Function at 0x140006100
Capabilities:
Create directory
Delete file
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd28]
sub rsp, 0xe00
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0xce0], rax
xor r14d, r14d
mov qword [rbp + 0x50], rcx
mov dword [rsp + 0x50], r14d
mov rsi, rcx
lea r15, [r14 - 1]
test rcx, rcx
je 0x140006c2d
mov ecx, dword [rcx]
mov eax, ecx
and eax, 0x108
cmp eax, 0x108
jne 0x14000617b
lea rcx, str.ERROR:_FLAG_LATEST_cannot_be_used_with_FLAG_CUSTOM._n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
cmp qword [rsi + 0x50], r14
jne 0x14000619d
test ecx, 0x120
jne 0x14000619d
lea rcx, str.ERROR:_no_ipsw_file_given_n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
mov edi, 1
test cl, 2
je 0x1400061bd
mov ecx, edi
call qword [sym.imp.imobiledevice.dll_idevice_set_debug_level]
mov ecx, edi
call qword [sym.imp.irecovery.dll_irecv_set_debug_level]
mov dword [0x14002eae0], edi
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x1400061d7
mov r8, qword [rsi + 0xc0]
xorps xmm1, xmm1
xor ecx, ecx
call rax
lea rcx, [rsi + 0xc8]
mov r8, rsi
lea rdx, [0x140005f60]
call qword [sym.imp.irecovery.dll_irecv_device_event_subscribe]
lea rbx, [0x140005dc0]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.imobiledevice.dll_idevice_event_subscribe]
lea r12, [rsi + 0xd8]
mov qword [rsi + 0xd0], rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsi + 0x88]
lea r13, [0x14002e040]
add r13, 0xfffffffffffffff0
mov qword [rsp + 0x58], r13
cmp rdx, r13
je 0x140008e21
test byte [rsi], dil
jne 0x140008e21
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140006282
mov r8, qword [rsi + 0xc0]
xor ecx, ecx
movsd xmm1, qword [0x140029508]
call rax
mov rdx, qword [rsi + 0x88]
mov rdx, qword [rdx + 8]
lea rcx, str.Found_device_in__s_mode_n
call fcn.140002320
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsi + 0x88]
cmp dword [rax], r14d
jne 0x1400065fa
mov rcx, rsi
call fcn.1400031b0
test eax, eax
je 0x1400062cb
lea rcx, str.ERROR:_Could_not_open_device_in_WTF_mode_n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
cmp qword [rsi + 0x60], r14
jne 0x1400062e1
mov rcx, rsi
call fcn.1400031b0
test eax, eax
js 0x14000663c
mov rcx, qword [rsi + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_get_device_info]
test rax, rax
je 0x14000663c
mov r8d, dword [rax]
test r8d, r8d
je 0x14000663c
lea rdx, str.Firmware_dfu_WTF.s5l_04xxall.RELEASE.dfu
lea rcx, [rbp + 0xe0]
call fcn.1400059e0
mov rcx, qword [rsi + 0x50]
lea r9, [rbp - 0x20]
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], r14
lea rdx, [rbp + 0xe0]
mov dword [rbp - 0x20], r14d
call fcn.14000e7f0
mov rdi, qword [rbp - 0x10]
test rdi, rdi
jne 0x140006526
mov rcx, rsi
call fcn.140005aa0
mov rcx, qword [rsi + 0x18]
lea rax, str.FirmwareURL
mov qword [rsp + 0x40], rax
lea r9, [0x1400202ec]
mov qword [rsp + 0x38], r9
lea rax, str.304218112
mov qword [rsp + 0x30], rax
lea r8, str.MobileDeviceSoftwareVersionsByVersion
lea rax, [0x14001df58]
mov qword [rbp - 0x18], r14
mov qword [rsp + 0x28], rax
lea edx, [rdi + 7]
lea rax, str.RecoverySoftwareVersions
mov qword [rsp + 0x20], rax
call qword [sym.imp.plist.dll_plist_access_path]
mov rbx, rax
test rax, rax
je 0x1400063c2
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x1400063c2
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rax, qword [rbp - 0x18]
test rax, rax
jne 0x1400063e8
lea rcx, str.Using_hardcoded_x12220000_5_Recovery.ipsw_URL_n
call fcn.140002320
lea rcx, str.http:__appldnld.apple.com.edgesuite.net_content.info.apple.com_iPhone_061_6618.20090617.Xse7Y_x12220000_5_Recovery.ipsw
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rbp - 0x18], rax
mov edx, 0x2f
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, rax
test rax, rax
jne 0x140006407
lea rbx, str.x12220000_5_Recovery.ipsw
jmp 0x14000640a
inc rbx
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x1400064b1
lea rdx, [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jns 0x140006434
mov rcx, qword [rsi + 0xb0]
call fcn.1400026e0
mov rcx, qword [rsi + 0xb0]
lea rdx, [rbp + 0x8e0]
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140006450
lea rcx, [rbp + 0x8e0]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140006470
movzx eax, word [0x14001da60]
mov word [rcx], ax
lea rcx, [rbp + 0x8e0]
dec rcx
nop
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140006490
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400064a0
jmp 0x1400064ce
lea rcx, [rbp + 0x8e0]
sub rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400064c0
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x1400064f6
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp + 0x8e0]
xor r8d, r8d
call fcn.140003dc0
lea r9, [rbp - 0x20]
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x8e0]
call fcn.14000e7f0
mov rdi, qword [rbp - 0x10]
test rdi, rdi
jne 0x140006526
lea rcx, str.ERROR:_Could_not_extract_WTF_n
call fcn.1400023a0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rdi, rdi
je 0x140006584
mov edx, dword [rbp - 0x20]
lea rcx, str.Sending_data___d_bytes_..._n
call fcn.140002320
mov rcx, qword [rsi + 0x60]
mov r9d, 1
mov r8d, dword [rbp - 0x20]
mov rdx, rdi
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_send_buffer]
test eax, eax
je 0x140006584
mov ecx, eax
call qword [sym.imp.irecovery.dll_irecv_strerror]
mov rdx, rax
lea rcx, str.ERROR:_Unable_to_send_data:__s_n
call fcn.1400023a0
lea rcx, str.ERROR:_Could_not_send_WTF..._n
call fcn.1400023a0
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x1400065af
mov rax, qword [rcx]
test rax, rax
je 0x1400065a9
mov rcx, rax
call qword [sym.imp.irecovery.dll_irecv_close]
mov rax, qword [rsi + 0x60]
mov qword [rax], r14
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
mov qword [rsi + 0x60], r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [0x14002e050]
cmp qword [rsi + 0x88], rax
jne 0x14000661f
test byte [rsi], 1
jne 0x14000661f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 1
mov rcx, rsi
call fcn.140009490
mov qword [rsi + 0x78], rax
test rax, rax
jne 0x14000667f
lea rcx, str.ERROR:_Unable_to_discover_device_type_n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.ERROR:_Failed_to_put_device_into_DFU_from_WTF_mode_n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
lea rcx, str.ERROR:_Could_not_get_CPID_for_WTF_mode_device_n
call fcn.1400023a0
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x140006673
mov rax, qword [rcx]
test rax, rax
je 0x14000666d
mov rcx, rax
call qword [sym.imp.irecovery.dll_irecv_close]
mov rax, qword [rsi + 0x60]
mov qword [rax], r14
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi + 0x60], r14
mov rax, r15
jmp 0x140006c30
mov rdx, qword [rsi + 0xb8]
movsd xmm6, qword [0x140029510]
test rdx, rdx
je 0x1400066a5
mov r8, qword [rsi + 0xc0]
movaps xmm1, xmm6
xor ecx, ecx
call rdx
mov rax, qword [rsi + 0x78]
mov r8, qword [rax]
lea rcx, str.Identified_device_as__s___s_n
mov rdx, qword [rax + 8]
call fcn.140002320
mov eax, dword [rsi]
test al, 0x20
je 0x1400067f3
mov rax, qword [rsi + 0x88]
cmp dword [rax], 1
je 0x1400066e2
lea rcx, str.ERROR:_you_need_to_put_your_device_into_DFU_mode_to_pwn_it._n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
mov rcx, qword [rsi + 0x70]
test rcx, rcx
je 0x140006711
mov rax, qword [rcx]
test rax, rax
je 0x140006707
mov rcx, rax
call qword [sym.imp.irecovery.dll_irecv_close]
mov rax, qword [rsi + 0x70]
mov qword [rax], r14
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi + 0x70], r14
mov rax, qword [rsi + 0x88]
cmp dword [rax], 1
je 0x140006731
lea rcx, str.ERROR:_Device_needs_to_be_in_DFU_mode_for_this_option._n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
lea rcx, str.connecting_to_DFU_n
call fcn.140002320
mov rcx, rsi
call fcn.1400031b0
test eax, eax
js 0x140006c2d
lea rcx, str.exploiting_with_limera1n..._n
call fcn.140002320
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsi + 0x78]
call fcn.1400100a0
test eax, eax
je 0x1400067b1
lea rcx, str.ERROR:_limera1n_exploit_failed_n
call fcn.1400023a0
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x140006673
mov rax, qword [rcx]
test rax, rax
je 0x14000679f
mov rcx, rax
call qword [sym.imp.irecovery.dll_irecv_close]
mov rax, qword [rsi + 0x60]
mov qword [rax], r14
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r15
mov qword [rsi + 0x60], r14
jmp 0x140006c30
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x1400067dc
mov rax, qword [rcx]
test rax, rax
je 0x1400067d6
mov rcx, rax
call qword [sym.imp.irecovery.dll_irecv_close]
mov rax, qword [rsi + 0x60]
mov qword [rax], r14
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.Device_should_be_in_pwned_DFU_state_now._n
mov qword [rsi + 0x60], r14
call fcn.140002320
xor eax, eax
jmp 0x140006c30
bt eax, 8
jae 0x140006bbf
mov rcx, qword [rsi + 0x78]
lea rdx, [rbp - 0x18]
mov qword [rbp - 8], r14
mov r13, r14
mov qword [rbp - 0x18], r14
mov rcx, qword [rcx]
call fcn.14000eb70
mov ebx, eax
test eax, eax
jns 0x140006831
lea rcx, str.ERROR:_Could_not_fetch_list_of_signed_firmwares._n
call fcn.1400023a0
mov eax, ebx
jmp 0x140006c30
mov rbx, qword [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_array_get_size]
mov r12d, eax
test eax, eax
jne 0x140006869
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
mov rdx, qword [rsi + 0x78]
lea rcx, str.ERROR:_No_firmwares_are_currently_being_signed_for__s__REALLY____n
mov rdx, qword [rdx]
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
test dword [rsi], 0x200
je 0x140006a00
mov rdx, qword [rsi + 0x78]
lea rcx, str.The_following_firmwares_are_currently_being_signed_for__s:_n
mov rdx, qword [rdx]
call fcn.140002320
test r12d, r12d
je 0x140006928
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_array_get_item]
mov rcx, rax
lea rdx, str.version
mov rbx, rax
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rdx, str.buildid
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], r14
mov rcx, rdi
mov qword [rbp - 0x20], r14
mov rbx, rax
call qword [sym.imp.plist.dll_plist_get_string_val]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_string_val]
mov r9, qword [rbp - 0x20]
lea rcx, str.____d___s__build__s__n
mov r8, qword [rbp - 0x10]
inc r13d
mov edx, r13d
call fcn.140002320
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rbp - 0x18]
cmp r13d, r12d
jb 0x140006891
mov edi, 1
lea rcx, str.Select_the_firmware_you_want_to_restore:
call fcn.140005980
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea rcx, [rbp + 0x60]
call fcn.140002d20
cmp byte [rbp + 0x60], r14b
je 0x140006a2b
nop dword [rax]
test byte [rsi], 1
jne 0x140006c2d
xor edx, edx
lea rcx, [rbp + 0x60]
lea r8d, [rdx + 0xa]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
test eax, eax
je 0x140006992
cmp eax, r12d
jbe 0x1400069ef
mov edx, r12d
lea rcx, str.Invalid_input_value._Must_be_in_range:_1.._d_n
call fcn.140005980
lea rcx, str.Select_the_firmware_you_want_to_restore:
call fcn.140005980
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea rcx, [rbp + 0x60]
call fcn.140002d20
cmp byte [rbp + 0x60], r14b
jne 0x140006970
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
mov rax, r15
jmp 0x140006c30
lea edx, [rax - 1]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_array_get_item]
mov r13, r14
jmp 0x140006a17
lea rcx, str.NOTE:_Running_non_interactively__automatically_selecting_latest_available_version_n
call fcn.140002320
xor edx, edx
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_array_get_item]
mov r12, rax
test rax, rax
jne 0x140006a3c
lea rcx, str.ERROR:_failed_to_select_latest_firmware___n
call fcn.1400023a0
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
mov rax, r15
jmp 0x140006c30
lea rdx, str.version
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rdx, str.buildid
mov rcx, r12
mov rdi, rax
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], r14
mov rcx, rdi
mov qword [rbp + 0x10], r14
mov rbx, rax
call qword [sym.imp.plist.dll_plist_get_string_val]
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_string_val]
mov r8, qword [rbp + 0x10]
lea rcx, str.Selected_firmware__s__build__s__n
mov rdx, qword [rbp - 0x10]
call fcn.140002320
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [0x1400207cc]
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rdx, str.sha1sum
mov rcx, r12
mov rdi, rax
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rdx, [rbp - 8]
mov qword [rbp + 8], r14
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.plist.dll_plist_get_string_val]
lea rdx, [rbp + 8]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rcx, qword [rbp + 8]
mov rax, r15
inc rax
cmp byte [rcx + rax], r14b
jne 0x140006af7
cmp rax, 0x28
jne 0x140006b4c
mov ebx, r14d
mov rdi, r14
nop dword [rax]
add rcx, rdi
mov dword [rbp - 0x20], r14d
lea r8, [rbp - 0x20]
lea rdx, str._02x
call fcn.140005a40
movzx eax, byte [rbp - 0x20]
add rdi, 2
mov ecx, ebx
add ebx, 2
shr rcx, 1
mov byte [rbp + rcx + 0x60], al
cmp ebx, 0x28
jge 0x140006b46
mov rcx, qword [rbp + 8]
jmp 0x140006b10
lea r13, [rbp + 0x60]
jmp 0x140006b58
lea rcx, str.ERROR:_unexpected_size_of_sha1sum_n
call fcn.1400023a0
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.plist.dll_plist_free]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140006c21
test r13, r13
je 0x140006c21
mov r8, qword [rsi + 0xb0]
lea r9, [rbp + 8]
mov rdx, r13
mov qword [rbp + 8], r14
call fcn.14000efb0
mov ebx, eax
test eax, eax
je 0x140006bab
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140006ba4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
jmp 0x140006c30
mov rax, qword [rbp + 8]
lea r12, [rsi + 0xd8]
mov r13, qword [rsp + 0x58]
mov qword [rsi + 0x50], rax
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140006bde
mov r8, qword [rsi + 0xc0]
xor ecx, ecx
movsd xmm1, qword [0x140029530]
call rax
test byte [rsi], 0x40
jne 0x1400067ec
mov rax, qword [rsi + 0x88]
lea rbx, reloc.WS2_32.dll_closesocket
cmp dword [rax], 3
jne 0x140006d2d
cmp qword [rsi + 0x68], r14
jne 0x140006c65
mov rcx, rsi
call fcn.140012620
test eax, eax
jns 0x140006c65
lea rcx, str.ERROR:_Unable_to_open_device_in_restore_mode_n
call fcn.1400023a0
jmp 0x140006cc3
lea rcx, str.ERROR:_Missing_firmware_URL_or_SHA1_n
call fcn.1400023a0
mov eax, r15d
mov rcx, qword [rbp + 0xce0]
xor rcx, rsp
call fcn.14001bfa0
lea r11, [rsp + 0xe00]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, str.Rebooting_restore_mode_device..._n
call fcn.140002320
mov rcx, qword [rsi + 0x68]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.imobiledevice.dll_restored_reboot]
mov rcx, qword [rsi + 0x68]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.imobiledevice.dll_restored_client_free]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
cmp qword [rsi + 0x88], rbx
jne 0x140006cd9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.ERROR:_Unable_to_exit_restore_mode_n
call fcn.1400023a0
mov eax, 0xfffffffe
jmp 0x140006c30
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsi + 0x88]
cmp rdx, r13
je 0x140006d52
test byte [rsi], 1
jne 0x140006d52
mov rdx, qword [rdx + 8]
lea rcx, str.Found_device_in__s_mode_n
call fcn.140002320
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x50]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
jns 0x140006d67
mov rdx, qword [rsi + 0x50]
lea rcx, str.ERROR:_Firmware_file__s_does_not_exist._n
call fcn.1400023a0
jmp 0x140006c2d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.ERROR:_Unable_to_discover_device_mode._Please_make_sure_a_device_is_attached._n
jmp 0x140006c28
test byte [rsi], 8
mov qword [rbp], r14
je 0x140006dcf
lea rcx, str.Extracting_Restore.plist_from_IPSW_n
call fcn.140002320
mov rcx, qword [rsi + 0x50]
lea r9, [rbp - 0x20]
lea r8, [rbp - 8]
mov dword [rbp - 0x20], r14d
lea rdx, str.Restore.plist
mov qword [rbp - 8], r14
call fcn.14000e7f0
test eax, eax
jne 0x140006dba
mov edx, dword [rbp - 0x20]
lea r8, [rbp]
mov rcx, qword [rbp - 8]
call qword [sym.imp.plist.dll_plist_from_xml]
mov rcx, qword [rbp - 8]
jmp 0x140006e5e
mov rdx, qword [rsi + 0x50]
lea rcx, str.ERROR:_Unable_to_extract_Restore.plist_from__s._Firmware_file_might_be_corrupt._n
call fcn.1400023a0
jmp 0x140006c2d
lea rcx, str.Extracting_BuildManifest_from_IPSW_n
call fcn.140002320
mov rbx, qword [rsi + 0x50]
lea rdx, str.BuildManifesto.plist
mov rcx, rbx
mov dword [rbp - 0x20], r14d
mov qword [rbp - 0x18], r14
mov dword [rsp + 0x50], r14d
call fcn.14000e710
test eax, eax
je 0x140006e1a
lea r9, [rbp - 0x20]
mov rcx, rbx
lea r8, [rbp - 0x18]
lea rdx, str.BuildManifesto.plist
call fcn.14000e7f0
test eax, eax
je 0x140006e49
lea r9, [rbp - 0x20]
mov qword [rbp - 0x18], r14
lea r8, [rbp - 0x18]
mov dword [rbp - 0x20], r14d
lea rdx, str.BuildManifest.plist
mov rcx, rbx
call fcn.14000e7f0
test eax, eax
jne 0x140008e0c
mov dword [rsp + 0x50], 1
mov edx, dword [rbp - 0x20]
lea r8, [rbp]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.plist.dll_plist_from_xml]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140006e83
mov r8, qword [rsi + 0xc0]
xor ecx, ecx
movsd xmm1, qword [0x140029540]
call rax
mov rax, qword [rsi + 0x78]
lea rdx, str.SupportedProductTypes
mov rcx, qword [rbp]
mov rax, qword [rax]
mov qword [rbp + 8], rax
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov r12, rax
test rax, rax
je 0x140008dc7
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 4
jne 0x140008dc7
mov rcx, r12
call qword [sym.imp.plist.dll_plist_array_get_size]
mov r13d, eax
mov ebx, r14d
test eax, eax
je 0x140008e00
mov edx, ebx
mov rcx, r12
call qword [sym.imp.plist.dll_plist_array_get_item]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x140006f2b
lea rdx, [rbp - 8]
mov qword [rbp - 8], r14
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_get_string_val]
mov r9, qword [rbp - 8]
test r9, r9
je 0x140006f2b
mov r8, qword [rbp + 8]
mov rax, r9
sub r8, r9
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006f27
inc rax
test ecx, ecx
jne 0x140006f14
test edx, edx
je 0x140006f3e
inc ebx
cmp ebx, r13d
jb 0x140006ed4
lea rcx, str.ERROR:_Could_not_make_sure_this_firmware_is_suitable_for_the_current_device._Refusing_to_continue._n
jmp 0x140006c28
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rbp]
lea rdx, str.ProductVersion
mov rcx, r12
mov qword [rsi + 0x90], r14
mov qword [rsi + 0x98], r14
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rdi, rax
test rax, rax
je 0x140006fe9
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x140006fe9
lea rdx, [rsi + 0x90]
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_get_string_val]
lea rdx, str.ProductBuildVersion
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rdi, rax
test rax, rax
je 0x140006fe0
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x140006fe0
lea rdx, [rsi + 0x98]
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rcx, qword [rsi + 0x98]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov dword [rsi + 0xa0], eax
jmp 0x140006ff5
lea rcx, str.ERROR:_Unable_to_find_ProductBuildVersion_node_n
jmp 0x140006ff0
lea rcx, str.ERROR:_Unable_to_find_ProductVersion_node_n
call fcn.1400023a0
mov rdx, qword [rsi + 0x90]
lea rcx, str.Product_Version:__s_n
call fcn.140002320
mov r8d, dword [rsi + 0xa0]
lea rcx, str.Product_Build:__s_Major:__d_n
mov rdx, qword [rsi + 0x98]
call fcn.140002320
mov rax, qword [rsi + 0x88]
mov ecx, r15d
test rax, rax
je 0x140007033
mov ecx, dword [rax]
sub ecx, 1
je 0x1400070b7
sub ecx, 1
je 0x14000709a
cmp ecx, 2
je 0x140007056
lea rcx, str.ERROR:_Device_is_in_an_invalid_state_n
call fcn.1400023a0
mov eax, r14d
jmp 0x1400070eb
lea r8, str.Image4Supported
mov rcx, rsi
call fcn.140010b60
mov rbx, rax
test rax, rax
je 0x1400070c9
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
test eax, eax
jne 0x1400070c9
lea rdx, [rbp + 0x18]
mov byte [rbp + 0x18], r14b
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_bool_val]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
movzx eax, byte [rbp + 0x18]
jmp 0x1400070eb
cmp qword [rsi + 0x70], r14
jne 0x1400070b1
mov rcx, rsi
call fcn.140011330
test eax, eax
jns 0x1400070b1
mov eax, r14d
jmp 0x1400070eb
mov rcx, qword [rsi + 0x70]
jmp 0x1400070d2
cmp qword [rsi + 0x60], r14
jne 0x1400070ce
mov rcx, rsi
call fcn.1400031b0
test eax, eax
jns 0x1400070ce
mov eax, r14d
jmp 0x1400070eb
mov rcx, qword [rsi + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_get_device_info]
test rax, rax
jne 0x1400070e5
mov eax, r14d
jmp 0x1400070eb
mov eax, dword [rax + 0x20]
and eax, 4
test eax, eax
mov dword [rsi + 0x34], eax
lea rcx, str.true
lea rdx, str.false
cmovne rdx, rcx
lea rcx, str.Device_supports_Image4:__s_n
call fcn.140002320
mov eax, dword [rsi]
test al, 8
je 0x140007127
lea rcx, str.Custom_firmware_requested._Disabled_TSS_request._n
mov dword [rsp + 0x50], r14d
call fcn.140002320
mov eax, dword [rsi]
mov qword [rsi + 8], r14
lea rcx, [rsi + 8]
mov qword [rbp + 0x10], rcx
lea rcx, str.Update
lea r12, str.Erase
test al, 8
je 0x140007815
call qword [sym.imp.plist.dll_plist_new_dict]
mov rcx, qword [rsi + 0x78]
lea r8, [rbp - 0x18]
mov r13, rax
mov qword [rbp - 0x10], rax
mov rdx, qword [rcx + 8]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x140007170
mov rax, qword [rbp - 0x18]
test al, al
je 0x1400071a9
lea rbx, [rbp - 0x18]
nop
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx], al
lea rbx, [rbx + 1]
movzx ecx, byte [rbx]
movzx eax, cl
test cl, cl
jne 0x140007190
lea r9, str.production
lea r8, [rbp - 0x18]
lea rdx, str.Firmware_all_flash_all_flash._s._s
lea rcx, [rbp + 0x60]
call fcn.1400059e0
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x60]
mov byte [rbp + rcx + 0xe0], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400071d0
lea rcx, [rbp + 0xe0]
dec rcx
nop
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400071f0
movsd xmm0, qword [str._manifest]
lea r9, [rbp - 0x20]
movzx eax, word [0x140020ac8]
lea r8, [rbp - 8]
movsd qword [rcx], xmm0
lea rdx, [rbp + 0xe0]
mov word [rcx + 8], ax
mov rcx, qword [rsi + 0x50]
mov qword [rbp - 8], r14
mov dword [rbp - 0x20], r14d
call fcn.14000e7f0
test eax, eax
jns 0x14000724d
lea rdx, [rbp + 0xe0]
lea rcx, str.ERROR:_could_not_extract__s_from_IPSW_n
call fcn.1400023a0
jmp 0x140006c2d
mov r12, qword [rbp - 8]
lea rdx, [0x140020af8]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov edi, r14d
test rax, rax
je 0x14000729d
mov rbx, r14
nop dword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rsp + rbx*8 + 0x60], rax
inc edi
inc rbx
cmp rbx, 0x10
jge 0x14000729d
lea rdx, [0x140020af8]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
test rax, rax
jne 0x140007270
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.plist.dll_plist_new_dict]
mov qword [rbp - 8], rax
mov r12, rax
movsxd rax, edi
test edi, edi
jle 0x140007414
mov r15, qword [rbp - 8]
mov r12, r14
mov rsi, rax
call qword [sym.imp.plist.dll_plist_new_dict]
mov r13, rax
mov rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbp + rdx + 0x60]
mov byte [rbp + rdx + 0xe0], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400072e0
lea rcx, [rbp + 0xe0]
dec rcx
nop
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140007300
movzx eax, word [0x14001da60]
mov rbx, qword [rsp + r12*8 + 0x60]
mov word [rcx], ax
lea rcx, [rbp + 0xe0]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140007323
xor edx, edx
nop
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140007330
lea rcx, [rbp + 0xe0]
call qword [sym.imp.plist.dll_plist_new_string]
lea rdx, str.Path
mov rcx, r13
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
mov r8, r13
lea rdx, str.Info
mov rcx, rax
mov rdi, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, rbx
call fcn.14000ade0
test rax, rax
je 0x1400073cf
mov r8, rdi
mov rdx, rax
mov rcx, r15
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8d, 0xa
lea rdx, str.DeviceTree
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1400073e7
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.RestoreDeviceTree
mov rcx, r15
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
jmp 0x1400073e7
mov rdx, rbx
lea rcx, str.WARNING:_unhandled_component__s_n
call fcn.1400023a0
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + r12*8 + 0x60], r14
inc r12
cmp r12, rsi
jl 0x1400072c8
mov rsi, qword [rbp + 0x50]
mov r15, 0xffffffffffffffff
mov r12, qword [rbp - 8]
mov r13, qword [rbp - 0x10]
lea r9, str.RELEASE
lea r8, [rbp - 0x18]
lea rdx, str.Firmware_dfu_iBSS._s._s.dfu
lea rcx, [rbp + 0xe0]
call fcn.1400059e0
call qword [sym.imp.plist.dll_plist_new_dict]
lea rcx, [rbp + 0xe0]
mov rdi, rax
call qword [sym.imp.plist.dll_plist_new_string]
lea rdx, str.Path
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
mov r8, rdi
lea rdx, str.Info
mov rcx, rax
mov rbx, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, rbx
lea rdx, str.iBSS
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea r9, str.RELEASE
lea r8, [rbp - 0x18]
lea rdx, str.Firmware_dfu_iBEC._s._s.dfu
lea rcx, [rbp + 0xe0]
call fcn.1400059e0
call qword [sym.imp.plist.dll_plist_new_dict]
lea rcx, [rbp + 0xe0]
mov rdi, rax
call qword [sym.imp.plist.dll_plist_new_string]
lea rdx, str.Path
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
mov r8, rdi
lea rdx, str.Info
mov rcx, rax
mov rbx, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, rbx
lea rdx, str.iBEC
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, qword [rbp]
lea rdx, str.KernelCachesByTarget
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
je 0x140007546
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 5
jne 0x140007546
lea r8d, [rax - 2]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x1d], r14b
mov rcx, rbx
jmp 0x140007551
mov rcx, qword [rbp]
lea rdx, str.RestoreKernelCaches
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
je 0x14000760b
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 5
jne 0x14000760b
lea rdx, str.Release
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rdi, rax
test rax, rax
je 0x14000760b
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x14000760b
call qword [sym.imp.plist.dll_plist_new_dict]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.Path
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
mov r8, rbx
lea rdx, str.Info
mov rcx, rax
mov rdi, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, rdi
lea rdx, str.KernelCache
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.RestoreKernelCache
mov rcx, r12
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, qword [rbp]
lea rdx, str.RestoreRamDisks
call qword [sym.imp.plist.dll_plist_dict_get_item]
lea rbx, str.User
mov rdi, rax
test rax, rax
je 0x1400076e2
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 5
jne 0x1400076e2
test byte [rsi], 4
lea rdx, str.Update
mov rcx, rdi
cmovne rdx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
jne 0x140007680
test byte [rsi], 4
jne 0x1400076e2
lea rdx, str.User
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_dict_get_item]
or dword [rsi], 4
mov rbx, rax
test rax, rax
je 0x1400076e2
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x1400076e2
call qword [sym.imp.plist.dll_plist_new_dict]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.Path
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
mov r8, rdi
lea rdx, str.Info
mov rcx, rax
mov rbx, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, rbx
lea rdx, str.RestoreRamDisk
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, qword [rbp]
lea rdx, str.SystemRestoreImages
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
jne 0x140007707
lea rcx, str.ERROR:_missing_SystemRestoreImages_in_Restore.plist_n
call fcn.1400023a0
lea rdx, str.User
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
jne 0x14000772d
lea rcx, str.ERROR:_missing_filesystem_in_Restore.plist_n
call fcn.1400023a0
jmp 0x140007781
call qword [sym.imp.plist.dll_plist_new_dict]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.Path
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
mov r8, rdi
lea rdx, str.Info
mov rcx, rax
mov rbx, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, rbx
lea rdx, [0x140020cb4]
mov rcx, r12
call qword [sym.imp.plist.dll_plist_dict_set_item]
call qword [sym.imp.plist.dll_plist_new_dict]
test byte [rsi], 4
lea rcx, str.Update
mov rbx, rax
lea rax, str.Erase
cmovne rcx, rax
call qword [sym.imp.plist.dll_plist_new_string]
lea rdx, str.RestoreBehavior
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
test byte [rsi], 4
lea rax, str.Customer_Erase_Install__IPSW_
lea rcx, str.Customer_Upgrade_Install__IPSW_
cmovne rcx, rax
call qword [sym.imp.plist.dll_plist_new_string]
lea rdx, str.Variant
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, rbx
lea rdx, str.Info
mov rcx, r13
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov r8, r12
lea rdx, str.Manifest
mov rcx, r13
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea r12, str.Erase
jmp 0x140007887
mov rdx, qword [rsi + 0x78]
mov rdx, qword [rdx + 8]
test al, 4
je 0x140007854
mov rcx, qword [rbp]
mov r8, r12
call fcn.140009bd0
mov qword [rbp - 0x10], rax
mov r13, rax
test rax, rax
jne 0x140007887
lea rcx, str.ERROR:_Unable_to_find_any_build_identities_n
call fcn.1400023a0
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
jmp 0x140006c2d
mov r8, rcx
mov rcx, qword [rbp]
call fcn.140009bd0
mov qword [rbp - 0x10], rax
mov r13, rax
test rax, rax
jne 0x140007887
mov rax, qword [rsi + 0x78]
xor r8d, r8d
mov rcx, qword [rbp]
mov rdx, qword [rax + 8]
call fcn.140009bd0
mov r13, rax
mov qword [rbp - 0x10], rax
lea rdx, str.Info
mov qword [rbp - 0x20], r14
mov rcx, r13
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
je 0x1400079c1
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 5
jne 0x1400079c1
lea rdx, str.Variant
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rdi, rax
test rax, rax
je 0x1400079b8
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x1400079b8
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rdx, qword [rbp - 0x20]
lea rcx, str.Variant:__s_n
call fcn.140002320
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.RestoreBehavior
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
je 0x1400079af
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x1400079af
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rdx, qword [rbp - 0x20]
mov rcx, r14
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x140007974
cmp rcx, 6
jne 0x140007950
lea rcx, str.This_restore_will_erase_your_device_data._n
call fcn.140002320
mov rdx, qword [rbp - 0x20]
mov rcx, r14
lea r8, str.Update
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400079a4
cmp rcx, 7
jne 0x140007980
lea rcx, str.This_restore_will_update_your_device_without_erasing_user_data._n
call fcn.140002320
mov rdx, qword [rbp - 0x20]
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400079cd
lea rcx, str.ERROR:_Unable_to_find_RestoreBehavior_node_n
jmp 0x1400079c8
lea rcx, str.ERROR:_Unable_to_find_Variant_node_n
jmp 0x1400079c8
lea rcx, str.ERROR:_Unable_to_find_Info_node_n
call fcn.1400023a0
mov rax, qword [rsi + 0x88]
lea rbx, [0x140020fe8]
cmp dword [rax], 4
jne 0x140007b75
test byte [rsi], 0x84
jne 0x140007b75
lea r8, str.ProductVersion
mov rcx, rsi
call fcn.140010b60
mov rcx, r14
mov rbx, rax
mov qword [rbp - 0x18], rcx
test rax, rax
je 0x140007b68
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140007b68
mov rbx, qword [rsi + 0x90]
call fcn.140005d30
mov edi, eax
mov rcx, rbx
and edi, 0xffff00
call fcn.140005d30
and eax, 0xffff00
sub edi, eax
test edi, edi
jle 0x140007b64
test dword [rsi], 0x200
je 0x140007b64
mov rdi, qword [rsi + 0x90]
mov rax, r15
inc rax
cmp byte [rdi + rax], r14b
jne 0x140007a73
mov rbx, qword [rbp - 0x18]
mov ecx, recv
sub ecx, eax
mov rax, r15
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], r14b
jne 0x140007a90
sub ecx, eax
mov edx, 0x20
movsxd r12, ecx
lea rcx, [rbp + 0x50]
mov r8, r12
call sub.VCRUNTIME140.dll_memset
cmp r12, 0x10
jae 0x140008e3e
lea r9, [rbp + 0x50]
mov byte [rbp + r12 + 0x50], r14b
mov r8, rdi
lea rcx, str.___WARNING____n_You_are_trying_to_DOWNGRADE_a__s_device_with_an_IPSW_for__s_while_s__n_trying_to_preserve_the_user_data__Upgrade_restore_._This_might_work__but__n_there_is_a_VERY_HIGH_chance_it_might_FAIL_BADLY_with_COMPLETE_DATA_LOSS.____n_Hit_CTRLC_now_if_you_want_to_abort_the_restore.____________________________n_If_you_want_to_take_the_risk__and_have_a_backup_of_your_important_data______n_type_YES_and_press_ENTER_to_continue._You_have_been_warned._________________n_n
mov rdx, rbx
call fcn.140005980
lea rcx, [0x140020fe4]
call fcn.140005980
mov edi, 1
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea rcx, [rbp + 0x60]
mov byte [rbp + 0x60], r14b
call fcn.140002d20
test byte [rsi], dil
jne 0x140006c2d
cmp byte [rbp + 0x60], r14b
je 0x140007b4a
mov rcx, r14
lea rdx, [rbp + 0x60]
lea rbx, [0x140020fe8]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140007b4a
cmp rcx, 4
jne 0x140007b31
mov rcx, qword [rbp - 0x18]
jmp 0x140007b6f
lea rcx, str.Invalid_input._Please_type_YES_or_hit_CTRLC_to_abort._n
call fcn.140005980
lea rcx, [0x140020fe4]
call fcn.140005980
jmp 0x140007ae5
mov rcx, qword [rbp - 0x18]
lea rbx, [0x140020fe8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsi]
and eax, 0x204
cmp eax, 0x204
jne 0x140007c1f
lea rcx, str.___WARNING____n_You_are_about_to_perform_an_ERASE_restore._ALL_DATA_on_the_target_device__n_will_be_IRREVERSIBLY_DESTROYED._If_you_want_to_update_your_device_without___n_erasing_the_user_data__hit_CTRLC_now_and_restart_without__e_or___erase_____n_command_line_switch.________________________________________________________n_If_you_want_to_continue_with_the_ERASE__please_type_YES_and_press_ENTER.____n_n
call fcn.140005980
lea rcx, [0x140020fe4]
call fcn.140005980
mov edi, 1
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea rcx, [rbp + 0x60]
mov byte [rbp + 0x60], r14b
call fcn.140002d20
test byte [rsi], dil
jne 0x140006c2d
cmp byte [rbp + 0x60], r14b
je 0x140007c05
mov rcx, r14
lea rdx, [rbp + 0x60]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x140007c05
cmp rcx, 4
jne 0x140007bf0
jmp 0x140007c24
lea rcx, str.Invalid_input._Please_type_YES_or_hit_CTRLC_to_abort._n
call fcn.140005980
lea rcx, [0x140020fe4]
call fcn.140005980
jmp 0x140007ba4
mov edi, 1
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140007c3e
mov r8, qword [rsi + 0xc0]
xorps xmm1, xmm1
mov ecx, edi
call rax
lea rcx, str.Checking_IPSW_for_required_components..._n
call fcn.140002320
mov r12, qword [rsi + 0x50]
lea rdx, str.Manifest
mov rcx, r13
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
je 0x140008db2
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 5
jne 0x140008db2
lea rdx, [rbp - 8]
mov qword [rbp - 8], r14
mov rcx, rbx
mov edi, r14d
call qword [sym.imp.plist.dll_plist_dict_new_iter]
mov rdx, qword [rbp - 8]
lea r9, [rbp + 8]
lea r8, [rbp - 0x20]
mov qword [rbp + 8], r14
mov rcx, rbx
mov qword [rbp - 0x20], r14
call qword [sym.imp.plist.dll_plist_dict_next_item]
cmp qword [rbp - 0x20], r14
je 0x140007d21
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140007d21
lea r9, str.Path
mov edx, 2
lea r8, str.Info
call qword [sym.imp.plist.dll_plist_access_path]
test rax, rax
je 0x140007d21
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], r14
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x140007d21
mov rcx, r12
call fcn.14000e710
test eax, eax
jne 0x140007d17
mov r8, qword [rbp - 0x18]
lea rcx, str.ERROR:__s_file__s_not_found_in_IPSW_n
mov rdx, qword [rbp - 0x20]
call fcn.1400023a0
mov edi, r15d
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp qword [rbp + 8], r14
jne 0x140007c90
test edi, edi
js 0x140008db2
lea rcx, str.All_required_components_found_in_IPSW_n
call fcn.140002320
lea r8, [rbp - 8]
mov qword [rbp - 8], r14
lea rdx, [0x140020cb4]
mov rcx, r13
call fcn.14000ac90
test eax, eax
jns 0x140007d70
lea rcx, str.ERROR:_Unable_get_path_for_filesystem_component_n
jmp 0x140006c28
mov rcx, qword [rsi + 0xb0]
xorps xmm0, xmm0
mov edi, r14d
mov rbx, r14
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
test rcx, rcx
je 0x140007e3b
lea rdx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jns 0x140007daf
mov rcx, qword [rsi + 0xb0]
call fcn.1400026e0
mov rcx, qword [rsi + 0xb0]
lea rdx, [rbp + 0x4e0]
sub rdx, rcx
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140007dc0
lea rcx, [rbp + 0x4e0]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x140007de0
movzx eax, word [0x14001da60]
mov word [rcx], ax
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
mov r12, rax
call fcn.140001540
lea rcx, [rbp + 0x4e0]
mov r8, rax
dec rcx
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x140007e15
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140007e20
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140007e5e
mov rcx, qword [rsi + 0x50]
lea rdx, [rbp + 0x4e0]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140007e50
mov rcx, qword [rsi + 0x50]
call fcn.14000e030
test eax, eax
jne 0x140007ebd
lea rcx, [rbp + 0x4e0]
mov rax, r15
cmp byte [rcx + rax + 1], bl
lea rax, [rax + 1]
jne 0x140007e75
movzx ecx, byte [rbp + rax + 0x4df]
lea r8, [rbp + rax + 0x4df]
mov rdx, r8
test cl, cl
je 0x140007ead
lea eax, [rcx - 0x2e]
cmp al, 1
jbe 0x140007ead
cmp cl, 0x5c
je 0x140007ead
movzx ecx, byte [rdx - 1]
dec rdx
test cl, cl
jne 0x140007e96
sub r8, rdx
cmp r8, 6
jge 0x140007ebd
cmp byte [rdx], 0x2e
jne 0x140007ebd
mov byte [rdx], bl
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jns 0x140007ee1
xor edx, edx
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rbp + 0x4e0]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x140007ef0
movzx eax, word [0x14001da60]
mov word [rcx], ax
lea rcx, [rbp + 0x4e0]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x140007f10
mov r12, qword [rbp - 8]
xor edx, edx
nop
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140007f20
xorps xmm0, xmm0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x4e0]
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x140007fa6
mov rcx, qword [rsi + 0x50]
lea r8, [rbp - 8]
mov rdx, r12
mov qword [rbp - 8], r14
call fcn.14000e0b0
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140007fa6
movsxd rax, dword [rbp + 0x34]
cmp rax, rcx
jne 0x140007fa6
lea rdx, [rbp + 0x4e0]
lea rcx, str.Using_cached_filesystem_from__s_n
call fcn.140002320
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
test rax, rax
jne 0x14000827e
test byte [rsi], 0x80
jne 0x14000827e
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x4e0]
mov byte [rbp + rcx + 0x8e0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140007fc0
lea rcx, [rbp + 0x8e0]
dec rcx
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140007fe1
movsd xmm0, qword [str..extract]
movzx eax, byte [0x140021360]
movsd qword [rcx], xmm0
mov byte [rcx + 8], al
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x4e0]
mov byte [rbp + rcx + 0xe0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140008010
lea rcx, [rbp + 0xe0]
dec rcx
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140008031
mov eax, dword [str..lock]
xor r9d, r9d
mov dword [rcx], eax
mov edx, 0xc0000000
movzx eax, word [0x140021368]
mov word [rcx + 4], ax
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x30], r14
lea r8d, [r9 + 3]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x1400080a0
lea rdx, [rbp + 0xe0]
lea rcx, str.ERROR:_could_not_open_or_create_lockfile__s_n
call fcn.140002440
mov ebx, 1
jmp 0x1400080ef
mov ebx, 1
mov qword [rbp + 0x78], r14
lea rcx, [rbp + 0x68]
mov r9d, ebx
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x20], r14d
lea edx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
jne 0x1400080ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR:_cant_lock_file__error__d_n
call fcn.140002440
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x60], r15
xor edx, edx
lea rcx, [rbp + 0x8e0]
mov r13, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
je 0x14000811c
lea rdx, [0x14001df94]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r13, rax
mov rcx, qword [rbp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x140008167
lea rax, [rbp + 0x68]
mov qword [rbp + 0x78], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
test eax, eax
jne 0x140008159
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR:_cant_unlock_file__error__d_n
call fcn.140002440
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x60], r15
test r13, r13
jne 0x1400081a2
lea rcx, str.ipsw_
call fcn.140002b50
mov rbx, rax
test rax, rax
jne 0x14000819b
mov rdx, r12
lea rcx, str.WARNING:_Could_not_get_temporary_filename__using__s_in_current_directory_n
call fcn.1400023a0
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
mov edi, 1
jmp 0x1400081bb
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, r13
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, r12
lea rcx, str.Extracting_filesystem_from_IPSW:__s_n
call fcn.140002320
mov rcx, qword [rsi + 0x50]
mov r8, rbx
mov rdx, r12
call fcn.14000e210
test eax, eax
jns 0x14000822f
lea rcx, str.ERROR:_Unable_to_extract_filesystem_from_IPSW_n
call fcn.1400023a0
mov r8, qword [rbp + 0x10]
mov rcx, qword [r8]
test rcx, rcx
je 0x140008208
call qword [sym.imp.plist.dll_plist_free]
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
mov rdx, rbx
lea rcx, str.Removing__s_n
call fcn.140002320
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
jmp 0x140006c2d
lea rdx, str..extract
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14000827a
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [rbp + 0x4e0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
mov r13, qword [rbp - 0x10]
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x14000829b
mov r8, qword [rsi + 0xc0]
movaps xmm1, xmm6
mov ecx, 1
call rax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x1400084c6
lea rcx, str.Getting_devices_ECID_for_TSS_request_n
mov r12d, r14d
call fcn.140002440
lea rdx, [rsi + 0x20]
mov rcx, rsi
call fcn.1400096f0
test eax, eax
jns 0x1400082d2
lea rcx, str.ERROR:_Unable_to_find_device_ECID_n
jmp 0x140006c28
mov rdx, qword [rsi + 0x20]
lea rcx, str.Found_ECID__I64u_n
call fcn.140002320
mov rax, qword [rsi + 0x88]
cmp dword [rax], 4
jne 0x1400083b4
test byte [rsi], 0x84
jne 0x1400083b4
lea r8, str.HasSiDP
mov rcx, rsi
call fcn.140010b60
mov byte [rbp + 0x18], r12b
mov r13, rax
test rax, rax
je 0x1400083b4
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
test eax, eax
jne 0x140008334
lea rdx, [rbp + 0x18]
mov rcx, r13
call qword [sym.imp.plist.dll_plist_get_bool_val]
cmp byte [rbp + 0x18], r12b
je 0x1400083b4
lea rcx, str.Checking_if_device_requires_stashbag..._n
call fcn.140002320
mov rdx, qword [rbp - 0x10]
lea r8, [rbp + 0x50]
mov rcx, rsi
call fcn.140009dd0
test eax, eax
jns 0x140008366
lea rcx, str.ERROR:_Unable_to_create_preboard_manifest._n
jmp 0x140006c28
lea rcx, str.DEBUG:_creating_stashbag..._n
call fcn.140002440
mov r13, qword [rbp + 0x50]
mov rcx, rsi
mov rdx, r13
call fcn.140010c90
test eax, eax
jns 0x14000839f
cmp eax, 0xfffffffe
lea rcx, str.ERROR:_Could_not_create_stashbag__timeout_._n
lea rdx, str.ERROR:_An_error_occurred_while_creating_the_stashbag._n
cmovne rcx, rdx
jmp 0x140006c28
cmp eax, 1
mov rcx, r13
mov eax, 1
cmove r12d, eax
call qword [sym.imp.plist.dll_plist_free]
cmp dword [rsi + 0xa0], 8
jle 0x140008430
lea r8, [rbp - 0x20]
mov qword [rbp - 0x18], r14
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x20], r14d
mov rcx, rsi
call fcn.1400097f0
test eax, eax
jns 0x1400083e5
lea rcx, str.NOTE:_Unable_to_get_nonce_from_device_n
call fcn.140002320
mov rax, qword [rsi + 0x28]
movsxd r13, dword [rbp - 0x20]
test rax, rax
je 0x140008424
cmp r13d, dword [rsi + 0x30]
jne 0x14000841b
mov rcx, qword [rbp - 0x18]
mov r8, r13
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140008417
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140008430
mov rax, qword [rsi + 0x28]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbp - 0x18]
mov qword [rsi + 0x28], rax
mov dword [rsi + 0x30], r13d
test byte [rsi], 1
jne 0x140006c2d
mov r13, qword [rbp - 0x10]
lea r8, [rsi + 8]
mov rdx, r13
mov rcx, rsi
call fcn.140009fb0
test eax, eax
jns 0x14000845c
lea rcx, str.ERROR:_Unable_to_get_SHSH_blobs_for_this_device_n
jmp 0x140006c28
test r12d, r12d
je 0x1400084c2
mov rcx, qword [rsi + 8]
lea rdx, str.ApImg4Ticket
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov r12, rax
test rax, rax
je 0x1400084b6
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 7
jne 0x1400084b6
lea rcx, str.Committing_stashbag..._n
call fcn.140002320
mov rdx, r12
mov rcx, rsi
call fcn.140010ff0
test eax, eax
jns 0x1400084c2
mov edx, eax
lea rcx, str.ERROR:_Could_not_commit_stashbag___d_._Aborting._n
call fcn.1400023a0
jmp 0x140006c2d
lea rcx, str.ERROR:_Missing_ApImg4Ticket_in_TSS_response_for_stashbag_commit_n
jmp 0x140006c28
mov ecx, dword [rsp + 0x50]
mov eax, dword [rsi]
test al, 1
jne 0x140008a96
test al, al
jns 0x1400086a0
test ecx, ecx
jne 0x1400084ef
lea rcx, str.This_device_does_not_require_a_TSS_record_n
call fcn.140002320
xor eax, eax
jmp 0x140006c30
mov rcx, qword [rsi + 8]
lea rbx, [rsi + 8]
test rcx, rcx
jne 0x140008517
lea rcx, str.ERROR:_could_not_fetch_TSS_record_n
call fcn.1400023a0
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
jmp 0x140006c2d
lea r8, [rbp - 0x20]
mov qword [rbp - 0x18], r14
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x20], r14d
call qword [sym.imp.plist.dll_plist_to_bin]
cmp qword [rbp - 0x18], r14
je 0x14000867a
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x14000858f
lea rdx, [rbp + 0xe0]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140008550
lea rcx, [rbp + 0xe0]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140008570
mov eax, dword [str._shsh]
mov dword [rcx], eax
movzx eax, word [0x1400216c0]
mov word [rcx + 4], ax
jmp 0x1400085a8
mov eax, dword [str.shsh]
mov dword [rbp + 0xe0], eax
movzx eax, byte [0x14001f6bc]
mov byte [rbp + 0xe4], al
lea rcx, [rbp + 0xe0]
call fcn.1400026e0
mov r9, qword [rsi + 0x78]
lea rax, [rbp + 0xe0]
nop
inc r15
cmp byte [rax + r15], r14b
jne 0x1400085c0
mov rax, qword [rsi + 0x90]
lea rcx, [rbp + 0xe0]
mov r9, qword [r9]
lea rdx, str.__I64u__s__s.shsh
mov r8, qword [rsi + 0x20]
add rcx, r15
mov qword [rsp + 0x20], rax
call fcn.1400059e0
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14000865b
lea rdx, [0x14001df94]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.zlib1.dll_gzopen]
mov r8d, dword [rbp - 0x20]
mov rcx, rax
mov rdx, qword [rbp - 0x18]
mov rbx, rax
call qword [sym.imp.zlib1.dll_gzwrite]
mov rcx, rbx
call qword [sym.imp.zlib1.dll_gzclose]
lea rdx, [rbp + 0xe0]
lea rcx, str.SHSH_saved_to__s_n
call fcn.140002320
mov rcx, qword [rbp - 0x18]
mov rbx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140008686
lea rdx, [rbp + 0xe0]
lea rcx, str.SHSH__s_already_present._n
call fcn.140002320
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140008686
lea rcx, str.ERROR:_could_not_get_TSS_record_data_n
call fcn.1400023a0
mov rcx, qword [rbx]
call qword [sym.imp.plist.dll_plist_free]
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
xor eax, eax
jmp 0x140006c30
lea r12, [rsi + 8]
test ecx, ecx
je 0x1400086d1
mov rcx, qword [r12]
test rcx, rcx
jne 0x1400086cc
lea rcx, str.ERROR:_Unable_to_proceed_without_a_TSS_record._n
call fcn.1400023a0
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
jmp 0x140006c2d
call fcn.14000a7e0
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x1400086f3
mov r8, qword [rsi + 0xc0]
mov ecx, 1
movsd xmm1, qword [0x140029518]
call rax
test byte [rsi], 1
jne 0x140008a96
mov rax, qword [rsi + 0x88]
cmp dword [rax], 4
jne 0x14000874f
lea rcx, str.Entering_recovery_mode..._n
call fcn.140002320
mov rcx, rsi
call fcn.140010980
test eax, eax
jns 0x14000874f
lea rcx, str.ERROR:_Unable_to_place_device_into_recovery_mode_from_normal_mode_n
call fcn.1400023a0
mov rcx, qword [r12]
test rcx, rcx
je 0x14000873b
call qword [sym.imp.plist.dll_plist_free]
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
mov eax, 0xfffffffb
jmp 0x140006c30
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140008771
mov r8, qword [rsi + 0xc0]
mov ecx, 1
movsd xmm1, qword [0x140029520]
call rax
mov edx, dword [rsi]
test dl, 1
jne 0x140008a96
mov rax, qword [rsi + 0x88]
mov ecx, dword [rax]
cmp ecx, 1
jne 0x140008835
mov rcx, rsi
call fcn.1400032c0
mov rcx, rsi
call fcn.1400112e0
test byte [rsi], 8
je 0x140008816
mov rcx, qword [rsi + 0x78]
call fcn.14000ffe0
test eax, eax
je 0x140008816
lea rcx, str.connecting_to_DFU_n
call fcn.140002320
mov rcx, rsi
call fcn.1400031b0
test eax, eax
js 0x140008a96
lea rcx, str.exploiting_with_limera1n_n
call fcn.140002320
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsi + 0x78]
call fcn.1400100a0
test eax, eax
je 0x140008802
lea rcx, str.ERROR:_limera1n_exploit_failed_n
call fcn.1400023a0
mov rcx, rsi
call fcn.1400032c0
jmp 0x140008a96
mov rcx, rsi
call fcn.1400032c0
lea rcx, str.exploited_n
call fcn.140002320
mov rdx, r13
mov rcx, rsi
call fcn.140003710
test eax, eax
jns 0x14000893f
lea rcx, str.ERROR:_Unable_to_place_device_into_recovery_mode_from_DFU_mode_n
jmp 0x140008b41
cmp ecx, 2
jne 0x14000893f
cmp dword [rsi + 0xa0], 8
jle 0x14000886f
test dl, 8
jne 0x14000886f
cmp dword [rsi + 0x34], r14d
jne 0x14000886f
mov rcx, rsi
call fcn.140011c00
test eax, eax
jns 0x14000886f
lea rcx, str.ERROR:_Unable_to_send_APTicket_n
call fcn.1400023a0
jmp 0x140008b5f
lea r12, [rsi + 0xd8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, r13
mov rcx, rsi
call fcn.140012020
test eax, eax
jns 0x1400088a8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.ERROR:_Unable_to_send_iBEC_n
call fcn.1400023a0
jmp 0x140008b5f
mov rcx, rsi
call fcn.1400112e0
lea rcx, str.Waiting_for_device_to_disconnect..._n
call fcn.140002440
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x58]
cmp qword [rsi + 0x88], rax
jne 0x1400089e5
test byte [rsi], 1
jne 0x1400089e5
lea rcx, str.Waiting_for_device_to_reconnect_in_recovery_mode..._n
call fcn.140002440
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [0x14002e060]
cmp qword [rsi + 0x88], rax
jne 0x1400089c2
test byte [rsi], 1
jne 0x1400089c2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140008961
mov r8, qword [rsi + 0xc0]
mov ecx, 1
movsd xmm1, qword [0x140029528]
call rax
test byte [rsi], 1
jne 0x140008a96
cmp dword [rsi + 0x34], r14d
jne 0x140008a45
cmp dword [rsi + 0xa0], 8
jle 0x140008a45
lea r8, [rbp - 0x20]
mov qword [rbp + 8], r14
lea rdx, [rbp + 8]
mov dword [rbp - 0x20], r14d
mov rcx, rsi
call fcn.1400097f0
test eax, eax
jns 0x140008a08
lea rcx, str.ERROR:_Unable_to_get_nonce_from_device__n
call fcn.1400023a0
mov rcx, qword [rsi + 0x70]
lea rdx, str.reset
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_send_command]
jmp 0x140008b5f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [rsi], 1
jne 0x140008b5f
lea rcx, str.ERROR:_Device_did_not_reconnect_in_recovery_mode._Possibly_invalid_iBEC._Reset_device_and_try_again._n
call fcn.1400023a0
jmp 0x140008b5f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [rsi], 1
jne 0x140008b5f
lea rcx, str.ERROR:_Device_did_not_disconnect._Possibly_invalid_iBEC._Reset_device_and_try_again._n
call fcn.1400023a0
jmp 0x140008b5f
mov r12, qword [rsi + 0x28]
mov r13, qword [rbp + 8]
test r12, r12
je 0x140008ac7
movsxd rax, dword [rbp - 0x20]
cmp eax, dword [rsi + 0x30]
jne 0x140008ab5
mov r8, rax
mov rdx, r12
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140008ab5
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, qword [rbp - 0x10]
lea r12, [rsi + 8]
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140008a6b
mov r8, qword [rsi + 0xc0]
mov ecx, 1
movsd xmm1, qword [0x140029538]
call rax
test byte [rsi], 1
jne 0x140008a96
mov rax, qword [rsi + 0x88]
cmp dword [rax], 2
jne 0x140008b83
cmp qword [rsi + 0x48], r14
jne 0x140008b2b
lea rcx, str.ERROR:_could_not_retrieve_device_serial_number._Cant_continue._n
call fcn.1400023a0
test edi, edi
je 0x140006c2d
test rbx, rbx
je 0x140006c2d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
jmp 0x140006c2d
test r12, r12
je 0x140008ac7
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, qword [rbp + 8]
test byte [rsi], 8
lea r12, [rsi + 8]
mov eax, dword [rbp - 0x20]
mov dword [rsi + 0x30], eax
mov qword [rsi + 0x28], r13
jne 0x140008b22
mov rcx, qword [r12]
call qword [sym.imp.plist.dll_plist_free]
mov r13, qword [rbp - 0x10]
mov r8, r12
mov rdx, r13
mov rcx, rsi
call fcn.140009fb0
test eax, eax
jns 0x140008b03
lea rcx, str.ERROR:_Unable_to_get_SHSH_blobs_for_this_device_n
jmp 0x140008a91
mov rcx, qword [r12]
test rcx, rcx
jne 0x140008b18
lea rcx, str.ERROR:_cant_continue_without_TSS_n
jmp 0x140008a91
call fcn.14000a7e0
jmp 0x140008a49
mov r13, qword [rbp - 0x10]
jmp 0x140008a49
mov rdx, r13
mov rcx, rsi
call fcn.140011480
test eax, eax
jns 0x140008b7b
lea rcx, str.ERROR:_Unable_to_place_device_into_restore_mode_n
call fcn.1400023a0
mov rcx, qword [rbp]
call qword [sym.imp.plist.dll_plist_free]
mov rcx, qword [r12]
test rcx, rcx
je 0x140008b5f
call qword [sym.imp.plist.dll_plist_free]
test edi, edi
je 0x140008b71
test rbx, rbx
je 0x140008b71
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
mov eax, 0xfffffffe
jmp 0x140006c30
mov rcx, rsi
call fcn.1400112e0
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140008ba5
mov r8, qword [rsi + 0xc0]
mov ecx, 1
movsd xmm1, qword [0x140029548]
call rax
lea rcx, [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, str.Waiting_for_device_to_enter_restore_mode..._n
call fcn.140002320
lea rcx, [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0x100]
mov edx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, reloc.WS2_32.dll_closesocket
cmp qword [rsi + 0x88], rax
jne 0x140008d99
test byte [rsi], 1
jne 0x140008d99
lea rcx, [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsi + 0x88]
cmp dword [rax], 3
jne 0x140008c65
mov eax, 1
lea rcx, str.About_to_restore_device...__n
mov dword [rsi + 0x108], eax
call fcn.140002320
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.140017c50
mov r14d, eax
test eax, eax
jns 0x140008c65
lea rcx, str.ERROR:_Unable_to_restore_device_n
call fcn.1400023a0
test edi, edi
je 0x140008c5d
test rbx, rbx
je 0x140008c5d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
mov eax, r14d
jmp 0x140006c30
lea rcx, str.Cleaning_up..._n
call fcn.140002320
test edi, edi
je 0x140008c83
test rbx, rbx
je 0x140008c83
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
mov rcx, qword [rsi + 0x78]
lea rdx, str.AppleTV
mov r8d, 7
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140008d3e
mov rax, qword [rsi + 0x78]
mov rcx, qword [rax]
cmp byte [rcx + 7], 0x35
jge 0x140008d3e
mov rcx, rsi
call fcn.140011330
test eax, eax
jne 0x140008d32
mov rcx, qword [rsi + 0x70]
lea rdx, str.setenv_auto_boot_true
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_send_command]
test eax, eax
je 0x140008cef
lea rcx, str.ERROR:_Unable_to_set_auto_boot_environmental_variable_n
call fcn.1400023a0
lea rcx, str.Setting_auto_boot_failed___n
jmp 0x140008d39
mov rcx, qword [rsi + 0x70]
lea rdx, str.saveenv
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_send_command]
test eax, eax
je 0x140008d1c
lea rcx, str.ERROR:_Unable_to_save_environmental_variable_n
call fcn.1400023a0
lea rcx, str.Setting_auto_boot_failed___n
jmp 0x140008d39
mov rcx, qword [rsi + 0x70]
lea rdx, str.reset
mov rcx, qword [rcx]
call qword [sym.imp.irecovery.dll_irecv_send_command]
jmp 0x140008d3e
lea rcx, str.Could_not_connect_to_device_in_recovery_mode._n
call fcn.1400023a0
lea rcx, str.DONE_n
call fcn.140002320
test r14d, r14d
jne 0x140008d70
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140008d70
mov r8, qword [rsi + 0xc0]
lea ecx, [r14 + 6]
movsd xmm1, qword [0x140029550]
call rax
mov rcx, qword [rbp]
test rcx, rcx
je 0x140008d7f
call qword [sym.imp.plist.dll_plist_free]
test r13, r13
je 0x140008c5d
mov rcx, r13
call qword [sym.imp.plist.dll_plist_free]
mov eax, r14d
jmp 0x140006c30
lea rcx, [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.ERROR:_Device_failed_to_enter_restore_mode._n
jmp 0x140008a91
mov rdx, qword [rsi + 0x50]
lea rcx, str.ERROR:_Could_not_find_all_required_components_in_IPSW__s_n
call fcn.1400023a0
jmp 0x140006c2d
lea rdx, str.build_manifest_check_compatibility
lea rcx, str._s:_ERROR:_SupportedProductTypes_key_missing_n
call fcn.140002440
lea rdx, str.build_manifest_check_compatibility
lea rcx, str._s:_WARNING:_If_attempting_to_install_iPhoneOS_2.x__be_advised_that_Restore.plist_does_not_contain_the
call fcn.140002440
lea rdx, str.build_manifest_check_compatibility
lea rcx, str._s:_WARNING:_key_SupportedProductTypes._Recommendation_is_to_manually_add_it_to_the_Restore.plist.
call fcn.140002440
lea rcx, str.ERROR:_Could_not_make_sure_this_firmware_is_suitable_for_the_current_device._Refusing_to_continue._n
jmp 0x140006c28
mov rdx, qword [rsi + 0x50]
lea rcx, str.ERROR:_Unable_to_extract_BuildManifest_from__s._Firmware_file_might_be_corrupt._n
call fcn.1400023a0
jmp 0x140006c2d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.ERROR:_Unable_to_discover_device_mode._Please_make_sure_a_device_is_attached._n
call fcn.1400023a0
mov rax, r15
jmp 0x140006c30
call fcn.14001c0cc
int3