Function at 0x140009fb0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov qword [r8], 0
mov r12, r8
cmp dword [rcx + 0xa0], 8
mov r13, rdx
mov rbp, rcx
jle 0x140009ffb
test byte [rcx], 8
je 0x14000a1b1
lea rcx, str.checking_for_local_shsh_n
call fcn.1400023a0
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x14000a18b
mov rax, qword [rbp + 0x78]
mov r8, qword [rbp + 0xb0]
mov r9, qword [rax]
mov rax, qword [rbp + 0x20]
test r8, r8
je 0x14000a04e
mov qword [rsp + 0x28], rcx
lea rdx, str._s_shsh__I64u__s__s.shsh
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x70]
mov r9, rax
call fcn.1400059e0
jmp 0x14000a067
mov qword [rsp + 0x20], rcx
lea rdx, str.shsh__I64u__s__s.shsh
lea rcx, [rsp + 0x70]
mov r8, rax
call fcn.1400059e0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x14000a178
lea rdx, [0x14001dbf4]
lea rcx, [rsp + 0x70]
call qword [sym.imp.zlib1.dll_gzopen]
mov rdi, rax
test rax, rax
je 0x14000a197
mov ecx, 0x4000
xor ebx, ebx
mov r15d, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov r14, rax
mov r8d, 0x4000
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.zlib1.dll_gzread]
test eax, eax
js 0x14000a152
add ebx, eax
cmp eax, 0x4000
jge 0x14000a0e3
mov rcx, rdi
call qword [sym.imp.zlib1.dll_gzeof]
test eax, eax
jne 0x14000a10c
add r15d, 0x4000
mov rcx, rsi
movsxd rdx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
movsxd r14, ebx
mov rcx, rdi
mov rsi, rax
add r14, rax
call qword [sym.imp.zlib1.dll_gzeof]
test eax, eax
je 0x14000a0b3
mov rcx, rdi
call qword [sym.imp.zlib1.dll_gzclose]
test ebx, ebx
jle 0x14000a147
movabs rax, 0x30307473696c7062
mov r8, r12
mov edx, ebx
mov rcx, rsi
cmp qword [rsi], rax
jne 0x14000a141
call qword [sym.imp.plist.dll_plist_from_bin]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000a197
call qword [sym.imp.plist.dll_plist_from_xml]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000a197
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error_reading_gz_compressed_data_n
call fcn.140005930
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x70]
lea rcx, str.no_local_file__s_n
call fcn.1400023a0
jmp 0x14000a197
lea rcx, str.No_version_found___n
call fcn.1400023a0
cmp qword [r12], 0
je 0x14000a1b1
lea rcx, str.Using_cached_SHSH_n
call fcn.140002320
xor eax, eax
jmp 0x14000a7ab
lea rcx, str.Trying_to_fetch_new_SHSH_blob_n
call fcn.140002320
call qword [sym.imp.plist.dll_plist_new_dict]
mov rcx, qword [rbp + 0x20]
mov rbx, rax
call qword [sym.imp.plist.dll_plist_new_uint]
lea rdx, str.ApECID
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000a209
movsxd rdx, dword [rbp + 0x30]
call qword [sym.imp.plist.dll_plist_new_data]
lea rdx, str.ApNonce
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov rcx, rbp
call fcn.1400099e0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000a25f
movsxd rdx, dword [rsp + 0x38]
call qword [sym.imp.plist.dll_plist_new_data]
lea rdx, str.ApSepNonce
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov cl, 1
call qword [sym.imp.plist.dll_plist_new_bool]
lea rdx, str.ApProductionMode
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
cmp dword [rbp + 0x34], 0
je 0x14000a29f
mov cl, 1
call qword [sym.imp.plist.dll_plist_new_bool]
lea rdx, str.ApSecurityMode
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov cl, 1
jmp 0x14000a2a1
xor ecx, ecx
call qword [sym.imp.plist.dll_plist_new_bool]
lea rdx, str.ApSupportsImg4
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rdx, r13
mov rcx, rbx
call fcn.140018e50
call fcn.140018d70
mov rdi, rax
test rax, rax
jne 0x14000a2e3
lea rcx, str.ERROR:_Unable_to_create_TSS_request_n
call fcn.1400023a0
jmp 0x14000a79d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.140019970
test eax, eax
js 0x14000a788
mov rdx, rbx
mov rcx, rdi
call fcn.140019df0
test eax, eax
js 0x14000a788
cmp dword [rbp + 0x34], 0
je 0x14000a331
mov rdx, rbx
mov rcx, rdi
call fcn.140019750
test eax, eax
jns 0x14000a48d
lea rcx, str.ERROR:_Unable_to_add_img4_tags_to_TSS_request_n
jmp 0x14000a78f
test rbx, rbx
jne 0x14000a34e
lea rcx, str.ERROR:_Missing_required_AP_parameters_n
call fcn.1400023a0
lea rcx, str.ERROR:_Unable_to_add_img3_tags_to_TSS_request_n
jmp 0x14000a78f
lea rdx, str.ApNonce
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rsi, rax
test rax, rax
je 0x14000a3a8
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 7
je 0x14000a38c
lea rcx, str.ERROR:_Unable_to_find_required_ApNonce_in_parameters_n
call fcn.1400023a0
lea rcx, str.ERROR:_Unable_to_add_img3_tags_to_TSS_request_n
jmp 0x14000a78f
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.ApNonce
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov cl, 1
call qword [sym.imp.plist.dll_plist_new_bool]
lea rdx, str._APTicket
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.ApBoardID
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a773
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 1
jne 0x14000a773
lea rdx, str.ApChipID
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a75e
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 1
jne 0x14000a75e
lea rdx, str.ApSecurityDomain
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a749
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 1
jne 0x14000a749
lea rdx, str.ApProductionMode
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rsi, rax
test rax, rax
je 0x14000a734
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
test eax, eax
jne 0x14000a734
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.ApProductionMode
mov rcx, rdi
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rax, qword [rbp + 0x88]
cmp dword [rax], 4
jne 0x14000a6e9
lea r8, str.FirmwarePreflightInfo
mov rcx, rbp
xor r15d, r15d
call fcn.140010b60
mov rsi, rax
test rax, rax
je 0x14000a6d9
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 5
jne 0x14000a6d9
lea rdx, str.Nonce
mov rcx, rsi
mov r15, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a501
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.BbNonce
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.ChipID
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a532
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.BbChipID
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.CertID
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a563
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.BbGoldCertId
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.ChipSerialNo
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a594
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.BbSNUM
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rdx, rbx
mov rcx, rdi
call fcn.14001a110
lea rdx, str.EUICCChipID
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov qword [rsp + 0x38], 0
mov r14, rax
test rax, rax
je 0x14000a6e5
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 1
jne 0x14000a5fc
lea rdx, [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.plist.dll_plist_get_uint_val]
mov rcx, r14
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.eUICC_ChipID
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
cmp qword [rsp + 0x38], 5
jb 0x14000a6e5
lea rdx, str.EUICCCSN
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a639
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.eUICC_EID
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.EUICCCertIdentifier
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a66a
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.eUICC_RootKeyIdentifier
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.EUICCGoldNonce
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a69b
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.EUICCGoldNonce
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
lea rdx, str.EUICCMainNonce
mov rcx, rsi
call qword [sym.imp.plist.dll_plist_dict_get_item]
test rax, rax
je 0x14000a6cc
mov rcx, rax
call qword [sym.imp.plist.dll_plist_copy]
lea rdx, str.EUICCMainNonce
mov rcx, rbx
mov r8, rax
call qword [sym.imp.plist.dll_plist_dict_set_item]
mov rdx, rbx
mov rcx, rdi
call fcn.14001b130
jmp 0x14000a6e5
lea rcx, str.ERROR:_Unable_to_get_FirmwarePreflightInfo_n
call fcn.1400023a0
mov qword [rbp + 0x38], r15
mov rdx, qword [rbp + 0x10]
mov rcx, rdi
call fcn.14001ba30
mov rsi, rax
test rax, rax
jne 0x14000a70e
lea rcx, str.ERROR:_Unable_to_send_TSS_request_n
call fcn.140002320
jmp 0x14000a794
lea rcx, str.Received_SHSH_blobs_n
call fcn.140002320
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_free]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
xor eax, eax
mov qword [r12], rsi
jmp 0x14000a7ab
lea rcx, str.ERROR:_Unable_to_find_required_ApProductionMode_in_parameters_n
call fcn.1400023a0
lea rcx, str.ERROR:_Unable_to_add_img3_tags_to_TSS_request_n
jmp 0x14000a78f
lea rcx, str.ERROR:_Unable_to_find_required_ApSecurityDomain_in_request_n
call fcn.1400023a0
lea rcx, str.ERROR:_Unable_to_add_img3_tags_to_TSS_request_n
jmp 0x14000a78f
lea rcx, str.ERROR:_Unable_to_find_required_ApChipID_in_request_n
call fcn.1400023a0
lea rcx, str.ERROR:_Unable_to_add_img3_tags_to_TSS_request_n
jmp 0x14000a78f
lea rcx, str.ERROR:_Unable_to_find_required_ApBoardID_in_request_n
call fcn.1400023a0
lea rcx, str.ERROR:_Unable_to_add_img3_tags_to_TSS_request_n
jmp 0x14000a78f
lea rcx, str.ERROR:_Unable_to_add_common_tags_to_TSS_request_n
call fcn.1400023a0
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_free]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_free]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14001bfa0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret