Function at 0x4a077a
Capabilities:
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x4a5020
push ebx
mov ebx, ecx
push ecx
sub esp, 0x188
mov eax, dword [ecx]
lea edi, [ebp - 0x128]
mov dword [ebp - 0x16c], eax
call fcn.0042faf0
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x15c]
mov dword [esp], str.ANDROID_SERIAL
mov byte [ebp - 0x163], 1
mov dword [ebp - 0x158], 0x4ab03c
mov dword [ebp - 0x154], 0x4ab03c
call sub.msvcrt.dll_getenv
mov byte [ebp - 0x16f], 0
mov byte [ebp - 0x16e], 0
mov byte [ebp - 0x16d], 0
mov dword [0x4bf09c], eax
nop
lea eax, [ebp - 0x128]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.wub:k:n:r:t:s:S:lp:c:i:m:ha::
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call fcn.00432cf0
test eax, eax
js 0x4a0c04
cmp eax, 0x77
ja case.0x4a0830.1
lea esi, [esi]
jmp dword [eax*4 + 0x4ae900]
lea eax, [ebp - 0x138]
mov edi, 1
mov dword [ebp - 0x178], eax
mov ebx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x154]
mov dword [esp], ebx
lea ecx, [eax - 0xc]
call fcn.0046e570
mov eax, dword [ebp - 0x158]
lea ecx, [eax - 0xc]
sub esp, 4
mov dword [esp], ebx
call fcn.0046e570
mov eax, edi
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov byte [ebp - 0x16d], 1
jmp 0x4a07f0
mov eax, dword [ebp - 0x15c]
mov dword [esp], str.unbuffered
shl eax, 4
mov edi, dword [ebp + eax - 0x128]
mov dword [esp + 4], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4a1137
mov dword [esp + 4], edi
mov dword [esp], str.version
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4a1d54
mov dword [esp + 4], edi
mov dword [esp], str.slot
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4a0bb3
mov dword [esp + 4], edi
mov dword [esp], str.skip_secondary
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4a1ef3
mov byte [ebp - 0x16f], 1
jmp 0x4a07f0
mov byte [ebp - 0x163], 0
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4a527c], eax
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [0x4bf09c], eax
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4a5280], eax
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [0x4bf098], eax
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
test eax, eax
mov dword [0x4a528c], eax
jne 0x4a07f0
mov dword [esp], str.invalid_page_size
call fcn.00407490
mov dword [0x4bf08c], 1
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4a5284], eax
jmp 0x4a07f0
lea eax, [ebp - 0x138]
mov dword [esp + 4], eax
mov eax, dword [0x4c1048]
mov dword [esp + 8], 0
mov dword [ebp - 0x138], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov edx, dword [ebp - 0x138]
test edx, edx
je 0x4a2160
cmp byte [edx], 0
jne 0x4a2160
test eax, 0xffff0000
jne 0x4a2160
mov word [0x4bf090], ax
jmp 0x4a07f0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov edi, 1
mov dword [esp + 4], str.usage:_fastboot____option_____command__n_ncommands:_n__update__filename_________________________Reflash_device_from_update.zip._n___________________________________________Sets_the_flashed_slot_as_active._n__flashall_________________________________Flash_boot__system__vendor__and____n___________________________________________if_found____recovery._If_the_device_n___________________________________________supports_slots__the_slot_that_has_n___________________________________________been_flashed_to_is_set_as_active._n___________________________________________Secondary_images_may_be_flashed_to_n___________________________________________an_inactive_slot._n__flash__partition_____filename____________Write_a_file_to_a_flash_partition._n__flashing_lock____________________________Locks_the_device._Prevents_flashing._n__flashing_unlock__________________________Unlocks_the_device._Allows_flashing_n___________________________________________any_partition_except_n___________________________________________bootloader_related_partitions._n__flashing_lock_critical___________________Prevents_flashing_bootloader_related_n___________________________________________partitions._n__flashing_unlock_critical_________________Enables_flashing_bootloader_related_n___________________________________________partitions._n__flashing_get_unlock_ability______________Queries_bootloader_to_see_if_the_n___________________________________________device_is_unlocked._n__flashing_get_unlock_bootloader_nonce_____Queries_the_bootloader_to_get_the_n___________________________________________unlock_nonce._n__flashing_unlock_bootloader__request______Issue_unlock_bootloader_using_request._n__flashing_lock_bootloader_________________Locks_the_bootloader_to_prevent_n___________________________________________bootloader_version_rollback._n__erase__partition_________________________Erase_a_flash_partition._n__format_:__fs_type___:__size_____partition__n___________________________________________Format_a_flash_partition._Can_n___________________________________________override_the_fs_type_and_or_size_n___________________________________________the_bootloader_reports._n__getvar__variable_________________________Display_a_bootloader_variable._n__set_active__slot_________________________Sets_the_active_slot._If_slots_are_n___________________________________________not_supported__this_does_nothing._n__boot__kernel_____ramdisk_____second______Download_and_boot_kernel._n__flash:raw_boot__kernel_____ramdisk_____second______n___________________________________________Create_bootimage_and_flash_it._n__devices___l______________________________List_all_connected_devices__with_n___________________________________________device_paths_._n__continue_________________________________Continue_with_autoboot._n__reboot__bootloader_______________________Reboot_device__into_bootloader_._n__reboot_bootloader________________________Reboot_device_into_bootloader._n__help_____________________________________Show_this_help_message._n_noptions:_n___w_______________________________________Erase_userdata_and_cache__and_format_n___________________________________________if_supported_by_partition_type_._n___u_______________________________________Do_not_erase_partition_before_n___________________________________________formatting._n___s__specific_device______________________Specify_a_device._For_USB__provide_either_n___________________________________________a_serial_number_or_path_to_device_port._n___________________________________________For_ethernet__provide_an_address_in_the_n___________________________________________form__protocol_:_hostname__:port__where_n____________________________________________protocol__is_either_tcp_or_udp._n___p__product______________________________Specify_product_name._n___c__cmdline______________________________Override_kernel_commandline._n___i__vendor_id____________________________Specify_a_custom_USB_vendor_id._n___b____base__base_addr____________________Specify_a_custom_kernel_base_n___________________________________________address__default:_0x10000000_._n____k
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
jmp 0x4a0848
mov eax, dword [0x4c1048]
mov dword [0x4bf094], eax
jmp 0x4a07f0
mov eax, dword [0x4c1048]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [0x4a5288], eax
jmp 0x4a07f0
mov eax, dword [0x4c1048]
test eax, eax
je 0x4a0ac2
mov dword [esp], eax
lea ecx, [ebp - 0x154]
call fcn.0046eda0
push eax
mov byte [ebp - 0x16e], 1
jmp 0x4a07f0
mov edi, dword [0x4c1048]
lea eax, [ebp - 0x138]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00433fb0
mov ecx, dword [ebp - 0x138]
cmp edi, ecx
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], edx
je 0x4a0b20
movzx edi, byte [ecx]
and edi, 0xffffffdf
mov eax, edi
cmp al, 0x4b
jne 0x4a0b45
cmp dword [ebp - 0x174], 0x3fffff
jbe 0x4a1313
mov dword [esp], str.invalid_sparse_limit
mov dword [0x4a5298], 0xffffffff
mov dword [0x4a529c], 0xffffffff
call fcn.00407490
call sub.msvcrt.dll_abort
mov eax, edi
cmp al, 0x4d
jne 0x4a12c0
cmp dword [ebp - 0x174], 0xfff
ja 0x4a0b20
jb 0x4a0b66
cmp dword [ebp - 0x178], 0xfffffffe
ja 0x4a0b20
mov eax, dword [ebp - 0x178]
add ecx, 1
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x138], ecx
shld edx, eax, 0x14
shl eax, 0x14
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], edx
cmp byte [ecx], 0
jne 0x4a0b20
mov ecx, dword [ebp - 0x174]
test ecx, ecx
js 0x4a0b20
mov eax, dword [ebp - 0x178]
mov dword [0x4a529c], ecx
mov dword [0x4a5298], eax
jmp 0x4a07f0
lea eax, [ebp - 0x144]
mov dword [esp + 4], eax
mov eax, dword [0x4c1048]
lea ecx, [ebp - 0x138]
mov dword [esp], eax
call fcn.0046fc80
lea ecx, [ebp - 0x158]
push eax
push eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
call fcn.0046e7e0
push eax
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x140]
mov dword [esp], eax
call fcn.0046e570
push eax
jmp 0x4a07f0
mov eax, dword [0x4a5408]
mov edi, dword [ebp - 0x16c]
mov edx, dword [ebx + 4]
sub edi, eax
cmp byte [ebp - 0x16d], 0
lea edx, [edx + eax*4]
mov dword [ebp - 0x16c], edi
mov dword [ebx + 4], edx
jne 0x4a0c31
test edi, edi
je 0x4a0e54
cmp dword [ebp - 0x16c], 0
jle 0x4a0c7c
mov esi, dword [edx]
mov dword [esp + 4], str.devices
mov dword [ebp - 0x178], edx
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x178]
test eax, eax
mov edi, eax
je 0x4a16dc
mov dword [esp + 4], str.help
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
test eax, eax
mov edi, eax
je 0x4a187c
mov eax, dword [0x4bf084]
test eax, eax
je 0x4a16ff
mov dword [ebp - 0x150], eax
call fcn.00402e40
sub eax, 1
jle 0x4a1d11
mov dword [esp], 0x4ac240
lea ecx, [ebp - 0x158]
call fcn.004467f0
test eax, eax
push edi
jne 0x4a1690
mov dword [esp], 0x4ac240
lea ecx, [ebp - 0x154]
call fcn.004467f0
test eax, eax
push edx
jne 0x4a1644
cmp byte [ebp - 0x16e], 0
jne 0x4a1570
cmp dword [ebp - 0x16c], 0
mov byte [ebp - 0x170], 0
mov byte [ebp - 0x180], 0
jle 0x4a1346
movzx eax, byte [ebp - 0x16f]
mov dword [ebp - 0x184], eax
jmp 0x4a0d45
cmp dword [ebp - 0x16c], 1
je 0x4a213c
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00401f30
sub dword [ebp - 0x16c], 2
add dword [ebx + 4], 8
mov eax, dword [ebp - 0x16c]
test eax, eax
jle 0x4a1346
mov edx, dword [ebx + 4]
mov ecx, 7
mov edi, str.getvar
mov esi, dword [edx]
mov dword [ebp - 0x178], esi
repe cmpsb byte [esi], byte es:[edi]
je 0x4a0d10
mov esi, dword [ebp - 0x178]
mov edi, str.erase
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
jne 0x4a0e8e
cmp dword [ebp - 0x16c], 1
je 0x4a213c
mov dword [esp], 8
mov dword [ebp - 0x130], 0
call fcn.0049e4a0
lea edx, [ebp - 0x150]
lea ecx, [ebp - 0x144]
mov dword [eax], edx
lea edx, [ebx + 4]
mov dword [eax + 4], edx
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x12c], 0x403450
mov dword [ebp - 0x130], 0x402710
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.0046fc80
lea ecx, [ebp - 0x158]
lea edx, [ebp - 0x144]
push eax
push eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], 1
call fcn.00404260
mov eax, dword [ebp - 0x144]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x148]
mov dword [esp], eax
call fcn.0046e570
mov eax, dword [ebp - 0x130]
sub esp, 4
test eax, eax
je 0x4a0e44
lea edi, [ebp - 0x138]
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
sub dword [ebp - 0x16c], 2
add dword [ebx + 4], 8
jmp 0x4a0d37
cmp byte [ebp - 0x16e], 0
jne 0x4a0c7c
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov di, 1
mov dword [esp + 4], str.usage:_fastboot____option_____command__n_ncommands:_n__update__filename_________________________Reflash_device_from_update.zip._n___________________________________________Sets_the_flashed_slot_as_active._n__flashall_________________________________Flash_boot__system__vendor__and____n___________________________________________if_found____recovery._If_the_device_n___________________________________________supports_slots__the_slot_that_has_n___________________________________________been_flashed_to_is_set_as_active._n___________________________________________Secondary_images_may_be_flashed_to_n___________________________________________an_inactive_slot._n__flash__partition_____filename____________Write_a_file_to_a_flash_partition._n__flashing_lock____________________________Locks_the_device._Prevents_flashing._n__flashing_unlock__________________________Unlocks_the_device._Allows_flashing_n___________________________________________any_partition_except_n___________________________________________bootloader_related_partitions._n__flashing_lock_critical___________________Prevents_flashing_bootloader_related_n___________________________________________partitions._n__flashing_unlock_critical_________________Enables_flashing_bootloader_related_n___________________________________________partitions._n__flashing_get_unlock_ability______________Queries_bootloader_to_see_if_the_n___________________________________________device_is_unlocked._n__flashing_get_unlock_bootloader_nonce_____Queries_the_bootloader_to_get_the_n___________________________________________unlock_nonce._n__flashing_unlock_bootloader__request______Issue_unlock_bootloader_using_request._n__flashing_lock_bootloader_________________Locks_the_bootloader_to_prevent_n___________________________________________bootloader_version_rollback._n__erase__partition_________________________Erase_a_flash_partition._n__format_:__fs_type___:__size_____partition__n___________________________________________Format_a_flash_partition._Can_n___________________________________________override_the_fs_type_and_or_size_n___________________________________________the_bootloader_reports._n__getvar__variable_________________________Display_a_bootloader_variable._n__set_active__slot_________________________Sets_the_active_slot._If_slots_are_n___________________________________________not_supported__this_does_nothing._n__boot__kernel_____ramdisk_____second______Download_and_boot_kernel._n__flash:raw_boot__kernel_____ramdisk_____second______n___________________________________________Create_bootimage_and_flash_it._n__devices___l______________________________List_all_connected_devices__with_n___________________________________________device_paths_._n__continue_________________________________Continue_with_autoboot._n__reboot__bootloader_______________________Reboot_device__into_bootloader_._n__reboot_bootloader________________________Reboot_device_into_bootloader._n__help_____________________________________Show_this_help_message._n_noptions:_n___w_______________________________________Erase_userdata_and_cache__and_format_n___________________________________________if_supported_by_partition_type_._n___u_______________________________________Do_not_erase_partition_before_n___________________________________________formatting._n___s__specific_device______________________Specify_a_device._For_USB__provide_either_n___________________________________________a_serial_number_or_path_to_device_port._n___________________________________________For_ethernet__provide_an_address_in_the_n___________________________________________form__protocol_:_hostname__:port__where_n____________________________________________protocol__is_either_tcp_or_udp._n___p__product______________________________Specify_product_name._n___c__cmdline______________________________Override_kernel_commandline._n___i__vendor_id____________________________Specify_a_custom_USB_vendor_id._n___b____base__base_addr____________________Specify_a_custom_kernel_base_n___________________________________________address__default:_0x10000000_._n____k
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
jmp 0x4a0848
mov eax, dword [ebp - 0x178]
mov dword [esp + 8], 6
mov dword [esp + 4], str.format
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strncmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a1005
cmp dword [ebp - 0x16c], 1
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
je 0x4a213c
mov dword [esp + 4], 0x3a
mov eax, dword [edx]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4a0f24
lea esi, [eax + 1]
mov dword [esp + 4], 0x3a
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
mov dword [ebp - 0x148], eax
je 0x4a0f1e
mov byte [eax], 0
add dword [ebp - 0x148], 1
mov dword [ebp - 0x14c], esi
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x4a0f3d
cmp byte [eax], 0
jne 0x4a0f3d
mov dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x4a0f56
cmp byte [eax], 0
jne 0x4a0f56
mov dword [ebp - 0x148], 0
mov dword [esp], 0x10
mov dword [ebp - 0x130], 0
call fcn.0049e4a0
lea edx, [ebp - 0x163]
lea ecx, [ebp - 0x144]
mov dword [eax], edx
lea edx, [ebp - 0x150]
mov dword [eax + 4], edx
lea edx, [ebp - 0x14c]
mov dword [eax + 8], edx
lea edx, [ebp - 0x148]
mov dword [eax + 0xc], edx
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x162]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x12c], 0x404fe0
mov dword [ebp - 0x130], 0x4024a0
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.0046fc80
lea ecx, [ebp - 0x158]
lea edx, [ebp - 0x144]
push eax
push eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], 1
call fcn.00404260
mov eax, dword [ebp - 0x144]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x161]
jmp 0x4a0e18
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.signature
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a109a
cmp dword [ebp - 0x16c], 1
je 0x4a213c
mov eax, dword [edx + 4]
lea edx, [ebp - 0x140]
call fcn.004023e0
test eax, eax
mov dword [ebp - 0x160], eax
je 0x4a23b5
mov edx, dword [ebp - 0x140]
xor dh, 1
or edx, dword [ebp - 0x13c]
jne 0x4a23a9
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
mov dword [esp], str.signature
call fcn.00402020
mov dword [esp + 4], str.installing_signature
mov dword [esp], str.signature
call fcn.00401ff0
jmp 0x4a0e44
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.reboot
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a118c
mov esi, dword [ebp - 0x16c]
lea eax, [edx + 4]
mov dword [ebx + 4], eax
sub esi, 1
je 0x4a1125
mov dword [esp + 4], str.bootloader
mov eax, dword [edx + 4]
mov dword [ebp - 0x178], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x178]
test eax, eax
jne 0x4a1125
sub dword [ebp - 0x16c], 2
add edx, 8
cmp dword [ebp - 0x16c], 0xffffffff
mov dword [ebx + 4], edx
je 0x4a213c
mov byte [ebp - 0x170], 1
mov byte [ebp - 0x180], 0
jmp 0x4a0d37
mov dword [ebp - 0x16c], esi
mov byte [ebp - 0x180], 1
jmp 0x4a0d37
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_setvbuf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_setvbuf
jmp 0x4a07f0
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.reboot_bootloader
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
je 0x4a139b
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.continue
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
je 0x4a1a08
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.boot
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a18a5
mov edi, dword [ebp - 0x16c]
lea eax, [edx + 4]
mov dword [ebx + 4], eax
cmp edi, 1
je 0x4a1d87
sub edi, 2
mov eax, dword [edx + 4]
lea ecx, [edx + 8]
test edi, edi
mov dword [ebx + 4], ecx
jle 0x4a1d8b
mov edi, dword [ebp - 0x16c]
lea ecx, [edx + 0xc]
mov esi, dword [edx + 8]
mov dword [ebx + 4], ecx
sub edi, 3
test edi, edi
jle 0x4a2258
mov edi, dword [ebp - 0x16c]
add edx, 0x10
mov ecx, dword [edx - 4]
mov dword [ebx + 4], edx
sub edi, 4
mov edx, dword [0x4bf094]
mov dword [esp + 4], edx
lea edx, [ebp - 0x140]
mov dword [esp], edx
mov edx, esi
call fcn.00402f90
test eax, eax
mov dword [ebp - 0x160], eax
je case.0x4a0830.63
mov edx, dword [ebp - 0x140]
mov dword [esp + 4], eax
mov dword [esp], str.boot.img
mov dword [esp + 8], edx
call fcn.00402020
mov dword [esp + 4], str.booting
mov dword [esp], str.boot
call fcn.00401ff0
mov dword [ebp - 0x16c], edi
jmp 0x4a0d37
mov eax, edi
cmp al, 0x47
jne 0x4a0b8e
cmp dword [ebp - 0x174], 3
ja 0x4a0b20
jb 0x4a12e6
cmp dword [ebp - 0x178], 0xfffffffe
ja 0x4a0b20
mov eax, dword [ebp - 0x178]
add ecx, 1
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x138], ecx
shld edx, eax, 0x1e
shl eax, 0x1e
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], edx
jmp 0x4a0b8e
jae 0x4a13b4
mov eax, dword [ebp - 0x178]
add ecx, 1
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x138], ecx
shld edx, eax, 0xa
shl eax, 0xa
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], edx
jmp 0x4a0b8e
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
cmp byte [ebp - 0x16d], 0
jne 0x4a13e7
cmp byte [ebp - 0x16e], 0
jne 0x4a13d7
cmp byte [ebp - 0x180], 0
jne 0x4a13c6
cmp byte [ebp - 0x170], 0
jne 0x4a1b99
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call fcn.004020c0
test eax, eax
setne al
movzx eax, al
mov edi, eax
jmp 0x4a0848
add edx, 4
sub dword [ebp - 0x16c], 1
mov dword [ebx + 4], edx
mov byte [ebp - 0x170], 1
jmp 0x4a0d37
cmp dword [ebp - 0x178], 0xfffffffe
ja 0x4a0b20
jmp 0x4a1319
call fcn.00401fc0
nop
lea esi, [esi]
call fcn.004020a0
jmp 0x4a137e
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call fcn.00401d10
jmp 0x4a1368
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea esi, [ebp - 0x148]
mov dword [esp + 4], str.wiping_userdata..._n
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
mov dword [esp], str.userdata
call fcn.00401d50
mov edi, dword [ebp - 0x178]
mov dword [esp + 4], esi
mov dword [esp], 0x4ac240
mov ecx, edi
call fcn.0046fc80
mov edx, str.userdata
mov ecx, 1
mov dword [ebp - 0x178], edi
push eax
push eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 8], edi
lea edi, [ebp - 0x14c]
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00404930
mov ebx, dword [ebp - 0x138]
lea ecx, [ebx - 0xc]
lea ebx, [ebp - 0x144]
mov dword [esp], ebx
call fcn.0046e570
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x144], 0x4ab03c
push eax
mov dword [esp + 4], edi
mov dword [esp], str.partition_type:cache
call fcn.0046fc80
push eax
push eax
mov eax, dword [ebp - 0x178]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call fcn.00401bf0
test al, al
je 0x4a1541
mov eax, dword [ebp - 0x144]
cmp dword [eax - 0xc], 0
je 0x4a1541
mov eax, dword [ebp - 0x138]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.0046e570
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push ecx
mov dword [esp + 4], str.wiping_cache..._n
mov dword [esp], eax
call fcn.00440af0
mov dword [esp], str.cache
call fcn.00401d50
mov dword [esp + 4], edi
mov edi, dword [ebp - 0x178]
mov dword [esp], 0x4ac240
mov ecx, edi
call fcn.0046fc80
mov eax, dword [ebp - 0x150]
mov ecx, 1
mov edx, str.cache
push ebx
push ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00404930
mov eax, dword [ebp - 0x138]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.0046e570
mov eax, dword [ebp - 0x144]
lea ecx, [eax - 0xc]
mov eax, dword [ebp - 0x178]
push edx
mov dword [esp], eax
call fcn.0046e570
push esi
jmp 0x4a135f
lea ecx, [ebp - 0x154]
mov dword [esp], 0x4ac240
call fcn.004467f0
test eax, eax
push ecx
jne 0x4a0ce0
mov dword [esp], 0x4ac240
lea ecx, [ebp - 0x158]
call fcn.004467f0
test eax, eax
push edx
jne 0x4a1f96
lea eax, [ebp - 0x138]
mov esi, eax
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x148]
mov ecx, esi
mov dword [esp + 4], eax
mov dword [esp], str.current_slot
mov dword [ebp - 0x140], 0x4ab03c
call fcn.0046fc80
mov eax, dword [ebp - 0x150]
push edi
push edi
lea edi, [ebp - 0x140]
mov dword [esp + 4], esi
lea esi, [ebp - 0x144]
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.00401bf0
mov dword [esp], esi
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
call fcn.0046e570
push eax
mov eax, dword [ebp - 0x17c]
test al, al
jne 0x4a21e9
mov byte [ebp - 0x16e], 0
mov eax, dword [ebp - 0x140]
lea ecx, [eax - 0xc]
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call fcn.0046e570
push edx
jmp 0x4a0ce0
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x138]
mov edi, eax
mov dword [esp], 0
lea ecx, [ebp - 0x154]
call fcn.004039d0
lea ecx, [ebp - 0x154]
mov dword [esp], edi
call fcn.0046e7e0
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x140]
push esi
mov dword [esp], eax
call fcn.0046e570
push edi
jmp 0x4a0cd3
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x138]
mov edi, eax
mov dword [esp], 1
lea ecx, [ebp - 0x158]
call fcn.004039d0
lea ecx, [ebp - 0x158]
mov dword [esp], edi
call fcn.0046e7e0
mov eax, dword [ebp - 0x138]
push ecx
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x140]
mov dword [esp], eax
call fcn.0046e570
push esi
jmp 0x4a0cb8
lea eax, [edx + 4]
mov dword [ebx + 4], eax
mov dword [esp], 0x403c70
call fcn.00407c90
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
jmp 0x4a0848
mov eax, dword [0x4bf09c]
mov dword [ebp - 0x148], 0x4ab03c
mov dword [ebp - 0x144], 0
test eax, eax
je 0x4a1d41
lea edi, [ebp - 0x138]
lea edx, [ebp - 0x140]
mov ecx, edi
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x178], edi
call fcn.0046fc80
push esi
push esi
mov dword [esp], edi
mov dword [esp + 4], str.tcp:
call fcn.00426370
mov esi, eax
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0046e570
mov eax, esi
test al, al
push edi
je 0x4a1f25
mov eax, dword [0x4bf09c]
xor edi, edi
mov dword [ebp - 0x144], 0x15b2
lea esi, [eax + 4]
test esi, esi
je 0x4a1a3e
mov ecx, dword [ebp - 0x178]
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x140], 0x4ab03c
call fcn.0046fc80
lea edx, [ebp - 0x140]
push eax
push eax
lea eax, [ebp - 0x144]
mov dword [esp + 8], eax
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x178]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp], eax
call fcn.00425c70
mov edx, eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x17c], edx
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x150]
mov dword [esp], eax
call fcn.0046e570
mov edx, dword [ebp - 0x17c]
test dl, dl
push eax
mov eax, dword [ebp - 0x140]
jne 0x4a1a2c
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], esi
mov dword [esp + 4], str.error:_Invalid_network_address__s:__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
mov eax, dword [ebp - 0x140]
mov edi, dword [ebp - 0x178]
lea ecx, [eax - 0xc]
mov dword [esp], edi
call fcn.0046e570
push eax
mov eax, dword [ebp - 0x148]
mov dword [esp], edi
mov edi, 1
lea ecx, [eax - 0xc]
call fcn.0046e570
mov dword [ebp - 0x150], 0
push eax
jmp 0x4a0848
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.usage:_fastboot____option_____command__n_ncommands:_n__update__filename_________________________Reflash_device_from_update.zip._n___________________________________________Sets_the_flashed_slot_as_active._n__flashall_________________________________Flash_boot__system__vendor__and____n___________________________________________if_found____recovery._If_the_device_n___________________________________________supports_slots__the_slot_that_has_n___________________________________________been_flashed_to_is_set_as_active._n___________________________________________Secondary_images_may_be_flashed_to_n___________________________________________an_inactive_slot._n__flash__partition_____filename____________Write_a_file_to_a_flash_partition._n__flashing_lock____________________________Locks_the_device._Prevents_flashing._n__flashing_unlock__________________________Unlocks_the_device._Allows_flashing_n___________________________________________any_partition_except_n___________________________________________bootloader_related_partitions._n__flashing_lock_critical___________________Prevents_flashing_bootloader_related_n___________________________________________partitions._n__flashing_unlock_critical_________________Enables_flashing_bootloader_related_n___________________________________________partitions._n__flashing_get_unlock_ability______________Queries_bootloader_to_see_if_the_n___________________________________________device_is_unlocked._n__flashing_get_unlock_bootloader_nonce_____Queries_the_bootloader_to_get_the_n___________________________________________unlock_nonce._n__flashing_unlock_bootloader__request______Issue_unlock_bootloader_using_request._n__flashing_lock_bootloader_________________Locks_the_bootloader_to_prevent_n___________________________________________bootloader_version_rollback._n__erase__partition_________________________Erase_a_flash_partition._n__format_:__fs_type___:__size_____partition__n___________________________________________Format_a_flash_partition._Can_n___________________________________________override_the_fs_type_and_or_size_n___________________________________________the_bootloader_reports._n__getvar__variable_________________________Display_a_bootloader_variable._n__set_active__slot_________________________Sets_the_active_slot._If_slots_are_n___________________________________________not_supported__this_does_nothing._n__boot__kernel_____ramdisk_____second______Download_and_boot_kernel._n__flash:raw_boot__kernel_____ramdisk_____second______n___________________________________________Create_bootimage_and_flash_it._n__devices___l______________________________List_all_connected_devices__with_n___________________________________________device_paths_._n__continue_________________________________Continue_with_autoboot._n__reboot__bootloader_______________________Reboot_device__into_bootloader_._n__reboot_bootloader________________________Reboot_device_into_bootloader._n__help_____________________________________Show_this_help_message._n_noptions:_n___w_______________________________________Erase_userdata_and_cache__and_format_n___________________________________________if_supported_by_partition_type_._n___u_______________________________________Do_not_erase_partition_before_n___________________________________________formatting._n___s__specific_device______________________Specify_a_device._For_USB__provide_either_n___________________________________________a_serial_number_or_path_to_device_port._n___________________________________________For_ethernet__provide_an_address_in_the_n___________________________________________form__protocol_:_hostname__:port__where_n____________________________________________protocol__is_either_tcp_or_udp._n___p__product______________________________Specify_product_name._n___c__cmdline______________________________Override_kernel_commandline._n___i__vendor_id____________________________Specify_a_custom_USB_vendor_id._n___b____base__base_addr____________________Specify_a_custom_kernel_base_n___________________________________________address__default:_0x10000000_._n____k
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
jmp 0x4a0848
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.flash
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a1bb7
cmp dword [ebp - 0x16c], 1
mov esi, dword [edx + 4]
mov dword [ebp - 0x148], 0x4ab03c
je 0x4a213c
cmp dword [ebp - 0x16c], 2
je 0x4a1d94
mov eax, dword [edx + 8]
lea edi, [ebp - 0x148]
mov ecx, edi
mov dword [esp], eax
call fcn.0046eda0
sub dword [ebp - 0x16c], 3
push eax
add dword [ebx + 4], 0xc
mov dword [esp], 0x4ac240
mov ecx, edi
call fcn.004467f0
test eax, eax
push edx
je 0x4a237c
mov dword [esp], 0xc
mov dword [ebp - 0x130], 0
call fcn.0049e4a0
lea edx, [ebp - 0x163]
lea ecx, [ebp - 0x144]
mov dword [eax], edx
lea edx, [ebp - 0x150]
mov dword [eax + 4], edx
mov dword [eax + 8], edi
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x161]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x12c], 0x404690
mov dword [ebp - 0x130], 0x402540
call fcn.0046fc80
lea ecx, [ebp - 0x158]
lea edx, [ebp - 0x144]
push eax
push eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], 1
call fcn.00404260
mov eax, dword [ebp - 0x144]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0046e570
push eax
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x4a19eb
lea edi, [ebp - 0x138]
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
mov eax, dword [ebp - 0x148]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x138]
mov dword [esp], eax
call fcn.0046e570
push eax
jmp 0x4a0d37
mov dword [esp + 4], str.resuming_boot
mov dword [esp], str.continue
call fcn.00401ff0
sub dword [ebp - 0x16c], 1
add dword [ebx + 4], 4
jmp 0x4a0d37
lea ecx, [eax - 0xc]
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call fcn.0046e570
push eax
mov esi, 1
mov dword [ebp - 0x17c], ebx
mov ebx, esi
mov esi, dword [ebp - 0x178]
jmp 0x4a1b03
lea eax, [ebp - 0x140]
test edi, edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x140], 0x4ab03c
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
je 0x4a1b26
call fcn.00407400
mov eax, dword [ebp - 0x138]
mov dword [0x4bf084], eax
cmp dword [0x4bf084], 0
je 0x4a1b3b
mov eax, dword [ebp - 0x140]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.0046e570
push eax
mov eax, dword [0x4bf084]
test eax, eax
jne 0x4a1b6a
test bl, bl
je 0x4a1af5
mov edx, dword [0x4bf09c]
mov eax, str.any_device
mov dword [esp + 4], str.__waiting_for__s___n
test edx, edx
cmovne eax, edx
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
mov dword [esp], 0x3e8
xor ebx, ebx
call fcn.00433350
mov eax, dword [ebp - 0x148]
cmp dword [eax - 0xc], 0
jne 0x4a1a56
mov dword [esp], 0x402290
call fcn.00407c90
mov dword [0x4bf084], eax
jmp 0x4a1ab8
call fcn.00406820
mov eax, dword [ebp - 0x138]
mov dword [0x4bf084], eax
jmp 0x4a1a99
test bl, bl
je 0x4a1aa6
mov eax, dword [ebp - 0x140]
mov dword [esp + 4], str.error:__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
jmp 0x4a1aa6
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x148]
mov ebx, dword [ebp - 0x17c]
lea ecx, [eax - 0xc]
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call fcn.0046e570
push eax
mov eax, dword [ebp - 0x180]
jmp 0x4a0c89
mov dword [esp + 4], str.rebooting_into_bootloader
mov dword [esp], str.reboot_bootloader
call fcn.00401ff0
call fcn.004020a0
jmp 0x4a137e
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.flash:raw
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a1df1
mov edi, dword [ebp - 0x16c]
mov eax, dword [edx + 8]
cmp edi, 2
jle 0x4a213c
lea ecx, [edx + 0xc]
cmp edi, 3
mov dword [ebx + 4], ecx
je 0x4a2129
lea ecx, [edx + 0x10]
cmp edi, 4
mov esi, dword [edx + 0xc]
mov dword [ebx + 4], ecx
je 0x4a2398
sub dword [ebp - 0x16c], 5
add edx, 0x14
mov ecx, dword [edx - 4]
mov dword [ebx + 4], edx
mov edx, dword [0x4bf094]
lea edi, [ebp - 0x140]
mov dword [esp], edi
mov dword [esp + 4], edx
mov edx, esi
call fcn.00402f90
test eax, eax
mov dword [ebp - 0x160], eax
je 0x4a238c
mov dword [esp], 8
mov dword [ebp - 0x130], 0
call fcn.0049e4a0
lea edx, [ebp - 0x160]
lea ecx, [ebp - 0x144]
mov dword [eax], edx
mov dword [eax + 4], edi
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x12c], 0x402410
mov dword [ebp - 0x130], 0x4027a0
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.0046fc80
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x158]
lea edx, [ebp - 0x144]
push edi
push edi
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], 1
call fcn.00404260
mov eax, dword [ebp - 0x144]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x148]
mov dword [esp], eax
call fcn.0046e570
push eax
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x4a0d37
lea edi, [ebp - 0x138]
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], edi
call eax
jmp 0x4a0d37
mov eax, dword [ebp - 0x150]
call fcn.00402c30
test al, al
je 0x4a0c9d
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Warning:_Device_A_B_support_is_outdated._Bootloader_update_required._n
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
jmp 0x4a0c9d
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
xor edi, edi
jmp 0x4a1a3e
mov edi, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], str.84e3321d5db3_android
mov dword [esp + 4], str.fastboot_version__s_n
add eax, 0x20
mov dword [esp], eax
call fcn.00440af0
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
jmp 0x4a0848
xor eax, eax
xor edi, edi
xor esi, esi
xor ecx, ecx
jmp 0x4a125f
mov eax, dword [0x4bf098]
lea edi, [ebp - 0x148]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x138]
mov dword [esp], eax
call fcn.00403df0
lea eax, [ebp - 0x138]
mov ecx, edi
mov dword [esp], eax
call fcn.0046e7e0
mov eax, dword [ebp - 0x138]
push ecx
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.0046e570
mov dword [ebp - 0x16c], 0
push eax
add dword [ebx + 4], 8
jmp 0x4a1915
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.flashall
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
je 0x4a20be
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.update
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
je 0x4a2175
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], 0x4ae704
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
jne 0x4a1fe2
cmp dword [ebp - 0x16c], 1
je 0x4a213c
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x138]
mov dword [esp], eax
call fcn.0046fc80
mov edx, dword [ebp - 0x150]
lea ecx, [ebp - 0x138]
push eax
push eax
lea eax, [ebp - 0x144]
mov dword [esp], 0
call fcn.004039d0
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x148]
mov dword [esp], eax
call fcn.0046e570
mov eax, dword [ebp - 0x144]
push edx
mov dword [esp], eax
call fcn.00401d10
mov eax, dword [ebp - 0x144]
sub dword [ebp - 0x16c], 2
add dword [ebx + 4], 8
jmp 0x4a19f1
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov edi, 1
mov dword [esp + 4], str.Internal_error_in_options_processing_for__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
lea eax, [ebp - 0x138]
mov dword [ebp - 0x178], eax
jmp 0x4a0848
lea eax, [ebp - 0x140]
mov edi, dword [ebp - 0x178]
mov dword [esp + 4], eax
mov eax, dword [0x4bf09c]
mov ecx, edi
mov dword [esp], eax
call fcn.0046fc80
push edx
push edx
mov dword [esp + 4], str.udp:
mov dword [esp], edi
call fcn.00426370
mov esi, eax
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x14c]
mov dword [esp], eax
call fcn.0046e570
mov eax, esi
test al, al
push ecx
je 0x4a1d4d
mov eax, dword [0x4bf09c]
mov edi, 1
mov dword [ebp - 0x144], 0x15b2
lea esi, [eax + 4]
jmp 0x4a178a
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x138]
mov edi, eax
mov dword [esp], 0
lea ecx, [ebp - 0x158]
call fcn.004039d0
lea ecx, [ebp - 0x154]
mov dword [esp], edi
call fcn.0046e7e0
push eax
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
lea eax, [ebp - 0x140]
mov dword [esp], eax
call fcn.0046e570
push eax
jmp 0x4a0ce0
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], 0x4ae70f
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x17c]
test eax, eax
je 0x4a2366
mov eax, dword [ebp - 0x178]
mov dword [esp + 4], str.flashing
mov dword [ebp - 0x17c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne case.0x4a0830.104
cmp dword [ebp - 0x16c], 2
mov edx, dword [ebp - 0x17c]
je 0x4a2286
cmp dword [ebp - 0x16c], 3
mov edi, edx
jne case.0x4a0830.104
mov dword [esp + 4], str.unlock_bootloader
mov eax, dword [edx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne case.0x4a0830.104
lea eax, [ebp - 0x138]
mov edx, eax
mov dword [ebp - 0x178], eax
mov eax, dword [edi + 8]
call fcn.004023e0
test eax, eax
je 0x4a225f
mov edx, dword [ebp - 0x138]
mov dword [esp + 4], eax
mov dword [esp], str.unlock_message
mov dword [esp + 8], edx
call fcn.00402020
mov dword [esp + 4], str.unlocking_bootloader
mov dword [esp], str.flashing_unlock_bootloader
call fcn.00401ff0
jmp 0x4a1352
add edx, 4
mov dword [ebx + 4], edx
lea ecx, [ebp - 0x158]
mov dword [esp], 0x4ac68b
sub dword [ebp - 0x16c], 1
call fcn.004467f0
test eax, eax
push esi
jne 0x4a222b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
movzx ecx, byte [ebp - 0x163]
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 0x150]
mov dword [esp], 1
call fcn.0049ffc3
mov byte [ebp - 0x180], 1
jmp 0x4a0d37
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x16c], 0
jmp 0x4a1c24
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.usage:_fastboot____option_____command__n_ncommands:_n__update__filename_________________________Reflash_device_from_update.zip._n___________________________________________Sets_the_flashed_slot_as_active._n__flashall_________________________________Flash_boot__system__vendor__and____n___________________________________________if_found____recovery._If_the_device_n___________________________________________supports_slots__the_slot_that_has_n___________________________________________been_flashed_to_is_set_as_active._n___________________________________________Secondary_images_may_be_flashed_to_n___________________________________________an_inactive_slot._n__flash__partition_____filename____________Write_a_file_to_a_flash_partition._n__flashing_lock____________________________Locks_the_device._Prevents_flashing._n__flashing_unlock__________________________Unlocks_the_device._Allows_flashing_n___________________________________________any_partition_except_n___________________________________________bootloader_related_partitions._n__flashing_lock_critical___________________Prevents_flashing_bootloader_related_n___________________________________________partitions._n__flashing_unlock_critical_________________Enables_flashing_bootloader_related_n___________________________________________partitions._n__flashing_get_unlock_ability______________Queries_bootloader_to_see_if_the_n___________________________________________device_is_unlocked._n__flashing_get_unlock_bootloader_nonce_____Queries_the_bootloader_to_get_the_n___________________________________________unlock_nonce._n__flashing_unlock_bootloader__request______Issue_unlock_bootloader_using_request._n__flashing_lock_bootloader_________________Locks_the_bootloader_to_prevent_n___________________________________________bootloader_version_rollback._n__erase__partition_________________________Erase_a_flash_partition._n__format_:__fs_type___:__size_____partition__n___________________________________________Format_a_flash_partition._Can_n___________________________________________override_the_fs_type_and_or_size_n___________________________________________the_bootloader_reports._n__getvar__variable_________________________Display_a_bootloader_variable._n__set_active__slot_________________________Sets_the_active_slot._If_slots_are_n___________________________________________not_supported__this_does_nothing._n__boot__kernel_____ramdisk_____second______Download_and_boot_kernel._n__flash:raw_boot__kernel_____ramdisk_____second______n___________________________________________Create_bootimage_and_flash_it._n__devices___l______________________________List_all_connected_devices__with_n___________________________________________device_paths_._n__continue_________________________________Continue_with_autoboot._n__reboot__bootloader_______________________Reboot_device__into_bootloader_._n__reboot_bootloader________________________Reboot_device_into_bootloader._n__help_____________________________________Show_this_help_message._n_noptions:_n___w_______________________________________Erase_userdata_and_cache__and_format_n___________________________________________if_supported_by_partition_type_._n___u_______________________________________Do_not_erase_partition_before_n___________________________________________formatting._n___s__specific_device______________________Specify_a_device._For_USB__provide_either_n___________________________________________a_serial_number_or_path_to_device_port._n___________________________________________For_ethernet__provide_an_address_in_the_n___________________________________________form__protocol_:_hostname__:port__where_n____________________________________________protocol__is_either_tcp_or_udp._n___p__product______________________________Specify_product_name._n___c__cmdline______________________________Override_kernel_commandline._n___i__vendor_id____________________________Specify_a_custom_USB_vendor_id._n___b____base__base_addr____________________Specify_a_custom_kernel_base_n___________________________________________address__default:_0x10000000_._n____k
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [0x4c1048]
mov dword [esp], str.invalid_vendor_id__s
mov dword [esp + 4], eax
call fcn.00407490
lea ecx, [ebp - 0x158]
mov dword [esp], 0x4ac68b
call fcn.004467f0
test eax, eax
sete al
push ecx
mov esi, eax
je 0x4a242b
cmp dword [ebp - 0x16c], 1
je 0x4a23df
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x158]
mov edx, dword [eax + 4]
mov eax, esi
or al, byte [ebp - 0x16f]
movzx eax, al
mov dword [esp + 4], eax
movzx eax, byte [ebp - 0x163]
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
call fcn.004a031e
sub dword [ebp - 0x16c], 2
add dword [ebx + 4], 8
mov byte [ebp - 0x180], 1
jmp 0x4a0d37
mov ecx, edi
mov edi, dword [ebp - 0x178]
mov edx, dword [ebp - 0x150]
mov dword [esp], 0
mov eax, edi
call fcn.004039d0
lea ecx, [ebp - 0x154]
mov dword [esp], edi
call fcn.0046e7e0
mov eax, dword [ebp - 0x138]
push ecx
lea ecx, [eax - 0xc]
mov dword [esp], esi
call fcn.0046e570
push esi
jmp 0x4a1627
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x158]
movzx ecx, byte [ebp - 0x163]
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
call fcn.0049ffc3
mov byte [ebp - 0x180], 1
jmp 0x4a0d37
xor ecx, ecx
jmp 0x4a125f
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.could_not_load__s:__s
mov dword [esp + 4], eax
call fcn.00407490
mov esi, dword [edx + 4]
mov dword [esp + 4], str.unlock
mov dword [ebp - 0x16c], edx
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
je 0x4a2351
mov dword [esp + 4], str.lock
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
je 0x4a2351
mov dword [esp + 4], str.unlock_critical
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
je 0x4a2351
mov dword [esp + 4], str.lock_critical
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
je 0x4a2351
mov dword [esp + 4], str.get_unlock_ability
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
je 0x4a2351
mov dword [esp + 4], str.get_unlock_bootloader_nonce
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
je 0x4a2351
mov dword [esp + 4], str.lock_bootloader
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov edx, dword [ebp - 0x16c]
test eax, eax
jne case.0x4a0830.104
mov eax, 2
call fcn.0049fde7
mov dword [ebp - 0x16c], eax
jmp 0x4a0d37
mov eax, dword [ebp - 0x16c]
call fcn.0049fde7
mov dword [ebp - 0x16c], eax
jmp 0x4a0d37
mov dword [esp + 4], esi
mov dword [esp], str.cannot_determine_image_filename_for__s
call fcn.00407490
mov dword [esp], str.cannot_load_bootable_image
call fcn.00407490
xor ecx, ecx
mov dword [ebp - 0x16c], 0
jmp 0x4a1c24
mov dword [esp], str.signature_must_be_256_bytes
call fcn.00407490
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
mov dword [esp], str.could_not_load__s:__s
mov dword [esp + 4], eax
call fcn.00407490
movzx eax, byte [ebp - 0x16f]
lea ecx, [ebp - 0x158]
mov edx, str.update.zip
or eax, esi
movzx eax, al
mov dword [esp + 4], eax
movzx eax, byte [ebp - 0x163]
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
call fcn.004a031e
lea eax, [ebp - 0x138]
add dword [ebx + 4], 4
mov byte [ebp - 0x180], 1
mov dword [ebp - 0x178], eax
jmp 0x4a1352
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
add eax, 0x40
mov dword [esp], eax
call fcn.00440af0
jmp 0x4a2195