Function at 0x4046e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x4b1020
push ebx
lea ebx, [ebp - 0x158]
sub esp, 0x23c
mov edi, ebx
mov dword [ebp - 0x1ec], ecx
mov ecx, 0x50
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1d4]
mov dword [esp], str.ANDROID_SERIAL
mov dword [ebp - 0x1d0], 0x4b717c
mov dword [ebp - 0x1cc], 0x4b717c
mov dword [0x4cb08c], 0x8000
mov dword [0x4cb094], 0x1000000
mov dword [0x4cb09c], 0xf00000
mov dword [0x4cb0a0], 0x100
mov dword [0x4cb0a4], 0x800
call sub.msvcrt.dll_getenv
mov byte [ebp - 0x1fc], 0
mov byte [ebp - 0x1f5], 0
mov byte [ebp - 0x1f6], 0
mov byte [ebp - 0x1f4], 0
mov dword [0x4cb704], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.a::hls:S:vw
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0043db00
cmp eax, 0xffffffff
je 0x404a21
test eax, eax
je 0x4047c1
sub eax, 0x3f
cmp eax, 0x38
ja case.0x4047ba.64
jmp dword [eax*4 + 0x4b9c3c]
mov eax, dword [ebp - 0x1d4]
lea esi, [ebp - 0x178]
lea ecx, [ebp - 0x188]
mov dword [esp + 4], esi
shl eax, 4
mov eax, dword [ebp + eax - 0x158]
mov dword [esp], eax
call fcn.0047e2b0
lea ecx, [ebp - 0x188]
sub esp, 8
mov dword [esp], str.base
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x404860
mov eax, dword [0x4cd620]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4b1250], eax
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
je 0x40477f
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40477f
mov dword [esp], esi
call fcn.0047cb80
push eax
jmp 0x40477f
mov dword [esp], str.cmdline
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
je 0x4049c0
mov dword [esp], str.disable_verification
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x4049f8
mov byte [0x4cb06c], 1
jmp 0x404827
mov byte [ebp - 0x1f4], 1
jmp 0x40477f
mov edi, 1
mov eax, dword [ebp - 0x1cc]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40659b
mov eax, dword [ebp - 0x1d0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406577
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov esi, dword [0x4cd620]
mov byte [ebp - 0x1f5], 1
test esi, esi
je 0x40477f
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x1cc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0047d400
sub esp, 8
jmp 0x40477f
mov eax, dword [0x4cd620]
mov dword [esp + 0x10], 1
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0x4cb6f8
mov dword [esp], eax
call fcn.00450b20
test al, al
jne 0x40477f
mov eax, dword [0x4cd620]
mov dword [esp], str.invalid_sparse_limit__s
mov dword [esp + 4], eax
call fcn.0040a700
call fcn.0040a760
jmp 0x40477f
mov eax, dword [0x4cd620]
mov dword [0x4cb704], eax
jmp 0x40477f
mov byte [0x4cb700], 1
jmp 0x40477f
mov eax, dword [sym.imp.msvcrt.dll__iob]
xor edi, edi
mov dword [esp + 4], str.usage:_fastboot__OPTION...__COMMAND..._n_nflashing:_n_update_ZIP_________________Flash_all_partitions_from_an_update.zip_package._n_flashall___________________Flash_all_partitions_from__ANDROID_PRODUCT_OUT._n____________________________On_A_B_devices__flashed_slot_is_set_as_active._n____________________________Secondary_images_may_be_flashed_to_inactive_slot._n_flash_PARTITION__FILENAME__n____________________________Flash_given_partition_only._n_nbasics:_n_devices___l________________List_devices_in_bootloader___l:_with_device_paths_._n_getvar_NAME________________Display_given_bootloader_variable._n_reboot__bootloader_________Reboot_device._n_nlocking_unlocking:_n_flashing_lockunlock_______Lock_unlock_partitions_for_flashing_n_flashing_lock_criticalunlock_critical_n____________________________Lock_unlock_critical_bootloader_partitions._n_flashing_get_unlock_ability_n____________________________Check_whether_unlocking_is_allowed__1__or_not_0_._n_nadvanced:_n_erase_PARTITION____________Erase_a_flash_partition._n_format_:FS_TYPE_:SIZE___PARTITION_n____________________________Format_a_flash_partition._n_set_active_SLOT____________Set_the_active_slot._n_oem__COMMAND...____________Execute_OEM_specific_command._n_nboot_image:_n_boot_KERNEL__RAMDISK__SECOND___n____________________________Download_and_boot_kernel_from_RAM._n_flash:raw_PARTITION_KERNEL__RAMDISK__SECOND___n____________________________Create_boot_image_and_flash_it._n___cmdline_CMDLINE__________Override_kernel_command_line._n___base_ADDRESS_____________Set_kernel_base_address__default:_0x10000000_._n___kernel_offset____________Set_kernel_offset__default:_0x00008000_._n___ramdisk_offset___________Set_ramdisk_offset__default:_0x01000000_._n___tags_offset______________Set_tags_offset__default:_0x00000100_._n___page_size_BYTES__________Set_flash_page_size__default:_2048_._n___header_version_VERSION___Set_boot_image_header_version._n___os_version_MAJOR_.MINOR_.PATCH___n____________________________Set_boot_image_OS_version__default:_0.0.0_._n___os_patch_level_YYYY_MM_DD_n____________________________Set_boot_image_OS_security_patch_level._n_nAndroid_Things:_n_stage_IN_FILE______________Sends_given_file_to_stage_for_the_next_command._n_get_staged_OUT_FILE________Writes_data_staged_by_the_last_command_to_a_file._n_noptions:_n__w_________________________Wipe_userdata._n__s_SERIAL__________________Specify_a_USB_device._n__s_tcpudp:HOST_:PORT______Specify_a_network_device._n__S_SIZE_KMG______________Break_into_sparse_files_no_larger_than_SIZE._n___slot_SLOT________________Use_SLOT__all_for_both_slots__other_for_n____________________________non_current_slot__default:_current_active_slot_._n___set_active_SLOT_________Sets_the_active_slot_before_rebooting._n___skip_secondary___________Dont_flash_secondary_slots_in_flashall_update._n___skip_reboot______________Dont_reboot_device_after_flashing._n___disable_verity___________Sets_disable_verity_when_flashing_vbmeta._n___disable_verification_____Sets_disable_verification_when_flashing_vbmeta._n___unbuffered_______________Dont_buffer_input_or_output._n___verbose___v______________Verbose_output._n___version__________________Display_version._n___help___h_________________Show_this_message._n
add eax, 0x20
mov dword [esp], eax
call fcn.0044ef90
jmp 0x4048b5
mov edx, dword [0x4cd620]
mov dword [esp], edx
mov dword [ebp - 0x1f0], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x1f0]
mov ecx, 0x4cb070
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0047d400
sub esp, 8
jmp 0x404827
call sub.msvcrt.dll_abort
mov dword [esp], str.disable_verity
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405286
mov byte [0x4cb06d], 1
jmp 0x404827
mov eax, dword [0x4b1548]
mov esi, dword [ebp + 8]
sub esi, eax
mov dword [ebp - 0x1f0], esi
mov esi, dword [ebp + 0xc]
cmp byte [ebp - 0x1f4], 0
lea ebx, [esi + eax*4]
jne 0x404cd8
mov eax, dword [ebp - 0x1f0]
test eax, eax
jne 0x404cd8
cmp byte [ebp - 0x1f5], 0
je 0x407073
mov edi, dword [0x4cb064]
test edi, edi
je 0x405872
mov dword [ebp - 0x1c8], edi
call fcn.0040a6d0
lea ecx, [ebp - 0x1d0]
mov dword [esp], 0x4b8088
fstp qword [ebp - 0x218]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405378
mov dword [esp], 0x4b8088
lea ecx, [ebp - 0x1cc]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x40530e
cmp byte [ebp - 0x1f5], 0
jne 0x4053e2
mov eax, dword [ebp - 0x1f0]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x18c], 0
lea eax, [ebx + eax*4]
mov edx, eax
sub edx, ebx
sar edx, 2
test edx, edx
mov dword [ebp - 0x1ec], eax
jne 0x4052ca
add edi, esi
cmp ebx, dword [ebp - 0x1ec]
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x18c], edi
je 0x405ec4
lea edi, [ebp - 0x178]
test esi, esi
mov edx, dword [ebx]
je 0x404b3c
mov dword [esp + 4], edi
mov ecx, esi
mov dword [esp], edx
call fcn.0047e2b0
sub esp, 8
add ebx, 4
add esi, 4
cmp dword [ebp - 0x1ec], ebx
jne 0x404b25
cmp dword [ebp - 0x194], esi
mov dword [ebp - 0x190], esi
je 0x406c0d
lea eax, [ebp - 0x194]
mov dword [ebp - 0x1ec], eax
movzx eax, byte [ebp - 0x1fc]
lea esi, [ebp - 0x1c4]
mov byte [ebp - 0x1f7], 0
lea edi, [ebp - 0x178]
mov byte [ebp - 0x20c], 0
mov dword [ebp - 0x210], eax
jmp 0x404be6
mov edx, dword [ebp - 0x1ec]
mov eax, edi
call fcn.00401eb0
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.0040c640
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40650d
mov eax, dword [ebp - 0x1c4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x4063cb
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x190], eax
je 0x405187
mov edx, dword [ebp - 0x1ec]
mov eax, esi
call fcn.00401eb0
mov ecx, esi
mov dword [esp], str.getvar
call fcn.00454fb0
sub esp, 4
test eax, eax
je 0x404b91
mov dword [esp], str.erase
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x404d47
mov edx, dword [ebp - 0x1ec]
lea ebx, [ebp - 0x188]
mov eax, ebx
call fcn.00401eb0
mov dword [esp], 4
mov dword [ebp - 0x170], 0
call fcn.004acbc0
lea edx, [ebp - 0x1c8]
lea ecx, [ebp - 0x1d0]
mov dword [eax], edx
mov edx, ebx
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [ebp - 0x16c], 0x4022c0
mov dword [ebp - 0x170], 0x4018b0
call fcn.00402c10
mov eax, dword [ebp - 0x170]
test eax, eax
je 0x404ca5
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
je 0x404bbf
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404bbf
mov dword [esp], edi
call fcn.0047cb80
push ecx
jmp 0x404bbf
mov eax, dword [ebp - 0x1f0]
test eax, eax
jle 0x404a5f
mov eax, dword [ebx]
mov edi, str.devices
mov ecx, 8
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta cl
setb dl
sub ecx, edx
movsx edi, cl
test edi, edi
je 0x405861
mov edi, str.help
mov esi, eax
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
sub edx, eax
movsx edi, dl
test edi, edi
jne 0x404a5f
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.usage:_fastboot__OPTION...__COMMAND..._n_nflashing:_n_update_ZIP_________________Flash_all_partitions_from_an_update.zip_package._n_flashall___________________Flash_all_partitions_from__ANDROID_PRODUCT_OUT._n____________________________On_A_B_devices__flashed_slot_is_set_as_active._n____________________________Secondary_images_may_be_flashed_to_inactive_slot._n_flash_PARTITION__FILENAME__n____________________________Flash_given_partition_only._n_nbasics:_n_devices___l________________List_devices_in_bootloader___l:_with_device_paths_._n_getvar_NAME________________Display_given_bootloader_variable._n_reboot__bootloader_________Reboot_device._n_nlocking_unlocking:_n_flashing_lockunlock_______Lock_unlock_partitions_for_flashing_n_flashing_lock_criticalunlock_critical_n____________________________Lock_unlock_critical_bootloader_partitions._n_flashing_get_unlock_ability_n____________________________Check_whether_unlocking_is_allowed__1__or_not_0_._n_nadvanced:_n_erase_PARTITION____________Erase_a_flash_partition._n_format_:FS_TYPE_:SIZE___PARTITION_n____________________________Format_a_flash_partition._n_set_active_SLOT____________Set_the_active_slot._n_oem__COMMAND...____________Execute_OEM_specific_command._n_nboot_image:_n_boot_KERNEL__RAMDISK__SECOND___n____________________________Download_and_boot_kernel_from_RAM._n_flash:raw_PARTITION_KERNEL__RAMDISK__SECOND___n____________________________Create_boot_image_and_flash_it._n___cmdline_CMDLINE__________Override_kernel_command_line._n___base_ADDRESS_____________Set_kernel_base_address__default:_0x10000000_._n___kernel_offset____________Set_kernel_offset__default:_0x00008000_._n___ramdisk_offset___________Set_ramdisk_offset__default:_0x01000000_._n___tags_offset______________Set_tags_offset__default:_0x00000100_._n___page_size_BYTES__________Set_flash_page_size__default:_2048_._n___header_version_VERSION___Set_boot_image_header_version._n___os_version_MAJOR_.MINOR_.PATCH___n____________________________Set_boot_image_OS_version__default:_0.0.0_._n___os_patch_level_YYYY_MM_DD_n____________________________Set_boot_image_OS_security_patch_level._n_nAndroid_Things:_n_stage_IN_FILE______________Sends_given_file_to_stage_for_the_next_command._n_get_staged_OUT_FILE________Writes_data_staged_by_the_last_command_to_a_file._n_noptions:_n__w_________________________Wipe_userdata._n__s_SERIAL__________________Specify_a_USB_device._n__s_tcpudp:HOST_:PORT______Specify_a_network_device._n__S_SIZE_KMG______________Break_into_sparse_files_no_larger_than_SIZE._n___slot_SLOT________________Use_SLOT__all_for_both_slots__other_for_n____________________________non_current_slot__default:_current_active_slot_._n___set_active_SLOT_________Sets_the_active_slot_before_rebooting._n___skip_secondary___________Dont_flash_secondary_slots_in_flashall_update._n___skip_reboot______________Dont_reboot_device_after_flashing._n___disable_verity___________Sets_disable_verity_when_flashing_vbmeta._n___disable_verification_____Sets_disable_verification_when_flashing_vbmeta._n___unbuffered_______________Dont_buffer_input_or_output._n___verbose___v______________Verbose_output._n___version__________________Display_version._n___help___h_________________Show_this_message._n
add eax, 0x20
mov dword [esp], eax
call fcn.0044ef90
jmp 0x4048b5
mov dword [esp + 4], str.format
mov dword [esp], esi
call fcn.0042b000
test al, al
je 0x404fa7
lea eax, [ebp - 0x1ac]
mov ecx, edi
mov dword [esp + 4], eax
lea ebx, [ebp - 0x188]
mov dword [esp], 0x4b98a1
mov dword [ebp - 0x1f0], eax
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0042b220
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407258
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x204], eax
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1b4], 0x4b717c
sub eax, edx
cmp eax, 7
jbe 0x405160
mov ebx, dword [edx + 4]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x1b4]
mov dword [esp], ebx
mov ecx, edx
mov dword [ebp - 0x208], edx
lea ebx, [ebp - 0x1b0]
mov dword [esp + 4], eax
call fcn.0047d400
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x1b0], 0x4b717c
mov dword [ebp - 0x200], ebx
sub eax, edx
sub esp, 8
cmp eax, 0xb
jbe 0x404e49
mov ebx, dword [edx + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov ecx, dword [ebp - 0x200]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0047d400
sub esp, 8
mov edx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x1f0]
call fcn.00401eb0
mov dword [esp], 0xc
mov dword [ebp - 0x170], 0
call fcn.004acbc0
lea edx, [ebp - 0x1c8]
mov ebx, dword [ebp - 0x204]
mov ecx, ebx
mov dword [eax], edx
mov edx, dword [ebp - 0x208]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x200]
mov dword [eax + 8], edx
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x1bc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x16c], 0x404440
mov dword [ebp - 0x170], 0x401790
mov dword [esp], eax
call fcn.0047e2b0
mov eax, dword [ebp - 0x1c8]
lea ecx, [ebp - 0x1d0]
mov edx, ebx
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.00402c10
mov eax, dword [ebp - 0x1a0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40702b
mov eax, dword [ebp - 0x170]
test eax, eax
je 0x404f15
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
mov eax, dword [ebp - 0x1ac]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407349
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40732b
mov eax, dword [ebp - 0x1b4]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407367
mov edx, dword [ebp - 0x184]
mov ebx, dword [ebp - 0x188]
cmp edx, ebx
je 0x40527f
mov dword [ebp - 0x1f0], edx
nop
mov eax, dword [ebx]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40638a
add ebx, 4
cmp dword [ebp - 0x1f0], ebx
jne 0x404f70
mov eax, dword [ebp - 0x188]
test eax, eax
je 0x404bbf
mov dword [esp], eax
call fcn.004acb10
jmp 0x404bbf
mov dword [esp], str.signature
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405110
mov edx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1a0]
call fcn.00401eb0
lea eax, [ebp - 0x1ac]
mov ecx, edi
mov dword [ebp - 0x1f0], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0047e2b0
lea edx, [ebp - 0x1a8]
mov eax, edi
sub esp, 8
call fcn.00401570
mov edx, dword [ebp - 0x178]
lea ecx, [edx - 0xc]
cmp ecx, 0x4b7170
mov dword [ebp - 0x1d8], eax
jne 0x4074f9
mov ebx, eax
test ebx, ebx
je 0x4074cf
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1a4]
mov ecx, edx
xor ch, 1
or ecx, eax
jne 0x40751f
mov eax, dword [ebp - 0x1f0]
mov ecx, edi
mov dword [esp], str.signature
mov dword [esp + 4], eax
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 8], 0x100
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.0040c800
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407307
lea ebx, [ebp - 0x188]
lea eax, [ebp - 0x1b0]
mov ecx, edi
mov dword [esp + 4], eax
mov dword [esp], str.installing_signature
call fcn.0047e2b0
lea eax, [ebp - 0x1b4]
mov ecx, ebx
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.signature
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040c7d0
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407477
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407459
mov eax, dword [ebp - 0x1a0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
je 0x404bbf
jmp 0x404cba
mov dword [esp], 0x4b98cb
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x40525a
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x194]
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
je 0x4054b5
mov byte [ebp - 0x20c], 1
cmp edx, ecx
je 0x404bbf
mov dword [esp], str.junk_after_reboot_command
call fcn.004aeaf3
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], 0x4b717c
mov dword [ebp - 0x200], eax
jmp 0x404e49
movzx eax, byte [ebp - 0x1f6]
xor eax, 1
mov byte [ebp - 0x1f6], al
movzx eax, byte [ebp - 0x20c]
and byte [ebp - 0x1f6], al
cmp byte [ebp - 0x1f4], 0
jne 0x40550f
cmp byte [ebp - 0x1f5], 0
jne 0x4052ec
cmp byte [ebp - 0x1f6], 0
jne 0x4052ff
cmp byte [ebp - 0x1f7], 0
jne 0x405be0
mov eax, dword [ebp - 0x1c8]
mov dword [esp], eax
call fcn.0040b6d0
or eax, edx
setne al
movzx eax, al
mov edi, eax
call fcn.0040a6d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Finished._Total_time:__.3fs_n
add eax, 0x40
mov dword [esp], eax
fsub qword [ebp - 0x218]
fstp qword [esp + 8]
call fcn.0044ef90
mov esi, dword [ebp - 0x190]
mov ebx, dword [ebp - 0x194]
cmp esi, ebx
je 0x405245
mov eax, dword [ebx]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x4070fb
add ebx, 4
cmp esi, ebx
jne 0x405227
mov esi, dword [ebp - 0x194]
test esi, esi
je 0x4048b5
mov dword [esp], esi
call fcn.004acb10
jmp 0x4048b5
mov dword [esp], str.reboot_bootloader
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405b30
mov byte [ebp - 0x1f7], 1
jmp 0x404bbf
mov eax, edx
jmp 0x404f92
mov dword [esp], str.header_version
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x40581d
mov eax, dword [0x4cd620]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4cb0a8], eax
jmp 0x404827
cmp edx, 0x3fffffff
ja 0x407143
lea edi, [edx*4]
mov dword [esp], edi
call fcn.004acbc0
mov esi, eax
jmp 0x404b05
lea eax, [ebp - 0x1cc]
mov dword [esp], eax
call fcn.0040bde0
jmp 0x4051be
call fcn.0040c740
call fcn.0040cb80
jmp 0x4051d8
mov edx, dword [ebp - 0x1c8]
lea esi, [ebp - 0x178]
mov eax, esi
mov dword [esp], 0
lea ecx, [ebp - 0x1cc]
call fcn.00402400
lea ecx, [ebp - 0x1cc]
mov dword [esp], esi
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
sub esp, 4
cmp ecx, 0x4b7170
je 0x404ab8
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404ab8
lea eax, [ebp - 0x188]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x404ab8
mov edx, dword [ebp - 0x1c8]
lea esi, [ebp - 0x178]
mov eax, esi
mov dword [esp], 1
lea ecx, [ebp - 0x1d0]
call fcn.00402400
lea ecx, [ebp - 0x1d0]
mov dword [esp], esi
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
sub esp, 4
cmp ecx, 0x4b7170
je 0x404a9b
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404a9b
lea eax, [ebp - 0x188]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x404a9b
mov dword [esp], 0x4b8088
lea ecx, [ebp - 0x1cc]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x404ac5
mov dword [esp], 0x4b8088
lea ecx, [ebp - 0x1d0]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x40610c
lea eax, [ebp - 0x1a0]
lea esi, [ebp - 0x178]
mov ecx, esi
mov dword [esp + 4], eax
mov dword [esp], str.current_slot
mov dword [ebp - 0x188], 0x4b717c
call fcn.0047e2b0
lea eax, [ebp - 0x188]
mov dword [ebp - 0x200], eax
sub esp, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0040bba0
mov edi, eax
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x194]
mov dword [esp], eax
mov dword [ebp - 0x1ec], eax
call fcn.0047cba0
mov eax, edi
sub esp, 4
test al, al
jne 0x406531
mov byte [ebp - 0x1f5], 0
mov eax, dword [ebp - 0x188]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.0047cba0
sub esp, 4
jmp 0x404ac5
mov edx, dword [ebp - 0x1ec]
mov eax, edi
call fcn.00401eb0
mov ecx, edi
mov dword [esp], str.bootloader
call fcn.00454fb0
sub esp, 4
test eax, eax
mov eax, dword [ebp - 0x178]
jne 0x4074bf
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40749b
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x194]
mov byte [ebp - 0x1f7], 1
mov byte [ebp - 0x20c], 0
jmp 0x40514c
lea eax, [ebp - 0x1b0]
lea esi, [ebp - 0x178]
mov dword [esp + 4], eax
mov ecx, esi
mov edi, esi
mov dword [esp], str.userdata
mov dword [ebp - 0x1f0], eax
call fcn.0047e2b0
lea eax, [ebp - 0x1ac]
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x1fc], eax
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.cache
call fcn.0047e2b0
lea eax, [ebp - 0x1a0]
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x208], eax
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.metadata
call fcn.0047e2b0
sub esp, 8
mov dword [esp], 0xc
call fcn.004acbc0
mov dword [ebp - 0x204], eax
mov ebx, eax
test ebx, ebx
je 0x4055a7
mov dword [esp], edi
mov ecx, ebx
call fcn.0047e350
sub esp, 4
add edi, 4
add ebx, 4
lea eax, [ebp - 0x16c]
cmp edi, eax
jne 0x405596
sub edi, 4
mov eax, dword [edi]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40711f
cmp edi, esi
jne 0x4055b7
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x188]
mov dword [ebp - 0x200], edx
cmp ebx, eax
mov edi, eax
je 0x4057fc
mov dword [ebp - 0x1f4], ebx
mov ebx, dword [ebp - 0x200]
mov dword [ebp - 0x1ec], esi
jmp 0x40561e
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x4057ae
add edi, 4
cmp dword [ebp - 0x1f4], edi
je 0x4057d2
mov eax, dword [ebp - 0x1f0]
mov ecx, ebx
mov dword [esp], str.partition_type:
mov dword [ebp - 0x1ac], 0x4b717c
mov dword [esp + 4], eax
call fcn.0047e2b0
mov ecx, ebx
sub esp, 8
mov dword [esp], edi
call fcn.0047d160
mov edx, dword [eax]
sub esp, 4
mov dword [ebp - 0x178], edx
mov dword [eax], 0x4b717c
mov eax, dword [ebp - 0x1fc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1ec]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c8]
mov dword [esp], eax
call fcn.0040bba0
mov edx, dword [ebp - 0x178]
lea ecx, [edx - 0xc]
cmp ecx, 0x4b7170
jne 0x406c92
mov edx, dword [ebp - 0x188]
lea ecx, [edx - 0xc]
cmp ecx, 0x4b7170
jne 0x406c62
test al, al
mov eax, dword [ebp - 0x1ac]
je 0x405600
mov esi, dword [eax - 0xc]
test esi, esi
je 0x405600
mov dword [esp], edi
call fcn.0040bee0
mov ecx, edi
mov dword [esp], str.userdata
call fcn.00454fb0
mov ecx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1b4]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x4b8088
call fcn.0047e2b0
lea eax, [ebp - 0x1b8]
mov ecx, ebx
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x4b8088
call fcn.0047e2b0
mov esi, dword [ebp - 0x208]
lea eax, [ebp - 0x1bc]
mov ecx, esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x4b8088
call fcn.0047e2b0
mov eax, dword [ebp - 0x1ec]
mov ecx, 1
mov edx, edi
sub esp, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00403c80
mov eax, dword [ebp - 0x1a0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x4070d7
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406c3e
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406c20
mov eax, dword [ebp - 0x1ac]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
je 0x40560f
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40560f
mov eax, dword [ebp - 0x1ec]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x40560f
mov ebx, dword [ebp - 0x1f4]
mov esi, dword [ebp - 0x1ec]
mov edi, dword [ebp - 0x204]
mov eax, dword [edi]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407385
add edi, 4
cmp ebx, edi
jne 0x4057e4
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x4051b1
mov eax, dword [ebp - 0x204]
mov dword [esp], eax
call fcn.004acb10
jmp 0x4051b1
mov dword [esp], str.kernel_offset
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405c6a
mov eax, dword [0x4cd620]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4cb08c], eax
jmp 0x404827
mov dword [esp], 0x402620
call fcn.0040af40
jmp 0x4048b5
mov eax, dword [0x4cb704]
mov dword [ebp - 0x1a0], 0x4b717c
mov dword [ebp - 0x194], 0
test eax, eax
je 0x405edd
lea edx, [ebp - 0x188]
lea esi, [ebp - 0x178]
mov ecx, esi
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x200], edx
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 4], str.tcp:
mov dword [esp], esi
call fcn.0042b000
mov edi, eax
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40704f
mov eax, edi
test al, al
je 0x4060aa
mov eax, dword [0x4cb704]
mov dword [ebp - 0x194], 0x15b2
mov dword [ebp - 0x1ec], 0
lea edi, [eax + 4]
test edi, edi
je 0x405997
lea eax, [ebp - 0x1a8]
mov ecx, esi
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x188], 0x4b717c
call fcn.0047e2b0
mov eax, dword [ebp - 0x200]
sub esp, 8
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x194]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1a0]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0042a900
mov byte [ebp - 0x200], al
mov eax, dword [ebp - 0x178]
lea edx, [eax - 0xc]
cmp edx, 0x4b7170
jne 0x4070b1
cmp byte [ebp - 0x200], 0
mov eax, dword [ebp - 0x188]
je 0x40709d
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x40707f
mov eax, dword [ebp - 0x1a0]
mov esi, 1
mov dword [ebp - 0x200], ebx
mov ebx, esi
mov esi, dword [ebp - 0x1ec]
jmp 0x405a85
lea eax, [ebp - 0x188]
test esi, esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x188], 0x4b717c
mov dword [esp + 8], eax
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x178]
mov dword [esp], eax
je 0x405aa8
call fcn.0040a670
mov eax, dword [ebp - 0x178]
mov dword [0x4cb064], eax
test eax, eax
je 0x405abd
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406fbf
mov edi, dword [0x4cb064]
test edi, edi
jne 0x405aec
test bl, bl
je 0x405a59
mov edx, dword [0x4cb704]
mov eax, str.any_device
mov dword [esp + 4], str.__waiting_for__s___n
test edx, edx
cmovne eax, edx
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
mov dword [esp + 8], 0xf4240
xor ebx, ebx
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.00481c20
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x4059b5
mov dword [esp], 0x401500
call fcn.0040af40
mov dword [0x4cb064], eax
mov edi, eax
jmp 0x405a21
call fcn.00409ab0
mov eax, dword [ebp - 0x178]
mov dword [0x4cb064], eax
jmp 0x4059fe
test bl, bl
je 0x405a06
mov eax, dword [ebp - 0x188]
mov dword [esp + 4], str.error:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
jmp 0x405a06
mov edx, dword [ebp - 0x1a0]
mov ebx, dword [ebp - 0x200]
lea ecx, [edx - 0xc]
cmp ecx, 0x4b7170
je 0x404a6d
or esi, 0xffffffff
lock xadd dword [edx - 4], esi
test esi, esi
jg 0x404a6d
lea esi, [ebp - 0x178]
mov dword [esp], esi
call fcn.0047cb80
push eax
jmp 0x404a6d
mov dword [esp], str.continue
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405caa
lea eax, [ebp - 0x1ac]
mov ecx, edi
mov dword [esp + 4], eax
lea ebx, [ebp - 0x188]
mov dword [esp], str.resuming_boot
call fcn.0047e2b0
lea eax, [ebp - 0x1b0]
mov ecx, ebx
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.continue
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040c7d0
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406fe3
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
je 0x404bbf
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404bbf
mov dword [esp], ebx
call fcn.0047cb80
push eax
jmp 0x404bbf
lea eax, [ebp - 0x1ac]
lea ebx, [ebp - 0x178]
mov dword [esp + 4], eax
mov ecx, ebx
mov dword [esp], str.rebooting_into_bootloader
call fcn.0047e2b0
lea eax, [ebp - 0x188]
mov esi, eax
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x1b0]
mov ecx, esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.reboot_bootloader
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0040c7d0
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406be9
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406bc5
call fcn.0040cb80
jmp 0x4051d8
mov dword [esp], str.os_patch_level
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405ef1
mov eax, dword [0x4cd620]
mov ecx, dword [ebp - 0x1ec]
mov dword [esp], 0x4cb080
mov dword [esp + 4], eax
call fcn.00402790
sub esp, 8
jmp 0x404827
mov dword [esp], str.boot
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x405f31
mov ebx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x200], eax
mov edx, ebx
call fcn.00401eb0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x190], eax
mov dword [ebp - 0x1ac], 0x4b717c
je 0x4064a2
mov edx, ebx
mov eax, edi
call fcn.00401eb0
lea eax, [ebp - 0x1ac]
mov ecx, eax
mov dword [esp], edi
lea ebx, [ebp - 0x188]
mov dword [ebp - 0x1f0], eax
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], ebx
call fcn.0047cba0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a0], 0x4b717c
sub esp, 4
cmp dword [ebp - 0x190], eax
je 0x4073c1
mov edx, dword [ebp - 0x1ec]
mov eax, edi
call fcn.00401eb0
lea eax, [ebp - 0x1a0]
mov ecx, eax
mov dword [esp], edi
mov dword [ebp - 0x204], eax
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], ebx
call fcn.0047cba0
sub esp, 4
lea eax, [ebp - 0x1a8]
mov ecx, dword [ebp - 0x204]
mov dword [esp], eax
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x200]
call fcn.00401f50
mov edx, dword [ebp - 0x1a8]
mov ecx, edi
mov dword [esp], str.boot.img
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], eax
mov dword [ebp - 0x208], eax
call fcn.0047e2b0
mov eax, dword [ebp - 0x200]
mov edx, dword [ebp - 0x1f0]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.0040c800
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x4073a3
lea eax, [ebp - 0x1b8]
mov ecx, edi
mov dword [esp + 4], eax
mov dword [esp], str.booting
call fcn.0047e2b0
lea eax, [ebp - 0x1bc]
mov ecx, ebx
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.boot
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040c7d0
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406b57
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406b39
mov eax, dword [ebp - 0x1a0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406b1b
mov eax, dword [ebp - 0x1ac]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x406afd
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
je 0x404bbf
jmp 0x404cba
mov dword [ebp - 0x190], esi
mov byte [ebp - 0x1f6], 0
mov byte [ebp - 0x1f7], 0
jmp 0x4051a4
mov eax, 0x4b717c
mov dword [ebp - 0x1ec], 0
jmp 0x40599d
mov dword [esp], str.os_version
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x40615c
mov eax, dword [0x4cd620]
mov ecx, dword [ebp - 0x1ec]
mov dword [esp], 0x4cb080
mov dword [esp + 4], eax
call fcn.004044c0
sub esp, 8
jmp 0x404827
mov dword [esp], str.flash
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x4061b0
mov ebx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1f0], eax
mov edx, ebx
call fcn.00401eb0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x190], eax
mov dword [ebp - 0x1a0], 0x4b717c
je 0x40715e
mov edx, ebx
mov eax, edi
call fcn.00401eb0
lea eax, [ebp - 0x1a0]
mov ecx, eax
mov dword [esp], edi
lea ebx, [ebp - 0x188]
mov dword [ebp - 0x204], eax
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], ebx
call fcn.0047cba0
sub esp, 4
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x407148
mov dword [esp], 8
mov dword [ebp - 0x170], 0
call fcn.004acbc0
lea edx, [ebp - 0x1c8]
mov ecx, ebx
mov dword [eax], edx
mov edx, dword [ebp - 0x204]
mov dword [eax + 4], edx
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x16c], fcn.004035e0
mov dword [ebp - 0x170], 0x401930
mov dword [esp], eax
call fcn.0047e2b0
mov eax, dword [ebp - 0x1c8]
lea ecx, [ebp - 0x1d0]
mov edx, ebx
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.00402c10
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x1b0]
mov dword [esp], eax
call fcn.0047cba0
mov eax, dword [ebp - 0x170]
sub esp, 4
test eax, eax
je 0x40607d
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
mov eax, dword [ebp - 0x1a0]
mov dword [esp], edi
lea ecx, [eax - 0xc]
call fcn.0047cba0
mov eax, dword [ebp - 0x1ac]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], edi
call fcn.0047cba0
sub esp, 4
jmp 0x404bbf
mov eax, dword [ebp - 0x200]
mov ecx, esi
mov dword [esp + 4], eax
mov eax, dword [0x4cb704]
mov dword [esp], eax
call fcn.0047e2b0
sub esp, 8
mov dword [esp + 4], str.udp:
mov dword [esp], esi
call fcn.0042b000
mov edi, eax
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
cmp ecx, 0x4b7170
jne 0x407007
mov eax, edi
test al, al
jne 0x4063aa
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1ec], 0
jmp 0x40599d
mov edx, dword [ebp - 0x1c8]
lea esi, [ebp - 0x178]
mov eax, esi
mov dword [esp], 0
lea ecx, [ebp - 0x1d0]
call fcn.00402400
lea ecx, [ebp - 0x1cc]
mov dword [esp], esi
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x188]
sub esp, 4
mov dword [esp], eax
call fcn.0047cba0
sub esp, 4
jmp 0x404ac5
mov dword [esp], str.page_size
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x4063f0
mov eax, dword [0x4cd620]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
test eax, eax
mov dword [0x4cb0a4], eax
jne 0x404827
mov dword [esp], str.invalid_page_size
call fcn.0040a700
nop
mov dword [esp], str.flash:raw
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x406434
mov ebx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x200], eax
mov edx, ebx
call fcn.00401eb0
lea eax, [ebp - 0x1ac]
mov edx, ebx
mov dword [ebp - 0x1f0], eax
call fcn.00401eb0
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a0], 0x4b717c
je 0x4064f6
mov edx, dword [ebp - 0x1ec]
mov eax, edi
lea ebx, [ebp - 0x188]
call fcn.00401eb0
lea eax, [ebp - 0x1a0]
mov ecx, eax
mov dword [esp], edi
mov dword [ebp - 0x204], eax
call fcn.0047ce10
push eax
mov eax, dword [ebp - 0x178]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.0047cba0
push eax
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x194]
mov dword [ebp - 0x188], 0x4b717c
je 0x406295
mov edx, dword [ebp - 0x1ec]
mov eax, edi
call fcn.00401eb0
mov ecx, ebx
mov dword [esp], edi
call fcn.0047ce10
push eax
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x1b4]
mov dword [esp], eax
call fcn.0047cba0
push eax
lea eax, [ebp - 0x1a8]
mov edx, dword [ebp - 0x204]
mov ecx, ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x1f0]
call fcn.00401f50
mov dword [esp], 8
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x1d8], eax
call fcn.004acbc0
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x1d0]
mov dword [eax], edx
lea edx, [ebp - 0x1a8]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x200]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [ebp - 0x16c], 0x401700
mov dword [ebp - 0x170], 0x4019c0
call fcn.00402c10
mov eax, dword [ebp - 0x170]
test eax, eax
je 0x406335
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
mov eax, dword [ebp - 0x188]
mov dword [esp], edi
lea ecx, [eax - 0xc]
call fcn.0047cba0
mov eax, dword [ebp - 0x1a0]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], edi
call fcn.0047cba0
mov eax, dword [ebp - 0x1ac]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], edi
call fcn.0047cba0
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], edi
call fcn.0047cba0
sub esp, 4
jmp 0x404bbf
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404f81
mov dword [esp], edi
call fcn.0047cb80
push eax
jmp 0x404f81
mov eax, dword [0x4cb704]
mov dword [ebp - 0x194], 0x15b2
mov dword [ebp - 0x1ec], 1
lea edi, [eax + 4]
jmp 0x405903
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404bd4
mov dword [esp], edi
call fcn.0047cb80
push eax
jmp 0x404bd4
mov dword [esp], str.ramdisk_offset
lea ecx, [ebp - 0x188]
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x4064cf
mov eax, dword [0x4cd620]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4cb094], eax
jmp 0x404827
mov dword [esp], str.flashall
mov ecx, esi
call fcn.00454fb0
sub esp, 4
test eax, eax
jne 0x4065bf
mov dword [esp], 0x4b841d
lea ecx, [ebp - 0x1d0]
call fcn.00454fb0
test eax, eax
push ebx
jne 0x4073d2
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
mov eax, dword [ebp - 0x1c8]
mov ecx, 1
lea edx, [ebp - 0x1d0]
call fcn.004aec30
mov byte [ebp - 0x20c], 1
jmp 0x404bbf
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x204], eax
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1a0], 0x4b717c
lea ebx, [ebp - 0x188]
mov dword [ebp - 0x1f0], eax
jmp 0x405d8a
mov dword [esp], str.skip_reboot
lea ecx, [ebp - 0x188]
call fcn.00454fb0
test eax, eax
push edx
jne 0x407282
mov byte [ebp - 0x1f6], 1
jmp 0x404827
lea edx, [ebp - 0x1a0]
lea ebx, [ebp - 0x188]
mov dword [ebp - 0x204], edx
jmp 0x406253
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404bbf
lea ebx, [ebp - 0x188]
mov dword [esp], ebx
call fcn.0047cb80
push eax
jmp 0x404bbf
mov edx, dword [ebp - 0x1c8]
mov eax, esi
mov ecx, dword [ebp - 0x200]
mov dword [esp], 0
call fcn.00402400
lea ecx, [ebp - 0x1cc]
mov dword [esp], esi
call fcn.0047ce10
push eax
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
mov eax, dword [ebp - 0x1ec]
mov dword [esp], eax
call fcn.0047cba0
push eax
jmp 0x40549c
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4048df
lea eax, [ebp - 0x178]
mov dword [esp], eax
call fcn.0047cb80
push ebx
jmp 0x4048df
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4048ca
lea eax, [ebp - 0x178]
mov dword [esp], eax
call fcn.0047cb80
push esi
jmp 0x4048ca
mov ecx, esi
mov dword [esp], str.update
call fcn.00454fb0
test eax, eax
push ecx
jne 0x406cfa
mov dword [esp], 0x4b841d
lea ecx, [ebp - 0x1d0]
call fcn.00454fb0
test eax, eax
push edx
sete byte [ebp - 0x1f0]
jne 0x40660c
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
mov dword [esp + 4], edi
lea ecx, [ebp - 0x1c0]
mov dword [esp], str.update.zip
lea ebx, [ebp - 0x188]
call fcn.0047e2b0
push eax
push eax
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x190], eax
je 0x40666c
mov edx, dword [ebp - 0x1ec]
mov eax, edi
lea ebx, [ebp - 0x188]
call fcn.00401eb0
lea ecx, [ebp - 0x1c0]
mov dword [esp], edi
call fcn.0047ce10
push eax
mov eax, dword [ebp - 0x178]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.0047cba0
push eax
movzx eax, byte [ebp - 0x1f0]
or eax, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1c8]
mov byte [ebp - 0x208], al
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x200], eax
call fcn.004ae40a
mov ecx, edi
mov dword [esp + 4], ebx
mov dword [esp], str.product
call fcn.0047e2b0
push eax
push eax
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x4cb020
mov dword [esp], edi
call fcn.0040c6c0
mov edx, dword [ebp - 0x178]
lea ecx, [edx - 0xc]
lea edx, [ebp - 0x1a0]
mov dword [esp], edx
mov dword [ebp - 0x204], edx
call fcn.0047cba0
lea edx, [ebp - 0x1bc]
push eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040f660
test eax, eax
jne 0x406cd8
mov ecx, dword [ebp - 0x204]
mov edx, str.android_info.txt
mov eax, dword [ebp - 0x1bc]
call fcn.00401d90
test eax, eax
je 0x406cc2
mov edx, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x19c]
mov dword [esp], edx
mov edx, eax
mov eax, dword [ebp - 0x1f0]
mov dword [esp + 4], ecx
call fcn.004ae5df
cmp byte [ebp - 0x208], 0
mov dword [ebp - 0x1b8], 0x4b717c
je 0x406a6c
mov dword [ebp - 0x1b4], 0
mov byte [ebp - 0x208], 1
xor eax, eax
jmp 0x406971
mov eax, dword [ebp - 0x164]
mov dword [esp + 4], str.extracting__s___u_MB__to_disk...
shr eax, 0x14
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x204]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
call fcn.0040a6d0
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x21c]
fstp qword [ebp - 0x228]
mov dword [esp], eax
call fcn.0040e970
test eax, eax
jne 0x406e2d
mov eax, dword [ebp - 0x200]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.00442e90
or edx, eax
jne 0x406e4f
call fcn.0040a6d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str._took__.3fs_n
add eax, 0x40
mov dword [esp], eax
fsub qword [ebp - 0x228]
fstp qword [esp + 8]
call fcn.0044ef90
cmp dword [ebp - 0x200], 0xffffffff
je 0x406a38
mov edx, dword [ebp - 0x200]
mov ecx, edi
mov eax, dword [ebp - 0x1f0]
call fcn.00402e20
test al, al
je 0x406d71
mov dword [esp], 0xc
mov dword [ebp - 0x180], 0
call fcn.004acbc0
lea edx, [ebp - 0x1bc]
lea ecx, [ebp - 0x1ac]
mov dword [eax], edx
lea edx, [ebp - 0x1b4]
mov dword [eax + 4], edx
mov dword [eax + 8], edi
mov dword [ebp - 0x188], eax
lea eax, [ebp - 0x1d9]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x17c], 0x403970
mov dword [ebp - 0x180], 0x401820
mov dword [esp], eax
call fcn.0047e2b0
lea eax, [ebp - 0x1b0]
mov edx, eax
lea eax, [ebp - 0x1da]
mov ecx, edx
mov dword [ebp - 0x200], edx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1b4]
lea eax, [eax + eax*4]
mov eax, dword [eax*4 + 0x4b116c]
mov dword [esp], eax
call fcn.0047e2b0
mov edx, dword [ebp - 0x200]
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x1f0]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00402c10
mov ecx, dword [ebp - 0x1b0]
lea eax, [ebp - 0x1db]
mov dword [esp], eax
sub ecx, 0xc
call fcn.0047cba0
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0x1ac]
sub ecx, 0xc
sub esp, 4
mov dword [esp], eax
call fcn.0047cba0
mov eax, dword [ebp - 0x180]
sub esp, 4
test eax, eax
je 0x406959
mov dword [esp + 8], 3
mov dword [esp + 4], ebx
mov dword [esp], ebx
call eax
mov eax, dword [ebp - 0x1b4]
add eax, 1
cmp eax, 0xb
mov dword [ebp - 0x1b4], eax
ja 0x406e79
mov edx, dword [ebp - 0x1d0]
mov dword [ebp - 0x20c], edx
lea edx, [eax + eax*4]
cmp byte [edx*4 + 0x4b1171], 0
je 0x40699f
cmp byte [ebp - 0x208], 0
jne 0x406959
mov edx, dword [ebp - 0x1b8]
mov dword [ebp - 0x20c], edx
lea eax, [eax + eax*4]
mov edx, dword [ebp - 0x1bc]
mov eax, dword [eax*4 + 0x4b1164]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x204], eax
call fcn.00401660
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov ecx, ebx
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x204]
mov dword [esp], eax
call fcn.0040db60
mov edx, dword [ebp - 0x21c]
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.0040e3e0
test eax, eax
je 0x406773
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], str.archive_does_not_contain__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
cmp dword [ebp - 0x200], 0xffffffff
je 0x406a38
mov eax, dword [ebp - 0x200]
mov dword [esp], eax
call sub.msvcrt.dll__close
mov eax, dword [ebp - 0x1b4]
lea edx, [eax + eax*4]
cmp byte [edx*4 + 0x4b1170], 0
lea ecx, [edx*4]
jne 0x40695f
mov eax, dword [ecx + 0x4b1164]
mov dword [esp], str.non_optional_file__s_missing
mov dword [esp + 4], eax
call fcn.0040a700
lea ecx, [ebp - 0x1d0]
mov dword [esp], 0x4b8088
call fcn.00454fb0
test eax, eax
push ecx
je 0x406bb3
mov eax, dword [ebp - 0x1f0]
call fcn.00401c40
lea edx, [ebp - 0x1d0]
mov ecx, eax
mov eax, edi
call fcn.00401730
lea eax, [ebp - 0x1b8]
mov ecx, eax
mov dword [esp], edi
mov dword [ebp - 0x200], eax
call fcn.0047ce10
mov eax, dword [ebp - 0x178]
push ecx
lea ecx, [eax - 0xc]
mov dword [esp], ebx
call fcn.0047cba0
push eax
mov eax, dword [ebp - 0x200]
mov dword [esp], 0x4b8088
mov ecx, eax
call fcn.00454fb0
mov byte [ebp - 0x208], 0
test eax, eax
push edx
je 0x406b7b
mov dword [ebp - 0x1b4], 0
jmp 0x40676c
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405eaa
mov dword [esp], edi
call fcn.0047cb80
push ebx
jmp 0x405eaa
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405e95
mov dword [esp], edi
call fcn.0047cb80
push eax
jmp 0x405e95
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405e80
mov dword [esp], ebx
call fcn.0047cb80
push eax
jmp 0x405e80
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405e6b
mov eax, dword [ebp - 0x208]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x405e6b
mov eax, dword [ebp - 0x1f0]
call fcn.00401c40
mov byte [ebp - 0x208], 1
sub eax, 1
jle 0x406aee
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Warning:_Could_not_determine_slot_for_secondary_images._Ignoring._n
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
jmp 0x406aee
mov edx, dword [ebp - 0x1f0]
mov eax, edi
call fcn.004aea38
jmp 0x406aa1
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405c60
mov eax, dword [ebp - 0x200]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x405c60
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405c4b
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x405c4b
mov byte [ebp - 0x1f6], 0
mov byte [ebp - 0x1f7], 0
jmp 0x4051a4
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405799
mov dword [esp], ebx
call fcn.0047cb80
push eax
jmp 0x405799
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405784
mov eax, dword [ebp - 0x208]
mov dword [esp], eax
call fcn.0047cb80
push edx
jmp 0x405784
or esi, 0xffffffff
lock xadd dword [edx - 4], esi
test esi, esi
jg 0x4056aa
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x1ec]
mov dword [esp], eax
call fcn.0047cb80
push eax
mov eax, dword [ebp - 0x200]
jmp 0x4056aa
or esi, 0xffffffff
lock xadd dword [edx - 4], esi
test esi, esi
jg 0x405695
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x208]
mov dword [esp], eax
call fcn.0047cb80
push eax
mov eax, dword [ebp - 0x200]
jmp 0x405695
mov eax, dword [ebp - 0x200]
mov dword [esp], str.update_package__s_has_no_android_info.txt
mov dword [esp + 4], eax
call fcn.0040a700
mov dword [esp], eax
call fcn.0040db20
mov dword [esp], str.failed_to_open_zip_file__s:__s
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], eax
call fcn.0040a700
mov dword [esp], 0x4b9b25
mov ecx, esi
call fcn.00454fb0
test eax, eax
push edx
jne 0x406da2
mov edx, dword [ebp - 0x1ec]
mov eax, edi
lea ebx, [ebp - 0x188]
call fcn.00401eb0
mov edx, dword [ebp - 0x1c8]
mov ecx, edi
mov dword [esp], 0
mov eax, ebx
call fcn.00402400
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0047cba0
push eax
mov dword [esp], ebx
call fcn.0040bde0
mov eax, dword [ebp - 0x188]
mov dword [esp], edi
lea ecx, [eax - 0xc]
call fcn.0047cba0
push eax
jmp 0x404bbf
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], str.cannot_load__s_from_flash:__s
mov dword [esp + 8], eax
imul eax, dword [ebp - 0x1b4], 0x14
mov eax, dword [eax + 0x4b1164]
mov dword [esp + 4], eax
call fcn.0040a700
mov dword [esp], str.stage
mov ecx, esi
call fcn.00454fb0
test eax, eax
push ebx
jne 0x406ef9
mov edx, dword [ebp - 0x1ec]
lea ebx, [ebp - 0x188]
mov eax, ebx
call fcn.00401eb0
mov edx, dword [ebp - 0x188]
mov ecx, edi
mov eax, dword [ebp - 0x1c8]
call fcn.00403230
test al, al
je 0x406ee3
cmp dword [ebp - 0x178], 0
jne 0x406ee3
mov eax, dword [ebp - 0x170]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x168]
mov dword [esp + 4], eax
call fcn.0040c910
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0047cba0
push ecx
jmp 0x404bbf
mov dword [esp], eax
call fcn.0040db20
mov dword [esp], str._nfailed_to_extract__s:__s
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], eax
call fcn.0040a700
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], str._nlseek_on_extracted_file__s_failed:__s
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], eax
call fcn.0040a700
mov dword [esp], 0x4b841d
lea ecx, [ebp - 0x1d0]
call fcn.00454fb0
test eax, eax
push edx
je 0x406f3e
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1d0]
call fcn.004aea80
mov eax, dword [ebp - 0x1bc]
mov dword [esp], eax
call fcn.0040d630
mov eax, dword [ebp - 0x1b8]
mov dword [esp], edi
lea ecx, [eax - 0xc]
call fcn.0047cba0
mov eax, dword [ebp - 0x1c0]
push ecx
lea ecx, [eax - 0xc]
mov dword [esp], edi
call fcn.0047cba0
mov byte [ebp - 0x20c], 1
push ebx
jmp 0x404bbf
mov eax, dword [ebp - 0x188]
mov dword [esp], str.cannot_load__s
mov dword [esp + 4], eax
call fcn.0040a700
mov ecx, esi
mov dword [esp], str.get_staged
call fcn.00454fb0
test eax, eax
push ecx
jne 0x406f7c
mov edx, dword [ebp - 0x1ec]
mov eax, edi
call fcn.00401eb0
mov dword [esp], edi
call fcn.0040c9e0
mov eax, dword [ebp - 0x178]
lea ebx, [ebp - 0x188]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.0047cba0
push eax
jmp 0x404bbf
mov ecx, edi
mov dword [esp + 4], ebx
mov dword [esp], 0x4b8421
call fcn.0047e2b0
mov edx, edi
push eax
push eax
mov eax, dword [ebp - 0x1f0]
call fcn.004aea80
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x1ac]
mov dword [esp], eax
call fcn.0047cba0
push eax
jmp 0x406ea5
mov dword [esp], 0x4b9b41
mov ecx, esi
call fcn.00454fb0
test eax, eax
push edx
jne 0x4073f5
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], 0x4b9b41
mov ecx, edi
call fcn.0047e2b0
mov eax, edi
push edx
push edx
mov edx, dword [ebp - 0x1ec]
call fcn.004aeb52
jmp 0x406f21
or edi, 0xffffffff
lock xadd dword [eax - 4], edi
test edi, edi
jg 0x405a1b
lea eax, [ebp - 0x178]
mov dword [esp], eax
call fcn.0047cb80
push edx
jmp 0x405a1b
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405ba6
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x405ba6
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4060ed
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x4060ed
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404efa
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
call fcn.0047cb80
push ecx
jmp 0x404efa
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4058dd
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x4058dd
mov dword [esp], str.no_command
call fcn.004aeaf3
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405997
mov dword [esp], esi
call fcn.0047cb80
push esi
jmp 0x405997
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], str.invalid_network_address__s:__s_n
call fcn.0040a700
or ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x405975
lea eax, [ebp - 0x1ac]
mov ecx, edx
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x405975
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x40576f
mov eax, dword [ebp - 0x1f0]
mov dword [esp], eax
call fcn.0047cb80
push ecx
jmp 0x40576f
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405238
lea eax, [ebp - 0x178]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x405238
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4055cb
lea eax, [ebp - 0x188]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x4055cb
call fcn.004a72a0
mov eax, dword [ebp - 0x1ac]
mov dword [esp], str.cannot_determine_image_filename_for__s
mov dword [esp + 4], eax
call fcn.0040a700
xor ebx, ebx
jmp 0x40716a
add ebx, 1
cmp ebx, 0xc
je 0x4071e1
lea eax, [ebx + ebx*4]
lea edx, [eax*4]
mov eax, dword [eax*4 + 0x4b1160]
mov dword [ebp - 0x200], edx
test eax, eax
je 0x407162
mov ecx, dword [ebp - 0x1f0]
mov dword [esp], eax
call fcn.00454fb0
mov edx, dword [ebp - 0x200]
sub esp, 4
test eax, eax
jne 0x407162
mov edx, dword [edx + 0x4b1164]
mov eax, edi
lea ebx, [ebp - 0x188]
call fcn.004ae3c0
lea eax, [ebp - 0x1a0]
mov ecx, eax
mov dword [esp], edi
mov dword [ebp - 0x204], eax
call fcn.0047ce10
push eax
mov eax, dword [ebp - 0x178]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.0047cba0
push edx
jmp 0x405fbb
mov ecx, dword [ebp - 0x1f0]
mov dword [esp], str.userdata
call fcn.00454fb0
test eax, eax
push edx
je 0x4072bc
mov ecx, dword [ebp - 0x1f0]
mov dword [esp], str.cache
call fcn.00454fb0
test eax, eax
push ebx
je 0x4072a5
mov eax, dword [ebp - 0x1ac]
lea ebx, [ebp - 0x188]
mov dword [esp + 4], str.unknown_partition__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0044ef90
mov ecx, edi
mov dword [esp + 4], ebx
mov dword [esp], 0x4b8088
call fcn.0047e2b0
push ecx
push ecx
jmp 0x4071b3
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
lea eax, [ebp - 0x1a0]
test edx, edx
mov dword [ebp - 0x204], eax
jg 0x404db7
mov dword [esp], eax
call fcn.0047cb80
push ebx
jmp 0x404db7
lea ecx, [ebp - 0x188]
mov dword [esp], str.skip_secondary
call fcn.00454fb0
test eax, eax
push ecx
jne 0x4072d3
mov byte [ebp - 0x1fc], 1
jmp 0x404827
mov edx, str.cache.img
mov eax, edi
call fcn.004ae3c0
lea ebx, [ebp - 0x188]
jmp 0x4071b3
mov edx, str.userdata.img
mov eax, edi
call fcn.004ae3c0
lea ebx, [ebp - 0x188]
jmp 0x4071b3
mov dword [esp], str.slot
lea ecx, [ebp - 0x188]
call fcn.00454fb0
test eax, eax
push edx
jne 0x407533
mov eax, dword [0x4cd620]
lea ecx, [ebp - 0x1d0]
mov dword [esp], eax
call fcn.0047d3d0
push eax
jmp 0x404827
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
lea ebx, [ebp - 0x188]
jg 0x405089
mov dword [esp], ebx
call fcn.0047cb80
push eax
jmp 0x405089
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404f3f
mov dword [esp], edi
call fcn.0047cb80
push eax
jmp 0x404f3f
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404f2a
mov dword [esp], edi
call fcn.0047cb80
push edx
jmp 0x404f2a
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x404f54
mov dword [esp], edi
call fcn.0047cb80
push eax
jmp 0x404f54
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4057f5
mov dword [esp], esi
call fcn.0047cb80
push eax
jmp 0x4057f5
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x405e14
mov dword [esp], ebx
call fcn.0047cb80
push eax
jmp 0x405e14
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x204], eax
jmp 0x405d8a
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x1c8]
call fcn.004aec30
mov byte [ebp - 0x20c], 1
jmp 0x404bbf
mov dword [esp], str.flashing
mov ecx, esi
call fcn.00454fb0
test eax, eax
push ebx
jne 0x407671
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x194]
cmp eax, ecx
je 0x407665
sub eax, ecx
sar eax, 2
sub eax, 1
jne 0x4075e1
mov dword [esp], str.unlock
call fcn.00454fb0
test eax, eax
push ecx
jne 0x407575
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], str.flashing
jmp 0x406fa4
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4050f5
mov dword [esp], ebx
call fcn.0047cb80
push ecx
jmp 0x4050f5
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4050e0
mov eax, dword [ebp - 0x1f0]
mov dword [esp], eax
call fcn.0047cb80
push eax
jmp 0x4050e0
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4054f0
lea ebx, [ebp - 0x188]
mov dword [esp], ebx
call fcn.0047cb80
push edx
jmp 0x4054f0
mov dword [esp + 4], eax
mov dword [esp], str.unknown_reboot_target__s
call fcn.004aeaf3
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], str.could_not_load__s:__s
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1a0]
mov dword [esp + 4], eax
call fcn.0040a700
or eax, 0xffffffff
lock xadd dword [edx - 4], eax
test eax, eax
jg 0x407514
lea ebx, [ebp - 0x188]
mov dword [esp], ebx
call fcn.0047cb80
push eax
mov ebx, dword [ebp - 0x1d8]
jmp 0x40501e
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], str.signature_must_be_256_bytes__got__lld_
call fcn.0040a700
lea ecx, [ebp - 0x188]
mov dword [esp], str.tags_offset
call fcn.00454fb0
test eax, eax
push ecx
jne 0x4075f9
mov eax, dword [0x4cd620]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4cb0a0], eax
jmp 0x404827
mov ecx, dword [ebp - 0x194]
mov dword [esp], str.lock
call fcn.00454fb0
test eax, eax
push edx
je 0x407443
mov ecx, dword [ebp - 0x194]
mov dword [esp], str.unlock_critical
call fcn.00454fb0
test eax, eax
push ebx
je 0x407443
mov ecx, dword [ebp - 0x194]
mov dword [esp], str.lock_critical
call fcn.00454fb0
test eax, eax
push ecx
je 0x407443
mov ecx, dword [ebp - 0x194]
mov dword [esp], str.get_unlock_ability
call fcn.00454fb0
test eax, eax
push edx
je 0x407443
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov dword [esp], str.unknown_flashing_command__s
mov dword [esp + 4], eax
call fcn.004aeaf3
mov dword [esp], str.unbuffered
lea ecx, [ebp - 0x188]
call fcn.00454fb0
test eax, eax
push edx
jne 0x407687
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_setvbuf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_setvbuf
jmp 0x404827
mov dword [esp], str.missing_flashing_command
call fcn.004aeaf3
mov eax, dword [ebp - 0x1c4]
mov dword [esp], str.unknown_command__s
mov dword [esp + 4], eax
call fcn.004aeaf3
mov dword [esp], str.version
lea ecx, [ebp - 0x188]
call fcn.00454fb0
test eax, eax
mov edi, eax
push ebx
jne 0x407719
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], str.28.0.0_4797878
mov dword [esp + 4], str.fastboot_version__s_n
add eax, 0x20
mov dword [esp], eax
call fcn.0044ef90
mov dword [esp], esi
call fcn.004295b0
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.Installed_as__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call fcn.0044ef90
mov eax, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x194]
mov dword [esp], eax
call fcn.0047cba0
mov eax, dword [ebp - 0x188]
lea ecx, [eax - 0xc]
push edx
mov dword [esp], esi
call fcn.0047cba0
push ecx
jmp 0x4048b5
mov eax, dword [ebp - 0x1d4]
mov dword [esp], str.unknown_option__s
shl eax, 4
mov eax, dword [ebp + eax - 0x158]
mov dword [esp + 4], eax
call fcn.0040a700
nop
nop
nop
nop
nop
nop
nop
jmp fcn.00445dd0