Function at 0x403dea
Capabilities:
Query environment variable
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x3c], ecx
call fcn.00401320
sub esp, 0xc
push str.ANDROID_SERIAL
call sub.msvcrt.dll_getenv
mov dword [ebp - 0x38], 0
mov dword [0x4292b8], eax
mov dword [ebp - 0x2c], 1
add esp, 0x10
sub esp, 0xc
push 0
push 0x422580
push str.wub:k:n:r:s:S:lp:c:i:m:h
mov eax, dword [ebp - 0x3c]
push eax
push edi
call fcn.0041b320
add esp, 0x20
test eax, eax
js 0x404094
sub eax, 0x3f
cmp eax, 0x38
jbe switch.0x00403e55
call sub.msvcrt.dll_abort
jmp dword [eax*4 + 0x422454]
call fcn.00402ac0
mov edx, 1
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea esp, [ebp - 0x10]
mov edx, 1
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov ebx, dword [0x429350]
lea edx, [ebp - 0x18]
push ecx
push 0
push edx
push ebx
call fcn.0041b370
mov esi, dword [ebp - 0x18]
add esp, 0x10
cmp esi, ebx
je 0x40403d
mov cl, byte [esi]
cmp cl, 0x6b
je 0x40402e
cmp cl, 0x4b
je 0x40402e
cmp cl, 0x6d
je 0x4041c6
cmp cl, 0x4d
je 0x4041c6
cmp cl, 0x67
je 0x403edc
cmp cl, 0x47
jne 0x40407b
cmp edx, 3
ja 0x40403d
jb 0x403ef0
cmp eax, 0xfffffffe
ja 0x40403d
shld edx, eax, 0x1e
shl eax, 0x1e
inc esi
mov dword [ebp - 0x18], esi
jmp 0x40407b
mov eax, dword [0x429350]
mov dword [0x4292c8], eax
jmp 0x403e24
mov dword [ebp - 0x38], 1
jmp 0x403e24
push esi
push 0x10
push 0
mov ebx, dword [0x429350]
push ebx
call sub.msvcrt.dll_strtoul
add esp, 0x10
mov dword [0x42001c], eax
jmp 0x403e24
mov dword [ebp - 0x2c], 0
jmp 0x403e24
mov eax, dword [0x429350]
mov dword [0x4292b8], eax
jmp 0x403e24
push esi
push 0x10
push 0
mov ebx, dword [0x429350]
push ebx
call sub.msvcrt.dll_strtoul
add esp, 0x10
mov dword [0x420024], eax
jmp 0x403e24
mov eax, dword [0x429350]
mov dword [0x4292f8], eax
jmp 0x403e24
push eax
push 0
push 0
mov eax, dword [0x429350]
push eax
call sub.msvcrt.dll_strtoul
add esp, 0x10
mov dword [0x420018], eax
test eax, eax
jne 0x403e24
sub esp, 0xc
push str.invalid_page_size
call fcn.00403190
add esp, 0x10
jmp 0x403e24
mov dword [0x4292e8], 1
jmp 0x403e24
push eax
push 0x10
push 0
mov eax, dword [0x429350]
push eax
call sub.msvcrt.dll_strtoul
add esp, 0x10
mov dword [0x420020], eax
jmp 0x403e24
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
push 0
push eax
mov edx, dword [0x429350]
push edx
call sub.msvcrt.dll_strtoul
mov ebx, eax
mov eax, dword [ebp - 0x18]
add esp, 0x10
test eax, eax
je 0x40400d
cmp byte [eax], 0
je 0x404066
push eax
push eax
mov eax, dword [0x429350]
push eax
push str.invalid_vendor_id__s
call fcn.00403190
add esp, 0x10
mov word [0x4292d8], bx
jmp 0x403e24
cmp edx, 0x3fffff
ja 0x40403d
jb 0x404070
cmp eax, 0xfffffffe
jbe 0x404070
sub esp, 0xc
mov dword [0x420030], 0xffffffff
mov dword [0x420034], 0xffffffff
push str.invalid_sparse_limit
call fcn.00403190
add esp, 0x10
jmp 0x403e24
test ebx, 0xffff0000
je 0x404022
jmp 0x40400d
inc esi
shld edx, eax, 0xa
shl eax, 0xa
mov dword [ebp - 0x18], esi
cmp byte [esi], 0
jne 0x40403d
test edx, edx
js 0x40403d
mov dword [0x420030], eax
mov dword [0x420034], edx
jmp 0x403e24
mov eax, dword [0x4200e8]
mov edx, dword [ebp - 0x38]
sub edi, eax
mov dword [ebp - 0x28], edi
or edx, edi
je case.0x403e55.104
mov edx, dword [ebp - 0x28]
test edx, edx
jle 0x4045ec
mov edx, dword [ebp - 0x3c]
mov edi, str.devices
cld
lea eax, [edx + eax*4]
mov ecx, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [eax]
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x4041ed
cld
mov edi, str.help
mov ecx, 5
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x4043d1
call fcn.004030b0
mov dword [ebp - 0x34], 0
mov dword [0x429308], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x40], eax
jmp 0x404149
cmp dword [ebp - 0x28], 1
je 0x404391
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push edi
push edi
push eax
push eax
call fcn.00401c50
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
sub esi, 2
add ebx, 8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
add esp, 0x10
mov edi, dword [ebp - 0x28]
test edi, edi
jle 0x404311
mov eax, dword [ebp - 0x24]
mov ecx, 7
cld
mov ebx, dword [eax]
mov edi, str.getvar
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x404110
cld
mov edi, str.erase
mov ecx, 6
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4041f9
cmp dword [ebp - 0x28], 1
je 0x404391
push ecx
push ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 4]
push edx
mov eax, dword [0x429308]
push eax
call fcn.00401d50
add esp, 0x10
test eax, eax
jne 0x40424b
mov edx, dword [ebp - 0x24]
sub esp, 0xc
mov eax, dword [edx + 4]
push eax
call fcn.004023b0
mov eax, dword [ebp - 0x28]
add esp, 0x10
sub eax, 2
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
add eax, 8
mov dword [ebp - 0x24], eax
jmp 0x40413e
cmp edx, 0xfff
ja 0x40403d
jb 0x4041dd
cmp eax, 0xfffffffe
ja 0x40403d
shld edx, eax, 0x14
shl eax, 0x14
inc esi
mov dword [ebp - 0x18], esi
jmp 0x40407b
call fcn.00403090
xor edx, edx
jmp 0x403e66
cld
mov edi, str.format
mov ecx, 7
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404265
cmp dword [ebp - 0x28], 1
je 0x404391
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x404361
mov ebx, dword [ebp - 0x24]
add ebx, 4
push esi
push esi
push 0
mov ecx, dword [ebx]
push ecx
call fcn.00402370
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
sub edx, 2
add eax, 8
add esp, 0x10
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
jmp 0x40413e
mov eax, dword [ebp - 0x40]
push eax
push 0x39
push 1
push str._Did_you_mean_to_fastboot_format_this_partition__n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x40419d
cld
mov edi, str.signature
mov ecx, 0xa
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4043a0
cmp dword [ebp - 0x28], 1
je 0x404391
push eax
push eax
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call fcn.00404d60
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x40446a
cmp dword [ebp - 0x14], 0x100
je 0x4042bc
sub esp, 0xc
push str.signature_must_be_256_bytes
call fcn.00403190
add esp, 0x10
push eax
mov edi, dword [ebp - 0x14]
push edi
push ebx
push str.signature
call fcn.004021c0
pop ebx
pop esi
push str.installing_signature
push str.signature
call fcn.00401b60
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub ecx, 2
add edx, 8
add esp, 0x10
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
jmp 0x40413e
push eax
push eax
mov eax, dword [ebp - 0x2c]
push eax
push str.update.zip
call fcn.00403730
mov dword [ebp - 0x34], 1
add esp, 0x10
mov esi, dword [ebp - 0x38]
test esi, esi
jne 0x4043e7
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4043dd
mov edi, dword [ebp - 0x30]
test edi, edi
jne 0x404424
call fcn.004019f0
xor edx, edx
test eax, eax
jne 0x403e66
sub esp, 0xc
mov ebx, dword [0x429308]
push ebx
call fcn.00402420
add esp, 0x10
test eax, eax
setne al
xor edx, edx
mov dl, al
jmp 0x403e66
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x24]
add ebx, 4
mov eax, dword [edx + 4]
call fcn.00402aa0
test eax, eax
je 0x404225
mov eax, dword [ebp - 0x24]
sub esp, 0xc
mov edi, dword [eax + 4]
push edi
call fcn.004023b0
add esp, 0x10
jmp 0x404225
call fcn.00402ac0
sub esp, 0xc
push 1
call sub.msvcrt.dll_exit
cld
mov edi, str.reboot
mov ecx, 7
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40443d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], 1
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
jmp 0x40413e
call fcn.00402ac0
xor edx, edx
jmp 0x403e66
call fcn.00401b80
jmp 0x404332
sub esp, 0xc
push str.userdata
call fcn.004023b0
pop ecx
pop ebx
push 1
push str.userdata
call fcn.00402370
mov dword [esp], str.cache
call fcn.004023b0
pop eax
pop edx
push 1
push str.cache
call fcn.00402370
add esp, 0x10
jmp 0x40431c
push esi
push esi
push str.rebooting_into_bootloader
push str.reboot_bootloader
call fcn.00401b60
add esp, 0x10
jmp 0x404332
cld
mov edi, str.reboot_bootloader
mov ecx, 0x12
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404497
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], 1
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
jmp 0x40413e
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
push eax
push str.could_not_load__s:__s
call fcn.00403190
add esp, 0x10
jmp 0x4042a3
cld
mov edi, str.continue
mov ecx, 9
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4044d1
push eax
push eax
push str.resuming_boot
push str.continue
call fcn.00401b60
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
dec eax
add edi, 4
add esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edi
jmp 0x40413e
cld
mov edi, str.boot
mov ecx, 5
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404551
mov esi, dword [ebp - 0x24]
add esi, 4
dec dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
je 0x40454b
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx]
add edx, 4
dec dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
jne 0x404609
xor edx, edx
mov eax, dword [0x4292c8]
push eax
lea eax, [ebp - 0x14]
push eax
push edx
push ecx
call fcn.00402e80
add esp, 0x10
test eax, eax
je case.0x403e55.63
push edi
mov esi, dword [ebp - 0x14]
push esi
push eax
push str.boot.img
call fcn.004021c0
pop ecx
pop ebx
push str.booting
push str.boot
call fcn.00401b60
add esp, 0x10
jmp 0x40413e
xor edx, edx
xor ecx, ecx
jmp 0x404506
cld
mov edi, str.flash
mov ecx, 6
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404620
mov edx, dword [ebp - 0x24]
cmp dword [ebp - 0x28], 1
mov ebx, dword [edx + 4]
je 0x404391
cmp dword [ebp - 0x28], 2
je 0x4045c7
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub edx, 3
mov esi, dword [eax + 8]
add eax, 0xc
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
test esi, esi
jne 0x4045a5
push eax
push eax
push ebx
push str.cannot_determine_image_filename_for__s
call fcn.00403190
add esp, 0x10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4046f1
push edi
push esi
push ebx
mov esi, dword [0x429308]
push esi
call fcn.004032f0
add esp, 0x10
jmp 0x40413e
push eax
push eax
mov eax, dword [0x4292f8]
push eax
push ebx
call fcn.004039e0
add esp, 0x10
mov esi, eax
mov eax, dword [ebp - 0x24]
add eax, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], eax
jmp 0x404591
call fcn.004030b0
mov dword [ebp - 0x34], 0
mov dword [0x429308], eax
mov dword [ebp - 0x30], 0
jmp 0x404311
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
dec ebx
mov edx, dword [eax]
add eax, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
jmp 0x404506
cld
mov edi, str.flash:raw
mov ecx, 0xa
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4046b5
mov edx, dword [ebp - 0x24]
cmp dword [ebp - 0x28], 2
mov esi, dword [edx + 4]
mov ecx, dword [edx + 8]
jle 0x404391
cmp dword [ebp - 0x28], 3
je 0x4046a1
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
sub ebx, 4
mov edx, dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x4292c8]
push eax
lea eax, [ebp - 0x14]
push eax
push edx
push ecx
call fcn.00402e80
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x40468d
sub esp, 0xc
push str.cannot_load_bootable_image
call fcn.00403190
add esp, 0x10
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
push esi
call fcn.00402300
add esp, 0x10
jmp 0x40413e
mov eax, dword [ebp - 0x24]
xor edx, edx
add eax, 0xc
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], eax
jmp 0x404663
cld
mov edi, str.flashall
mov ecx, 9
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404711
mov eax, dword [ebp - 0x28]
sub esp, 0xc
dec eax
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
push edi
call fcn.00403b80
add esp, 0x10
mov dword [ebp - 0x34], 1
jmp 0x40413e
mov eax, ebx
call fcn.00402aa0
test eax, eax
je 0x4045b0
sub esp, 0xc
push ebx
call fcn.004023b0
add esp, 0x10
jmp 0x4045b0
cld
mov edi, str.update
mov ecx, 7
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40475f
cmp dword [ebp - 0x28], 1
je 0x4042f7
push esi
push esi
mov ebx, dword [ebp - 0x2c]
push ebx
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 4]
push ecx
call fcn.00403730
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
sub edx, 2
add eax, 8
add esp, 0x10
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 1
jmp 0x40413e
cld
mov edi, 0x422435
mov ecx, 4
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne case.0x403e55.104
push eax
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
call fcn.00402af0
add esp, 0x10
mov dword [ebp - 0x28], eax
jmp 0x40413e