add esp, 4
mov dword [esp + 0x44], esi
mov edi, dword [sym.imp.plist.dll_plist_dict_get_item]
push str.Info
push esi
mov dword [esp + 0x60], 0
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x408d37
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 5
jne 0x408d37
push str.Variant
push esi
call edi
mov edi, eax
add esp, 8
test edi, edi
je 0x408d30
push edi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 3
jne 0x408d30
lea eax, [esp + 0x58]
push eax
push edi
mov edi, dword [sym.imp.plist.dll_plist_get_string_val]
call edi
push dword [esp + 0x60]
push str.Variant:__s_n
call fcn.00403550
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x14
push str.RestoreBehavior
push esi
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
add esp, 8
test esi, esi
je 0x408d24
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 3
jne 0x408d24
lea eax, [esp + 0x58]
push eax
push esi
call edi
mov esi, dword [esp + 0x60]
add esp, 8
mov ecx, str.Erase
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408cc0
test dl, dl
je 0x408cbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408cc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x408ca0
xor eax, eax
jmp 0x408cc5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408cda
push str.This_restore_will_erase_your_device_data._n
call fcn.00403550
mov esi, dword [esp + 0x5c]
add esp, 4
mov ecx, str.Update
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408d01
test dl, dl
je 0x408cfd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408d01
add eax, 2
add ecx, 2
test dl, dl
jne 0x408ce1
xor eax, eax
jmp 0x408d06
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408d1b
push str.This_restore_will_update_your_device_without_erasing_user_data._n
call fcn.00403550
mov esi, dword [esp + 0x5c]
add esp, 4
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x408d47
push str.ERROR:_Unable_to_find_RestoreBehavior_node_n
call fcn.004035a0
jmp 0x408d47
push str.ERROR:_Unable_to_find_Variant_node_n
jmp 0x408d3c
push str.ERROR:_Unable_to_find_Info_node_n
call fcn.004035a0
mov edi, dword [sym.imp.plist.dll_plist_get_string_val]
mov eax, dword [ebx + 0x4c]
add esp, 4
cmp dword [eax], 4
jne 0x408fba
test byte [ebx], 0x84
jne 0x408fba
push str.ProductVersion
mov ecx, ebx
call fcn.004115c0
mov esi, eax
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], eax
test esi, esi
je 0x408fb0
lea eax, [esp + 0x5c]
push eax
push esi
call edi
push esi
call dword [sym.imp.plist.dll_plist_free]
mov eax, dword [esp + 0x68]
add esp, 0xc
test eax, eax
je 0x408fb0
mov edi, dword [ebx + 0x50]
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xac], 0
push ecx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb4], 0
push ecx
push str._d._d._d
push eax
mov dword [esp + 0xc4], 0
call fcn.00406f20
add esp, 0x14
cmp eax, 2
jl 0x408e05
movzx esi, byte [esp + 0xa8]
movzx eax, byte [esp + 0xac]
shl esi, 8
or esi, eax
shl esi, 8
jmp 0x408e0a
mov esi, 0xffff00
lea eax, [esp + 0xc0]
mov dword [esp + 0xb8], 0
push eax
lea eax, [esp + 0xc0]
mov dword [esp + 0xc0], 0
push eax
lea eax, [esp + 0xc0]
mov dword [esp + 0xc8], 0
push eax
push str._d._d._d
push edi
call fcn.00406f20
add esp, 0x14
cmp eax, 2
jl 0x408e70
movzx ecx, byte [esp + 0xb8]
movzx eax, byte [esp + 0xbc]
shl ecx, 8
or ecx, eax
shl ecx, 8
jmp 0x408e75
mov ecx, 0xffff00
sub esi, ecx
test esi, esi
jle 0x408fac
test dword [ebx], 0x200
je 0x408fac
mov ecx, dword [ebx + 0x50]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408e91
mov edi, dword [esp + 0x5c]
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x408ea3
sub edx, esi
lea eax, [esp + 0xb8]
mov esi, 0xd
sub esi, ecx
sub esi, edx
push esi
push 0x20
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp esi, 0x10
jae 0x40a347
lea eax, [esp + 0xb8]
mov byte [esp + esi + 0xb8], 0
push eax
push dword [ebx + 0x50]
push edi
push str.___WARNING____n_You_are_trying_to_DOWNGRADE_a__s_device_with_an_IPSW_for__s_while_s__n_trying_to_preserve_the_user_data__Upgrade_restore_._This_might_work__but__n_there_is_a_VERY_HIGH_chance_it_might_FAIL_BADLY_with_COMPLETE_DATA_LOSS.____n_Hit_CTRLC_now_if_you_want_to_abort_the_restore.____________________________n_If_you_want_to_take_the_risk__and_have_a_backup_of_your_important_data______n_type_YES_and_press_ENTER_to_continue._You_have_been_warned._________________n_n
call fcn.00406ea0
push 0x421b04
call fcn.00406ea0
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 0x14
push 1
call edi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
push eax
call esi
add esp, 4
push 0
call edi
add esp, 4
push eax
call esi
add esp, 4
mov byte [esp + 0xf8], 0
push ecx
lea ecx, [esp + 0xfc]
call fcn.00404090
add esp, 4
test byte [ebx], 1
jne 0x40a32f
cmp byte [esp + 0xf8], 0
je 0x408f89
mov ecx, 0x421b08
lea eax, [esp + 0xf8]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408f80
test dl, dl
je 0x408f7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408f80
add eax, 2
add ecx, 2
test dl, dl
jne 0x408f60
xor eax, eax
jmp 0x408f85
sbb eax, eax
or eax, 1
test eax, eax
je 0x408fac
push str.Invalid_input._Please_type_YES_or_hit_CTRLC_to_abort._n
call fcn.00406ea0
add esp, 4
push 0x421b04
call fcn.00406ea0
add esp, 4
push 1
call edi
jmp 0x408f0c
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [ebx]
and eax, 0x204
cmp eax, 0x204
jne 0x40908f
push str.___WARNING____n_You_are_about_to_perform_an_ERASE_restore._ALL_DATA_on_the_target_device__n_will_be_IRREVERSIBLY_DESTROYED._If_you_want_to_update_your_device_without___n_erasing_the_user_data__hit_CTRLC_now_and_restart_without__e_or___erase_____n_command_line_switch.________________________________________________________n_If_you_want_to_continue_with_the_ERASE__please_type_YES_and_press_ENTER.____n_n
call fcn.00406ea0
add esp, 4
push 0x421b04
call fcn.00406ea0
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push 1
call edi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
push eax
call esi
add esp, 4
push 0
call edi
add esp, 4
push eax
call esi
add esp, 4
mov byte [esp + 0xf8], 0
push ecx
lea ecx, [esp + 0xfc]
call fcn.00404090
add esp, 4
test byte [ebx], 1
jne 0x40a32f
cmp byte [esp + 0xf8], 0
je 0x40906c
mov ecx, 0x421b08
lea eax, [esp + 0xf8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409063
test dl, dl
je 0x40905f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409063
add eax, 2
add ecx, 2
test dl, dl
jne 0x409043
xor eax, eax
jmp 0x409068
sbb eax, eax
or eax, 1
test eax, eax
je 0x40908f
push str.Invalid_input._Please_type_YES_or_hit_CTRLC_to_abort._n
call fcn.00406ea0
add esp, 4
push 0x421b04
call fcn.00406ea0
add esp, 4
push 1
call edi
jmp 0x408ff6
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4090ab
push dword [ebx + 0x70]
xorps xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
push str.Checking_IPSW_for_required_components..._n
call fcn.00403550
mov eax, dword [ebx + 0x30]
add esp, 4
mov dword [esp + 0x5c], eax
push str.Manifest
push dword [esp + 0x48]
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov esi, eax
add esp, 8
test esi, esi
je 0x40a298
push esi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 5
jne 0x40a298
lea eax, [esp + 0x6c]
xor edi, edi
push eax
push esi
mov dword [esp + 0x74], edi
call dword [sym.imp.plist.dll_plist_dict_new_iter]
mov ebx, dword [esp + 0x64]
add esp, 8
nop word [eax + eax]
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
push eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
push eax
push dword [esp + 0x74]
push esi
call dword [sym.imp.plist.dll_plist_dict_next_item]
add esp, 0x10
cmp dword [esp + 0x58], 0
je 0x4091b0
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4091b0
push str.Path
push str.Info
push 2
push eax
call dword [sym.imp.plist.dll_plist_access_path]
add esp, 0x10
test eax, eax
je 0x4091b0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x5c], 0
push ecx
push eax
call dword [sym.imp.plist.dll_plist_get_string_val]
mov edx, dword [esp + 0x64]
add esp, 8
test edx, edx
je 0x4091b0
mov ecx, ebx
call fcn.0040f270
test eax, eax
jne 0x4091a3
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push str.ERROR:__s_file__s_not_found_in_IPSW_n
call fcn.004035a0
add esp, 0xc
or edi, 0xffffffff
push dword [esp + 0x5c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [esp + 0x58]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp dword [esp + 0x70], 0
jne 0x409110
mov ebx, dword [esp + 0x68]
test edi, edi
js 0x40a298
push str.All_required_components_found_in_IPSW_n
call fcn.00403550
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x60]
add esp, 4
mov dword [esp + 0x5c], 0
mov edx, 0x4217e4
push eax
call fcn.0040c2c0
add esp, 4
test eax, eax
jns 0x40920d
push str.ERROR:_Unable_get_path_for_filesystem_component_n
jmp 0x40a327
xor eax, eax
mov dword [esp + 0x58], 0
push 0x30
push eax
mov dword [esp + 0x78], eax
lea eax, [esp + 0x80]
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebx + 0x60]
add esp, 0xc
test eax, eax
je 0x4092d9
lea ecx, [esp + 0x78]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jns 0x409254
mov ecx, dword [ebx + 0x60]
call fcn.00403860
mov ecx, dword [ebx + 0x60]
lea edx, [esp + 0x578]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x409260
lea edi, [esp + 0x578]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x409275
mov ax, word [0x41e584]
push dword [ebx + 0x30]
mov word [edi], ax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x6c], eax
mov ecx, eax
call fcn.00402760
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0x4092a3
lea edi, [esp + 0x578]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4092b4
push dword [esp + 0x6c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4092f2
mov ecx, dword [ebx + 0x30]
lea edx, [esp + 0x578]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x4092e5
mov ecx, dword [ebx + 0x30]
call fcn.0040eae0
test eax, eax
jne 0x409348
lea ecx, [esp + 0x578]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409308
sub ecx, edx
mov al, byte [esp + ecx + 0x577]
lea edx, [esp + ecx + 0x577]
mov ecx, edx
test al, al
je 0x409339
cmp al, 0x2e
je 0x409339
cmp al, 0x2f
je 0x409339
cmp al, 0x5c
je 0x409339
mov al, byte [ecx - 1]
dec ecx
test al, al
jne 0x409325
sub edx, ecx
cmp edx, 6
jge 0x409348
cmp byte [ecx], 0x2e
jne 0x409348
mov byte [ecx], 0
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x57c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jns 0x409372
push 0
lea eax, [esp + 0x57c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [esp + 0x578]
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x409380
mov ax, word [0x41e584]
mov edx, dword [esp + 0x5c]
mov esi, edx
mov word [edi], ax
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4093a0
lea edi, [esp + 0x578]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4093b1
mov ecx, edx
lea eax, [esp + 0x78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x30
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x57c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jne 0x4094da
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0xa8]
mov ecx, dword [ebx + 0x30]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0xac], xmm0
call fcn.0040eb50
mov esi, dword [esp + 0xb0]
add esp, 4
mov ecx, dword [esp + 0xa8]
test esi, esi
jne 0x409433
test ecx, ecx
je 0x4094da
mov eax, dword [esp + 0x8c]
cdq
cmp eax, ecx
jne 0x4094da
cmp edx, esi
jne 0x4094da
lea eax, [esp + 0x578]
push eax
push str.Using_cached_filesystem_from__s_n
call fcn.00403550
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
lea eax, [esp + 0x580]
push eax
call esi
add esp, 0xc
mov dword [esp + 0x70], eax
test eax, eax
je 0x4094e0
mov esi, dword [esp + 0x70]
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x40949d
push dword [ebx + 0x70]
movsd xmm0, qword [0x429968]
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
mov ecx, dword [esp + 0x48]
test ecx, ecx
je 0x409945
push str.Getting_devices_ECID_for_TSS_request_n
mov dword [esp + 0x70], 0
call fcn.00403610
add esp, 4
lea edx, [ebx + 0x10]
mov ecx, ebx
call fcn.0040add0
test eax, eax
jns 0x4096f4
push str.ERROR:_Unable_to_find_device_ECID_n
jmp 0x40a327
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test byte [ebx], 0x80
jne 0x409478
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esp + ecx + 0x578]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x977], al
test al, al
jne 0x4094f0
lea ecx, [esp + 0x978]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x409510
mov eax, dword [str..extract]
mov dword [ecx], eax
mov eax, dword [0x421e60]
mov dword [ecx + 4], eax
mov al, byte [0x421e64]
mov byte [ecx + 8], al
xor ecx, ecx
mov al, byte [esp + ecx + 0x578]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x177], al
test al, al
jne 0x409533
lea ecx, [esp + 0x178]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x409550
mov eax, dword [str..lock]
lea edx, [esp + 0xb8]
mov dword [ecx], eax
mov ax, word [0x421e6c]
mov word [ecx + 4], ax
lea ecx, [esp + 0x178]
call fcn.00410de0
xor edi, edi
lea eax, [esp + 0x978]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
add esp, 8
test eax, eax
je 0x4095ae
lea eax, [esp + 0x978]
push 0x41ea64
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov edi, eax
lea ecx, [esp + 0xb8]
call fcn.00410e80
test edi, edi
jne 0x4095f3
mov ecx, str.ipsw_
call fcn.00403f10
mov esi, eax
test esi, esi
jne 0x4095e9
mov esi, dword [esp + 0x5c]
push esi
push str.WARNING:_Could_not_get_temporary_filename__using__s_in_current_directory_n
call fcn.004035a0
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 0xc
mov esi, eax
mov dword [esp + 0x58], 1
jmp 0x40960c
lea eax, [esp + 0x978]
push eax
call esi
add esp, 4
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea eax, [esp + 0x178]
push eax
call edi
add esp, 4
push dword [esp + 0x5c]
push str.Extracting_filesystem_from_IPSW:__s_n
call fcn.00403550
mov edx, dword [esp + 0x64]
add esp, 4
mov ecx, dword [ebx + 0x30]
push esi
call fcn.0040ecd0
add esp, 8
test eax, eax
jns 0x40969f
push str.ERROR:_Unable_to_extract_filesystem_from_IPSW_n
call fcn.004035a0
mov eax, dword [esp + 0x64]
add esp, 4
mov eax, dword [eax]
test eax, eax
je 0x409665
push eax
call dword [sym.imp.plist.dll_plist_free]
add esp, 4
push dword [esp + 0x64]
call dword [sym.imp.plist.dll_plist_free]
add esp, 4
push esi
push str.Removing__s_n
call fcn.00403550
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push str..extract
push esi
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
je 0x40947c
lea eax, [esp + 0x578]
push eax
call edi
add esp, 4
lea eax, [esp + 0x578]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
lea eax, [esp + 0x578]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov esi, eax
jmp 0x40947c
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push str.Found_ECID__llu_n
call fcn.00403550
mov eax, dword [ebx + 0x4c]
add esp, 0xc
cmp dword [eax], 4
jne 0x4097dd
test byte [ebx], 0x84
jne 0x4097dd
push str.HasSiDP
mov ecx, ebx
call fcn.004115c0
mov edi, eax
mov byte [esp + 0x7b], 0
add esp, 4
test edi, edi
je 0x4097dd
push edi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
test eax, eax
jne 0x409757
lea eax, [esp + 0x77]
push eax
push edi
call dword [sym.imp.plist.dll_plist_get_bool_val]
add esp, 8
cmp byte [esp + 0x77], 0
je 0x4097dd
push str.Checking_if_device_requires_stashbag..._n
call fcn.00403550
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x70]
add esp, 4
mov ecx, ebx
push eax
call fcn.0040b350
add esp, 4
test eax, eax
jns 0x40978c
push str.ERROR:_Unable_to_create_preboard_manifest._n
jmp 0x40a327
push str.DEBUG:_creating_stashbag..._n
call fcn.00403610
mov edi, dword [esp + 0x70]
add esp, 4
mov edx, edi
mov ecx, ebx
call fcn.00411760
mov ecx, eax
test ecx, ecx
jns 0x4097c2
cmp ecx, 0xfffffffe
mov eax, str.ERROR:_Could_not_create_stashbag__timeout_._n
mov edx, str.ERROR:_An_error_occurred_while_creating_the_stashbag._n
cmovne eax, edx
push eax
jmp 0x40a327
xor eax, eax
cmp ecx, 1
mov ecx, 1
cmove eax, ecx
push edi
mov dword [esp + 0x70], eax
call dword [sym.imp.plist.dll_plist_free]
add esp, 4
cmp dword [ebx + 0x58], 8
jle 0x4098a3
lea eax, [esp + 0x70]
mov dword [esp + 0x68], 0
push eax
lea edx, [esp + 0x6c]
mov dword [esp + 0x74], 0
mov ecx, ebx
call fcn.0040aea0
add esp, 4
test eax, eax
jns 0x40981b
push str.NOTE:_Unable_to_get_nonce_from_device_n
call fcn.00403550
add esp, 4
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x409895
mov edi, dword [esp + 0x70]
cmp edi, dword [ebx + 0x1c]
jne 0x40988b
mov ecx, dword [esp + 0x68]
mov edx, eax
sub edi, 4
jb 0x409847
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40984c
add ecx, 4
add edx, 4
sub edi, 4
jae 0x409836
cmp edi, 0xfffffffc
je 0x409879
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x409888
cmp edi, 0xfffffffd
je 0x409879
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x409888
cmp edi, 0xfffffffe
je 0x409879
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x409888
cmp edi, 0xffffffff
je 0x409879
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x409888
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4098a3
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword [esp + 0x68]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0x1c], eax
test byte [ebx], 1
jne 0x40a32f
mov edi, dword [esp + 0x44]
lea eax, [ebx + 4]
push eax
mov edx, edi
mov ecx, ebx
call fcn.0040b5d0
add esp, 4
test eax, eax
jns 0x4098ce
push str.ERROR:_Unable_to_get_SHSH_blobs_for_this_device_n
jmp 0x40a327
cmp dword [esp + 0x6c], 0
je 0x40994f
push str.ApImg4Ticket
push dword [ebx + 4]
call dword [sym.imp.plist.dll_plist_dict_get_item]
mov edi, eax
add esp, 8
test edi, edi
je 0x40993b
push edi
call dword [sym.imp.plist.dll_plist_get_node_type]
add esp, 4
cmp eax, 7
jne 0x40993b
push str.Committing_stashbag..._n
call fcn.00403550
add esp, 4
mov edx, edi
mov ecx, ebx
call fcn.00411af0
test eax, eax
jns 0x40994b
push eax
push str.ERROR:_Could_not_commit_stashbag___d_._Aborting._n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push str.ERROR:_Missing_ApImg4Ticket_in_TSS_response_for_stashbag_commit_n
jmp 0x40a327
mov edi, dword [esp + 0x44]
jmp 0x409953
mov edi, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov eax, dword [ebx]
test al, 1
jne 0x409f39
test al, al
jns 0x409b32
test ecx, ecx
jne 0x40998d
push str.This_device_does_not_require_a_TSS_record_n
call fcn.00403550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
test eax, eax
jne 0x4099a1
push str.ERROR:_could_not_fetch_TSS_record_n
jmp 0x408b8c
lea ecx, [esp + 0x6c]
mov dword [esp + 0x68], 0
push ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x70], 0
push ecx
push eax
call dword [sym.imp.plist.dll_plist_to_bin]
add esp, 0xc
cmp dword [esp + 0x68], 0
je 0x409af8
mov ecx, dword [ebx + 0x60]
test ecx, ecx
je 0x409a12
lea edx, [esp + 0x178]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x4099e0
lea ecx, [esp + 0x178]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4099f5
mov eax, dword [str._shsh]
mov dword [ecx], eax
mov ax, word [0x422194]
mov word [ecx + 4], ax
jmp 0x409a2a
mov eax, dword [str.shsh]
mov dword [esp + 0x178], eax
mov al, byte [0x420040]
mov byte [esp + 0x17c], al
lea ecx, [esp + 0x178]
call fcn.00403860
lea ecx, [esp + 0x178]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a40
push dword [ebx + 0x50]
mov eax, dword [ebx + 0x44]
sub ecx, edx
push dword [eax]
lea eax, [esp + 0x180]
push dword [ebx + 0x14]
add eax, ecx
push dword [ebx + 0x10]
push str.__llu__s__s.shsh
push eax
call fcn.00406ee0
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x194]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0x20
test eax, eax
lea eax, [esp + 0x178]
je 0x409ade
push 0x41ea64
push eax
call dword [sym.imp.zlib1.dll_gzopen]
push dword [esp + 0x74]
mov esi, eax
push dword [esp + 0x74]
push esi
call dword [sym.imp.zlib1.dll_gzwrite]
add esp, 0x14
push esi
call dword [sym.imp.zlib1.dll_gzclose]
add esp, 4
lea eax, [esp + 0x178]
push eax
push str.SHSH_saved_to__s_n
call fcn.00403550
mov esi, dword [esp + 0x68]
add esp, 8
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x409b02
push eax
push str.SHSH__s_already_present._n
call fcn.00403550
add esp, 8
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x409b02
push str.ERROR:_could_not_get_TSS_record_data_n
call fcn.004035a0
mov ebx, dword [sym.imp.plist.dll_plist_free]
add esp, 4
push dword [esi]
call ebx
add esp, 4
push dword [esp + 0x64]
call ebx
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x409b4c
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x409b47
push str.ERROR:_Unable_to_proceed_without_a_TSS_record._n
jmp 0x408b8c
call fcn.0040bee0
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x409b6d
push dword [ebx + 0x70]
movsd xmm0, qword [0x429970]
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
test byte [ebx], 1
jne 0x409f39
mov eax, dword [ebx + 0x4c]
cmp dword [eax], 4
jne 0x409bde
push str.Entering_recovery_mode..._n
call fcn.00403550
add esp, 4
mov ecx, ebx
call fcn.00411400
test eax, eax
jns 0x409bde
push str.ERROR:_Unable_to_place_device_into_recovery_mode_from_normal_mode_n
call fcn.004035a0
mov eax, dword [esp + 0x64]
add esp, 4
mov eax, dword [eax]
test eax, eax
je 0x409bb7
push eax
call dword [sym.imp.plist.dll_plist_free]
add esp, 4
push dword [esp + 0x64]
call dword [sym.imp.plist.dll_plist_free]
add esp, 4
mov eax, 0xfffffffb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x409bff
push dword [ebx + 0x70]
movsd xmm0, qword [0x429978]
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
mov ecx, dword [ebx]
test cl, 1
jne 0x409f39
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax]
cmp eax, 1
jne 0x409cb7
mov ecx, ebx
call fcn.00404630
mov ecx, ebx
call fcn.00411e40
test byte [ebx], 8
je 0x409c9c
mov ecx, dword [ebx + 0x44]
call fcn.004109b0
test eax, eax
je 0x409c9c
push str.connecting_to_DFU_n
call fcn.00403550
add esp, 4
mov ecx, ebx
call fcn.00404530
test eax, eax
js 0x409f39
push str.exploiting_with_limera1n_n
call fcn.00403550
mov edx, dword [ebx + 0x38]
add esp, 4
mov ecx, dword [ebx + 0x44]
call fcn.00410a50
test eax, eax
je 0x409c88
push str.ERROR:_limera1n_exploit_failed_n
call fcn.004035a0
add esp, 4
mov ecx, ebx
call fcn.00404630
jmp 0x409f39
mov ecx, ebx
call fcn.00404630
push str.exploited_n
call fcn.00403550
add esp, 4
mov edx, edi
mov ecx, ebx
call fcn.004049e0
test eax, eax
jns 0x409da2
push str.ERROR:_Unable_to_place_device_into_recovery_mode_from_DFU_mode_n
jmp 0x40a01a
cmp eax, 2
jne 0x409da2
cmp dword [ebx + 0x58], 8
jle 0x409ceb
test cl, 8
jne 0x409ceb
cmp dword [ebx + 0x20], 0
jne 0x409ceb
mov ecx, ebx
call fcn.004127e0
test eax, eax
jns 0x409ceb
push str.ERROR:_Unable_to_send_APTicket_n
call fcn.004035a0
jmp 0x40a03e
lea eax, [ebx + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, edi
mov ecx, ebx
call fcn.00412aa0
test eax, eax
jns 0x409d1b
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ERROR:_Unable_to_send_iBEC_n
call fcn.004035a0
jmp 0x40a03e
mov ecx, ebx
call fcn.00411e40
push str.Waiting_for_device_to_disconnect..._n
call fcn.00403610
add esp, 4
lea edi, [ebx + 0x7c]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2710
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x50]
cmp dword [ebx + 0x4c], eax
jne 0x409e4b
test byte [ebx], 1
jne 0x409e4b
push str.Waiting_for_device_to_reconnect_in_recovery_mode..._n
call fcn.00403610
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2710
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x4c], 0x42c028
jne 0x409e2c
test byte [ebx], 1
jne 0x409e2c
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x409dc3
push dword [ebx + 0x70]
movsd xmm0, qword [0x429980]
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
test byte [ebx], 1
jne 0x409f39
cmp dword [ebx + 0x20], 0
jne 0x409eec
cmp dword [ebx + 0x58], 8
jle 0x409eec
lea eax, [esp + 0x70]
mov dword [esp + 0x68], 0
push eax
lea edx, [esp + 0x6c]
mov dword [esp + 0x74], 0
mov ecx, ebx
call fcn.0040aea0
add esp, 4
test eax, eax
jns 0x409e6a
push str.ERROR:_Unable_to_get_nonce_from_device__n
call fcn.004035a0
mov eax, dword [ebx + 0x40]
add esp, 4
push str.reset
push dword [eax]
call dword [sym.imp.irecovery.dll_irecv_send_command]
add esp, 8
jmp 0x40a041
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [ebx], 1
jne 0x40a041
push str.ERROR:_Device_did_not_reconnect_in_recovery_mode._Possibly_invalid_iBEC._Reset_device_and_try_again._n
call fcn.004035a0
jmp 0x40a03e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [ebx], 1
jne 0x40a041
push str.ERROR:_Device_did_not_disconnect._Possibly_invalid_iBEC._Reset_device_and_try_again._n
call fcn.004035a0
jmp 0x40a03e
cmp dword [ebx + 0x18], 0
je 0x409f64
mov eax, dword [esp + 0x70]
cmp eax, dword [ebx + 0x1c]
jne 0x409f58
mov ecx, dword [esp + 0x68]
mov edi, eax
mov edx, dword [ebx + 0x18]
sub edi, 4
jb 0x409ea1
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x409ea6
add ecx, 4
add edx, 4
sub edi, 4
jae 0x409e90
cmp edi, 0xfffffffc
je 0x409edf
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x409f58
cmp edi, 0xfffffffd
je 0x409edf
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x409f58
cmp edi, 0xfffffffe
je 0x409edf
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x409f58
cmp edi, 0xffffffff
je 0x409edf
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x409f58
push dword [esp + 0x68]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov edi, dword [esp + 0x44]
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x409f11
push dword [ebx + 0x70]
movsd xmm0, qword [0x429990]
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
test byte [ebx], 1
jne 0x409f39
mov eax, dword [ebx + 0x4c]
cmp dword [eax], 2
jne 0x40a077
cmp dword [ebx + 0x2c], 0
jne 0x40a008
push str.ERROR:_could_not_retrieve_device_serial_number._Cant_continue._n
call fcn.004035a0
add esp, 4
cmp dword [esp + 0x58], 0
je 0x40a32f
test esi, esi
je 0x40a32f
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
jmp 0x40a32c
push dword [ebx + 0x18]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
test byte [ebx], 8
mov eax, dword [esp + 0x68]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0x1c], eax
jne 0x409eec
push dword [ebx + 4]
lea edi, [ebx + 4]
call dword [sym.imp.plist.dll_plist_free]
add esp, 4
mov ecx, ebx
push edi
mov edi, dword [esp + 0x48]
mov edx, edi
call fcn.0040b5d0
add esp, 4
test eax, eax
jns 0x409fcb
push str.ERROR:_Unable_to_get_SHSH_blobs_for_this_device_n
call fcn.004035a0
add esp, 4
cmp dword [esp + 0x58], 0
je 0x40a32f
test esi, esi
je 0x40a32f
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
jmp 0x40a32c
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x409ffe
push str.ERROR:_cant_continue_without_TSS_n
call fcn.004035a0
add esp, 4
cmp dword [esp + 0x58], 0
je 0x40a32f
test esi, esi
je 0x40a32f
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
jmp 0x40a32c
call fcn.0040bee0
jmp 0x409ef0
mov edx, edi
mov ecx, ebx
call fcn.00412030
test eax, eax
jns 0x40a070
push str.ERROR:_Unable_to_place_device_into_restore_mode_n
call fcn.004035a0
mov ebx, dword [sym.imp.plist.dll_plist_free]
add esp, 4
push dword [esp + 0x64]
call ebx
mov eax, dword [esp + 0x64]
add esp, 4
mov eax, dword [eax]
test eax, eax
je 0x40a041
push eax
call ebx
add esp, 4
cmp dword [esp + 0x58], 0
je 0x40a056
test esi, esi
je 0x40a056
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00411e40
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x40a098
push dword [ebx + 0x70]
movsd xmm0, qword [0x4299a0]
sub esp, 8
movsd qword [esp], xmm0
push 1
call eax
add esp, 0x10
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax]
cmp eax, 3
je 0x40a0fa
lea eax, [ebx + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.Waiting_for_device_to_enter_restore_mode..._n
call fcn.00403550
add esp, 4
lea eax, [ebx + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2bf20
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x4c], 0x42c030
jne 0x40a126
test byte [ebx], 1
jne 0x40a126
lea eax, [ebx + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax]
cmp eax, 3
jne 0x40a1a1
test dword [ebx], 0x800
je 0x40a13a
push str.Device_is_now_in_restore_mode._Exiting_as_requested.
call fcn.00403550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.ERROR:_Device_failed_to_enter_restore_mode._n
jmp 0x409f31
push str.About_to_restore_device...__n
mov dword [ebx + 0x98], 1
call fcn.00403550
add esp, 4
mov edx, edi
mov ecx, ebx
push esi
call fcn.004188b0
add esp, 4
mov dword [esp + 0x4c], eax
test eax, eax
jns 0x40a1a1
push str.ERROR:_Unable_to_restore_device_n
call fcn.004035a0
add esp, 4
cmp dword [esp + 0x58], 0
je 0x40a188
test esi, esi
je 0x40a188
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
add esp, 4
mov eax, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push str.Cleaning_up..._n
call fcn.00403550
add esp, 4
cmp dword [esp + 0x58], 0
je 0x40a1c3
test esi, esi
je 0x40a1c3
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
add esp, 4
mov eax, dword [ebx + 0x44]
push 7
push str.AppleTV
push dword [eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40a229
mov eax, dword [ebx + 0x44]
mov eax, dword [eax]
cmp byte [eax + 7], 0x35
jge 0x40a229
mov ecx, ebx
call fcn.00411e80
test eax, eax
jne 0x40a21c
lea edx, [eax + 1]
mov ecx, ebx
call fcn.00411fc0
test eax, eax
jne 0x40a215
mov eax, dword [ebx + 0x40]
push str.reset
push dword [eax]
call dword [sym.imp.irecovery.dll_irecv_send_command]
add esp, 8
jmp 0x40a229
push str.Setting_auto_boot_failed___n
jmp 0x40a221
push str.Could_not_connect_to_device_in_recovery_mode._n
call fcn.004035a0
add esp, 4
push str.DONE_n
call fcn.00403550
mov esi, dword [esp + 0x50]
add esp, 4
test esi, esi
jne 0x40a25f
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x40a25f
push dword [ebx + 0x70]
movsd xmm0, qword [0x4299a8]
sub esp, 8
movsd qword [esp], xmm0
push 6
call eax
add esp, 0x10
mov eax, dword [esp + 0x64]
mov ebx, dword [sym.imp.plist.dll_plist_free]
test eax, eax
je 0x40a273
push eax
call ebx
add esp, 4
test edi, edi
je 0x407f97
push edi
call ebx
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x30]
push str.ERROR:_Could_not_find_all_required_components_in_IPSW__s_n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push str.build_manifest_check_compatibility
push str._s:_ERROR:_SupportedProductTypes_key_missing_n
call fcn.00403610
push str.build_manifest_check_compatibility
push str._s:_WARNING:_If_attempting_to_install_iPhoneOS_2.x__be_advised_that_Restore.plist_does_not_contain_the
call fcn.00403610
push str.build_manifest_check_compatibility
push str._s:_WARNING:_key_SupportedProductTypes._Recommendation_is_to_manually_add_it_to_the_Restore.plist.
call fcn.00403610
add esp, 0x18
push str.ERROR:_Could_not_make_sure_this_firmware_is_suitable_for_the_current_device._Refusing_to_continue._n
jmp 0x40a327
push dword [ebx + 0x30]
push str.ERROR:_Unable_to_extract_BuildManifest_from__s._Firmware_file_might_be_corrupt._n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd70]
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
push esi
call edi
push str.ERROR:_Unable_to_discover_device_mode._Please_make_sure_a_device_is_attached._n
call fcn.004035a0
add esp, 4
mov ecx, dword [esp + 0xd7c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
call fcn.0041c97c
int3