Function at 0x404a00
Capabilities:
Contain obfuscated stackstrings
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x380
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20c]
mov dword [0x53e074], 0x8000
mov dword [0x53e07c], 0x1000000
mov dword [0x53e084], 0xf00000
mov dword [0x53e088], 0x100
mov dword [0x53e08c], 0x800
mov byte [esp + 0xa7], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x90], 0
mov dword [0x53e6e0], 0
mov dword [0x53e6dc], 0x1100000
push 0x170
push 0x51a338
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push str.ANDROID_SERIAL
call sub.msvcrt.dll_getenv
add esp, 4
mov dword [0x53e058], eax
xor eax, eax
mov dword [esp + 0xb8], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xec], 0
jmp case.0x404b42.119
mov eax, dword [0x53921c]
mov eax, dword [eax]
mov dword [0x53e058], eax
mov eax, ebx
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ebx, eax
mov edi, 1
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x210]
push eax
push str.a::hls:S:vw
push dword [ebp + 0xc]
push esi
call fcn.004bc6a0
add esp, 0x14
lea ecx, [eax - 0x3f]
cmp ecx, 0x38
ja case.default.0x404b42
mov al, 1
jmp dword [ecx*4 + section..rdata]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x53e060
mov eax, dword [0x53921c]
push dword [eax]
call fcn.004d2770
add esp, 0x14
test al, al
mov eax, ebx
jne case.0x404b42.119
jmp 0x407f5d
cmp eax, 0xffffffff
mov byte [esp + 0x44], bl
je 0x4053b0
test eax, eax
jne case.0x404b42.64
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x108], 0
mov dword [esp + 0x104], 0
mov dword [esp + 0x100], 0
shl eax, 4
mov esi, dword [esp + eax + 0x20c]
push esi
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x407f6e
mov ebx, eax
cmp eax, 0xb
jae 0x404c37
mov eax, ebx
lea edi, [esp + 0x101]
add al, bl
test ebx, ebx
mov byte [esp + 0x100], al
jne 0x404c6a
jmp 0x404c75
mov eax, dword [0x53921c]
mov edx, dword [eax]
mov al, 1
mov dword [esp + 0xc4], eax
mov eax, ebx
test edx, edx
je case.0x404b42.119
lea ecx, [esp + 0x88]
push edx
call fcn.004ee530
mov eax, ebx
jmp case.0x404b42.119
call fcn.0040dd00
mov eax, ebx
jmp case.0x404b42.119
mov byte [0x53e05e], 1
mov eax, ebx
jmp case.0x404b42.119
mov dword [esp + 0x34], esi
mov esi, ebx
add esi, 0x10
and esi, 0xfffffff0
push esi
call fcn.00493b40
add esp, 4
or esi, 1
mov dword [esp + 0x108], eax
mov edi, eax
mov dword [esp + 0x100], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0x104], ebx
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov byte [edi + ebx], 0
lea edi, [esp + 0x100]
movzx edx, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov eax, edx
mov esi, ecx
shr eax, 1
and dl, 1
cmove esi, eax
cmp esi, 4
jne 0x404cd0
mov ecx, edi
push 4
push str.base
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4051c7
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 7
jne 0x404d0c
mov ecx, edi
push 7
push str.cmdline
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4051e1
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0x14
jne 0x404d48
mov ecx, edi
push 0x14
push str.disable_verification
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4051e8
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xe
jne 0x404d84
mov ecx, edi
push 0xe
push str.disable_verity
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4051f1
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 5
jne 0x404dc0
mov ecx, edi
push 5
push str.force
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4051fa
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xe
jne 0x404dfc
mov ecx, edi
push 0xe
push str.header_version
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405204
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 3
jne 0x404e38
mov ecx, edi
push 3
push 0x51a30e
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40521e
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xd
jne 0x404e74
mov ecx, edi
push 0xd
push str.kernel_offset
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40525f
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xe
jne 0x404eb0
mov ecx, edi
push 0xe
push str.os_patch_level
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405279
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xa
jne 0x404eec
mov ecx, edi
push 0xa
push str.os_version
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40528c
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 9
jne 0x404f28
mov ecx, edi
push 9
push str.page_size
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40529f
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xe
jne 0x404f64
mov ecx, edi
push 0xe
push str.ramdisk_offset
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4052c9
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xb
jne 0x404fa0
mov ecx, edi
push 0xb
push str.skip_reboot
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4052e6
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xe
jne 0x404fdc
mov ecx, edi
push 0xe
push str.skip_secondary
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405307
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 4
jne 0x405018
mov ecx, edi
push 4
push str.slot
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405328
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xa
jne 0x405054
mov ecx, edi
push 0xa
push str.dtb_offset
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405334
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xb
jne 0x405090
mov ecx, edi
push 0xb
push str.tags_offset
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40535b
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xa
jne 0x4050cc
mov ecx, edi
push 0xa
push str.unbuffered
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405378
movzx eax, byte [esp + 0x100]
mov ecx, dword [esp + 0x104]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
cmovne eax, ecx
cmp eax, 7
jne 0x407f7a
mov ecx, edi
push 7
push str.version
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
jne 0x407f7a
push 1
call dword [0x519454]
add esp, 4
mov edi, eax
lea eax, [esp + 0x160]
push eax
call fcn.004014f0
add esp, 4
test byte [esp + 0x160], 1
mov esi, dword [ebp + 8]
lea eax, [esp + 0x161]
je 0x40512c
mov eax, dword [esp + 0x168]
push eax
push str.28.0.2
push str.fastboot_version__s__s_n
push edi
call fcn.004d17b0
add esp, 0x10
test byte [esp + 0x160], 1
je 0x405159
push dword [esp + 0x168]
call fcn.00493cf0
add esp, 4
push 1
call dword [0x519454]
add esp, 4
mov edi, eax
lea eax, [esp + 0x160]
push eax
call fcn.0041f190
add esp, 4
test byte [esp + 0x160], 1
lea eax, [esp + 0x161]
je 0x40518e
mov eax, dword [esp + 0x168]
push eax
push str.Installed_as__s_n
push edi
call fcn.004d17b0
add esp, 0xc
test byte [esp + 0x160], 1
je 0x4051b6
push dword [esp + 0x168]
call fcn.00493cf0
add esp, 4
xor ebx, ebx
test byte [esp + 0x100], 1
jne 0x40523e
jmp 0x40524d
push 0x10
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x519220], eax
jmp 0x40522f
mov ecx, 0x53e028
jmp 0x405223
mov byte [0x53e05c], 1
jmp 0x40522f
mov byte [0x53e05d], 1
jmp 0x40522f
mov byte [esp + 0xa7], 1
jmp 0x40522f
push 0
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x53e090], eax
jmp 0x40522f
mov ecx, 0x53e034
mov eax, dword [0x53921c]
push dword [eax]
call fcn.004ee530
mov esi, dword [ebp + 8]
mov bl, 1
test byte [esp + 0x100], 1
je 0x40524d
push dword [esp + 0x108]
call fcn.00493cf0
add esp, 4
test bl, bl
movzx eax, byte [esp + 0x44]
jne case.0x404b42.119
jmp 0x405539
push 0x10
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x53e074], eax
jmp 0x40522f
mov eax, dword [0x53921c]
push dword [eax]
push 0x53e068
call 0x4080f0
jmp 0x40522f
mov eax, dword [0x53921c]
push dword [eax]
push 0x53e068
call 0x408180
jmp 0x40522f
push 0
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov esi, dword [ebp + 8]
mov bl, 1
test eax, eax
mov dword [0x53e08c], eax
jne 0x405234
jmp 0x407f95
push 0x10
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x53e07c], eax
jmp 0x40522f
mov esi, dword [ebp + 8]
mov al, 1
mov bl, 1
mov dword [esp + 0xec], eax
test byte [esp + 0x100], 1
jne 0x40523e
jmp 0x40524d
mov esi, dword [ebp + 8]
mov al, 1
mov bl, 1
mov dword [esp + 0xb8], eax
test byte [esp + 0x100], 1
jne 0x40523e
jmp 0x40524d
lea ecx, [esp + 0x98]
jmp 0x405223
push 0x10
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x53e6dc], eax
mov dword [0x53e6e0], 0
jmp 0x40522f
push 0x10
push 0
mov eax, dword [0x53921c]
push dword [eax]
call sub.msvcrt.dll_strtoul
add esp, 0xc
mov dword [0x53e088], eax
jmp 0x40522f
push 1
mov eax, dword [fcn.004d11e0]
mov esi, eax
call eax
add esp, 4
push 0
push 4
push 0
push eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
push 2
call esi
add esp, 4
push 0
push 4
push 0
push eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
jmp 0x40522f
mov eax, dword [0x539220]
mov ecx, ebx
mov edx, dword [eax]
mov eax, esi
sub eax, edx
or cl, byte [esp + 0xc4]
jne 0x4053ce
test eax, eax
je 0x407fa6
mov ecx, dword [ebp + 0xc]
test eax, eax
mov dword [esp + 0x84], edx
lea ecx, [ecx + edx*4]
mov dword [esp + 0x34], ecx
jle 0x405415
mov eax, dword [esp + 0x34]
mov esi, dword [eax]
push str.devices
push esi
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
je 0x405579
push str.help
push esi
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
je case.0x404b42.104
call fcn.00408440
test eax, eax
je case.0x404b42.63
lea ecx, [esp + 0x160]
mov dword [esp + 0x160], 0x53bf64
mov dword [esp + 0x164], 0x408870
lea edi, [esp + 0x1c0]
lea esi, [esp + 0x1d8]
lea ebx, [esp + 0x1f0]
mov dword [esp + 0x170], ecx
lea ecx, [esp + 0x178]
mov dword [esp + 0x178], 0x53bf90
mov dword [esp + 0x17c], 0x4088b0
mov dword [esp + 0x1d0], edi
mov dword [esp + 0x1c0], 0x53bf64
mov dword [esp + 0x1c4], 0x408870
mov dword [esp + 0x1e8], esi
mov dword [esp + 0x1d8], 0x53bf90
mov dword [esp + 0x1dc], 0x4088b0
mov dword [esp + 0x200], ebx
mov dword [esp + 0x1f0], 0x53bf64
mov dword [esp + 0x1f4], 0x408970
mov dword [esp + 0x188], ecx
lea ecx, [esp + 0x190]
mov dword [esp + 0x190], 0x53bf64
mov dword [esp + 0x194], 0x408970
mov dword [esp + 0x1a0], ecx
lea ecx, [esp + 0x100]
push 0
push edi
push eax
call fcn.0040dd80
mov ecx, dword [esp + 0x200]
cmp ebx, ecx
je 0x405587
test ecx, ecx
je 0x40558c
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x40558c
push 1
call dword [0x519454]
add esp, 4
push str.usage:_fastboot__OPTION...__COMMAND..._n_nflashing:_n_update_ZIP_________________Flash_all_partitions_from_an_update.zip_package._n_flashall___________________Flash_all_partitions_from__ANDROID_PRODUCT_OUT._n____________________________On_A_B_devices__flashed_slot_is_set_as_active._n____________________________Secondary_images_may_be_flashed_to_inactive_slot._n_flash_PARTITION__FILENAME__Flash_given_partition__using_the_image_from_n_____________________________ANDROID_PRODUCT_OUT_if_no_filename_is_given._n_nbasics:_n_devices___l________________List_devices_in_bootloader___l:_with_device_paths_._n_getvar_NAME________________Display_given_bootloader_variable._n_reboot__bootloader_________Reboot_device._n_nlocking_unlocking:_n_flashing_lockunlock_______Lock_unlock_partitions_for_flashing_n_flashing_lock_criticalunlock_critical_n____________________________Lock_unlock_critical_bootloader_partitions._n_flashing_get_unlock_ability_n____________________________Check_whether_unlocking_is_allowed__1__or_not_0_._n_nadvanced:_n_erase_PARTITION____________Erase_a_flash_partition._n_format_:FS_TYPE_:SIZE___PARTITION_n____________________________Format_a_flash_partition._n_set_active_SLOT____________Set_the_active_slot._n_oem__COMMAND...____________Execute_OEM_specific_command._n_gsi_wipedisable___________Wipe_or_disable_a_GSI_installation__fastbootd_only_._n_nboot_image:_n_boot_KERNEL__RAMDISK__SECOND___n____________________________Download_and_boot_kernel_from_RAM._n_flash:raw_PARTITION_KERNEL__RAMDISK__SECOND___n____________________________Create_boot_image_and_flash_it._n___dtb_DTB__________________Specify_path_to_DTB_for_boot_image_header_version_2._n___cmdline_CMDLINE__________Override_kernel_command_line._n___base_ADDRESS_____________Set_kernel_base_address__default:_0x10000000_._n___kernel_offset____________Set_kernel_offset__default:_0x00008000_._n___ramdisk_offset___________Set_ramdisk_offset__default:_0x01000000_._n___tags_offset______________Set_tags_offset__default:_0x00000100_._n___dtb_offset_______________Set_dtb_offset__default:_0x01100000_._n___page_size_BYTES__________Set_flash_page_size__default:_2048_._n___header_version_VERSION___Set_boot_image_header_version._n___os_version_MAJOR_.MINOR_.PATCH___n____________________________Set_boot_image_OS_version__default:_0.0.0_._n___os_patch_level_YYYY_MM_DD_n____________________________Set_boot_image_OS_security_patch_level._n_nAndroid_Things:_n_stage_IN_FILE______________Sends_given_file_to_stage_for_the_next_command._n_get_staged_OUT_FILE________Writes_data_staged_by_the_last_command_to_a_file._n_noptions:_n__w_________________________Wipe_userdata._n__s_SERIAL__________________Specify_a_USB_device._n__s_tcpudp:HOST_:PORT______Specify_a_network_device._n__S_SIZE_KMG______________Break_into_sparse_files_no_larger_than_SIZE._n___force____________________Force_a_flash_operation_that_may_be_unsafe._n___slot_SLOT________________Use_SLOT__all_for_both_slots__other_for_n____________________________non_current_slot__default:_current_active_slot_._n___set_active_SLOT_________Sets_the_active_slot_before_rebooting._n___skip_secondary___________Dont_flash_secondary_slots_in_flashall_update._n___skip_reboot______________Dont_reboot_device_after_flashing._n___disable_verity___________Sets_disable_verity_when_flashing_vbmeta._n___disable_verification_____Sets_disable_verification_when_flashing_vbmeta._n___unbuffered_______________Dont_buffer_input_or_output._n___verbose___v______________Verbose_output._n___version__________________Display_version._n___help___h_________________Show_this_message._n
push eax
call fcn.004d17b0
add esp, 8
xor edi, edi
test byte [esp + 0x88], 1
je 0x405554
push dword [esp + 0x90]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x98], 1
je 0x40556d
push dword [esp + 0xa0]
call fcn.00493cf0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0
push 0x40a170
call fcn.004111b0
jmp 0x405536
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esp + 0x1e8]
mov bh, byte [esp + 0x44]
cmp esi, ecx
je 0x4055a9
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x4055b1
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x4055b1
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, dword [ebp + 8]
mov ecx, dword [esp + 0x1d0]
cmp edi, ecx
je 0x4055cb
mov edi, dword [esp + 0x34]
test ecx, ecx
je 0x4055d4
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x4055d4
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x100]
mov dword [0x53e04c], eax
call fcn.0040dc60
fstp qword [esp + 0x1b8]
movzx eax, byte [esp + 0x98]
movsd xmm0, qword [esp + 0x1b8]
test al, 1
movsd qword [esp + 0x1a8], xmm0
je 0x405617
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x405638
jmp 0x40561d
shr eax, 1
test eax, eax
jne 0x405638
lea ecx, [esp + 0x98]
push 0
push 0x51a0f0
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4056b6
lea ecx, [esp + 0x48]
lea edx, [esp + 0x98]
push 1
call fcn.004089a0
add esp, 4
test byte [esp + 0x98], 1
jne 0x405663
mov word [esp + 0x98], 0
jmp 0x40569c
mov eax, dword [esp + 0xa0]
mov byte [eax], 0
mov dword [esp + 0x9c], 0
test byte [esp + 0x98], 1
je 0x40569c
push dword [esp + 0xa0]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
mov dword [esp + 0xa0], eax
movsd qword [esp + 0x98], xmm0
movzx eax, byte [esp + 0x88]
test al, 1
je 0x4056cf
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x4056f0
jmp 0x4056d5
shr eax, 1
test eax, eax
jne 0x4056f0
lea ecx, [esp + 0x88]
push 0
push 0x51a0f0
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40576e
lea ecx, [esp + 0x48]
lea edx, [esp + 0x88]
push 0
call fcn.004089a0
add esp, 4
test byte [esp + 0x88], 1
jne 0x40571b
mov word [esp + 0x88], 0
jmp 0x405754
mov eax, dword [esp + 0x90]
mov byte [eax], 0
mov dword [esp + 0x8c], 0
test byte [esp + 0x88], 1
je 0x405754
push dword [esp + 0x90]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
mov dword [esp + 0x90], eax
movsd qword [esp + 0x88], xmm0
cmp byte [esp + 0xc4], 0
je 0x40587e
movzx eax, byte [esp + 0x88]
test al, 1
je 0x405799
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x40587e
jmp 0x4057a3
shr eax, 1
test eax, eax
jne 0x40587e
lea ecx, [esp + 0x88]
push 0
push 0x51a0f0
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
jne 0x40587e
movzx eax, byte [esp + 0x98]
test al, 1
je 0x4057db
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x405800
jmp 0x4057e1
shr eax, 1
test eax, eax
jne 0x405800
lea ecx, [esp + 0x98]
push 0
push 0x51a0f0
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x407e1d
lea ecx, [esp + 0x48]
lea edx, [esp + 0x98]
push 0
call fcn.004089a0
add esp, 4
test byte [esp + 0x88], 1
jne 0x40582b
mov word [esp + 0x88], 0
jmp 0x405864
mov eax, dword [esp + 0x90]
mov byte [eax], 0
mov dword [esp + 0x8c], 0
test byte [esp + 0x88], 1
je 0x405864
push dword [esp + 0x90]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
mov dword [esp + 0x90], eax
movsd qword [esp + 0x88], xmm0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea eax, [eax + esi*4]
sub eax, edi
je 0x405a08
sar eax, 2
cmp eax, 0x15555556
jae 0x407fbc
shl eax, 2
lea edi, [eax + eax*2]
push edi
call fcn.00493b40
add esp, 4
mov dword [esp + 0x20], eax
mov esi, eax
mov dword [esp + 0x1c], eax
add edi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x24], edi
cmp ecx, eax
je 0x405a08
shl eax, 2
shl ecx, 2
sub eax, ecx
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x34]
nop word cs:[eax + eax]
mov edi, dword [eax]
mov dword [esp + 0x34], eax
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push edi
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x407f9f
mov ecx, eax
cmp eax, 0xb
jae 0x405940
mov eax, ecx
add al, cl
mov byte [esi], al
inc esi
test ecx, ecx
jne 0x405970
jmp 0x40597f
mov ebx, ecx
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
mov dword [esp + 0xb8], ecx
call fcn.00493b40
mov ecx, dword [esp + 0xb8]
add esp, 4
or ebx, 1
mov dword [esi + 8], eax
mov dword [esi], ebx
mov bh, byte [esp + 0x44]
mov dword [esi + 4], ecx
mov esi, eax
push ecx
push edi
push esi
mov edi, ecx
call sub.msvcrt.dll_memcpy
mov ecx, edi
add esp, 0xc
mov byte [esi + ecx], 0
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x20]
add eax, 4
add esi, 0xc
add dword [esp + 0x84], 0xfffffffc
mov dword [esp + 0x20], esi
jne 0x405900
cmp dword [esp + 0x1c], esi
je 0x405a08
lea eax, [esp + 1]
lea ecx, [esp + 1]
lea edi, [esp + 0x28]
lea esi, [esp + 0x1c]
mov dword [esp + 0x84], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0xe8], ecx
and al, 1
mov dword [esp + 0xb8], eax
jmp 0x406f50
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0x84], 0
test bh, bh
je 0x405d41
mov eax, 0x6174656d
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov byte [esp + 0x48], 0x10
mov dword [esp + 0x4d], 0x61746164
lea esi, [esp + 0x54]
lea edi, [esp + 0x60]
add eax, 0x10f10e08
mov dword [esp + 0x49], eax
mov byte [esp + 0x51], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov byte [esp + 0x54], 0xa
mov dword [esp + 0x55], 0x68636163
mov word [esp + 0x59], 0x65
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov byte [esp + 0x60], 0x10
mov dword [esp + 0x65], 0x61746164
mov dword [esp + 0x61], 0x6174656d
mov byte [esp + 0x69], 0
push 0x24
call fcn.00493b40
add esp, 4
mov ebx, eax
lea eax, [esp + 0x48]
mov ecx, ebx
push eax
call fcn.004ef560
lea ecx, [ebx + 0xc]
mov dword [esp + 0xb8], ecx
push esi
call fcn.004ef560
lea ecx, [ebx + 0x18]
mov dword [esp + 0xd4], ecx
push edi
call fcn.004ef560
test byte [esp + 0x60], 1
jne 0x405dbf
test byte [esp + 0x54], 1
jne 0x405dd6
test byte [esp + 0x48], 1
je 0x405b3b
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
mov eax, 0x24
mov esi, ebx
mov dword [esp + 0x44], ebx
jmp 0x405c70
test al, 1
je 0x405b61
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jne 0x405b6d
jmp 0x405cd6
mov ecx, eax
shr ecx, 1
test ecx, ecx
je 0x405cd6
mov ecx, dword [0x53e04c]
push 0
push 0
push esi
call fcn.0040e3a0
movzx eax, byte [esi]
test al, 1
je 0x405b8e
mov eax, dword [esi + 4]
cmp eax, 8
je 0x405b95
jmp 0x405ba7
shr eax, 1
cmp eax, 8
jne 0x405ba7
mov ecx, esi
push 8
push str.userdata
push 0xffffffffffffffff
push 0
call fcn.004d5240
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov ecx, esi
mov edx, 1
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004093e0
add esp, 0xc
test byte [esp + 0x10], 1
jne 0x405c3c
test byte [esp], 1
jne 0x405c4e
test byte [esp + 0x28], 1
je 0x405c2c
push dword [esp + 0x30]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x48], 1
jne 0x405cda
jmp 0x405ce6
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
je 0x405c19
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x28], 1
jne 0x405c20
jmp 0x405c2c
mov ebx, dword [0x53e04c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0
push esi
push str.partition_type:
lea edi, [esp + 0x30]
push edi
call fcn.00515a10
add esp, 0xc
mov ecx, ebx
push 0
lea eax, [esp + 0x4c]
push eax
push edi
call fcn.0040e5a0
test byte [esp + 0x28], 1
mov ebx, eax
je 0x405cc9
push dword [esp + 0x30]
call fcn.00493cf0
add esp, 4
movzx eax, byte [esp + 0x48]
test ebx, ebx
je 0x405b50
test al, 1
je 0x405ce6
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp + 0x34]
add esi, 0xc
add eax, 0xfffffff4
jne 0x405c70
mov eax, dword [esp + 0xd4]
mov esi, dword [esp + 0x44]
test byte [eax], 1
je 0x405d11
push dword [esi + 0x20]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp + 0xb8]
test byte [eax], 1
je 0x405d28
push dword [esi + 0x14]
call fcn.00493cf0
add esp, 4
test byte [esi], 1
je 0x405d38
push dword [esi + 8]
call fcn.00493cf0
add esp, 4
push esi
call fcn.00493cf0
add esp, 4
test byte [esp + 0xc4], 1
je 0x405d62
mov ecx, dword [0x53e04c]
push 0
push 0
lea eax, [esp + 0x90]
push eax
call fcn.0040eb80
test byte [esp + 0xec], 1
jne 0x405d8b
mov eax, dword [esp + 0x84]
and al, 1
je 0x405d8b
mov ecx, dword [0x53e04c]
push 0
push 0
call fcn.0040e840
jmp 0x407cef
test byte [esp + 0xb4], 1
jne 0x407c1a
test byte [esp + 0xc0], 1
jne 0x407c78
test byte [esp + 0xbc], 1
je 0x407cfa
call fcn.004043b0
jmp 0x407cfa
push dword [esp + 0x68]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x54], 1
je 0x405b28
push dword [esp + 0x5c]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x48], 1
jne 0x405b2f
jmp 0x405b3b
mov al, 1
mov dword [esp + 0xb4], eax
jmp 0x407bf0
mov al, 1
mov dword [esp + 0xc0], eax
jmp 0x407bf0
mov al, 1
mov dword [esp + 0xbc], eax
jmp 0x407bf0
mov ecx, dword [0x53e04c]
push 0
push 0
call fcn.0040e000
jmp 0x407bf0
lea esi, [esp + 0x1c]
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
cmp eax, dword [esp + 0x20]
je 0x405f7a
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00408c30
test byte [esp], 1
jne 0x406003
mov word [esp], 0
jmp 0x40602b
lea esi, [esp + 0x1c]
mov ecx, esp
mov edx, esi
call fcn.00408c30
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
cmp eax, dword [esp + 0x20]
je 0x406086
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
test byte [esp + 0x10], 1
jne 0x406283
mov word [esp + 0x10], 0
jmp 0x4062ad
lea esi, [esp + 0x1c]
mov ecx, esp
mov edx, esi
call fcn.00408c30
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00408c30
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0
cmp eax, dword [esp + 0x20]
je 0x4062bc
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
test byte [esp + 0x38], 1
jne 0x4063ac
mov word [esp + 0x38], 0
jmp 0x4063d6
movzx eax, byte [esp + 0x98]
test al, 1
je 0x406188
mov eax, dword [esp + 0x9c]
cmp eax, 3
je 0x40618f
jmp 0x4061ae
movzx eax, byte [esp + 0x98]
test al, 1
je 0x406313
mov eax, dword [esp + 0x9c]
jmp 0x406315
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
jmp 0x40647f
mov edi, esp
lea esi, [esp + 0x1c]
mov ecx, edi
mov edx, esi
call fcn.00408c30
lea ecx, [esp + 0x48]
mov edx, edi
push 0
call fcn.004089a0
add esp, 4
test byte [esp], 1
je 0x405fc8
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
mov ecx, dword [0x53e04c]
push 0
push 0
lea eax, [esp + 0x50]
push eax
call fcn.0040eb80
test byte [esp + 0x48], 1
je 0x405fef
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
lea edi, [esp + 0x28]
test byte [esp + 0x28], 1
jne 0x407bfb
jmp 0x407c07
mov eax, dword [esp + 8]
mov byte [eax], 0
mov dword [esp + 4], 0
test byte [esp], 1
je 0x40602b
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
mov dword [esp], 0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
movsd xmm0, qword [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
cmp ecx, dword [esp + 0x20]
mov dword [esp + 8], eax
movsd qword [esp], xmm0
je 0x40647f
lea ecx, [esp + 0x38]
mov edx, esi
call fcn.00408c30
test byte [esp + 0x10], 1
jne 0x406441
mov word [esp + 0x10], 0
jmp 0x40646b
xor ebx, ebx
mov edi, 0x51908c
mov esi, dword [edi - 4]
test esi, esi
je 0x4060cb
push esi
call sub.msvcrt.dll_strlen
add esp, 4
movzx ecx, byte [esp]
test cl, 1
je 0x4060b0
mov ecx, dword [esp + 4]
cmp eax, ecx
je 0x4060b6
jmp 0x4060cb
shr ecx, 1
cmp eax, ecx
jne 0x4060cb
mov ecx, esp
push eax
push esi
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406bde
inc ebx
add edi, 0x18
cmp ebx, 0x11
jb 0x40608d
push 2
call dword [0x519454]
add esp, 4
test byte [esp], 1
lea ecx, [esp + 1]
je 0x4060ed
mov ecx, dword [esp + 8]
push ecx
push str.unknown_partition__s_n
push eax
call fcn.004d17b0
add esp, 0xc
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
test byte [esp + 0x10], 1
jne 0x406d2a
mov word [esp + 0x10], 0
lea esi, [esp + 0x1c]
jmp 0x406d58
lea esi, [esp + 0x1c]
mov ecx, esp
mov edx, esi
call fcn.00408c30
test byte [esp], 1
lea ecx, [esp + 1]
je 0x40614a
mov ecx, dword [esp + 8]
lea edx, [esp + 0x48]
call fcn.004091c0
test al, al
je 0x407fc5
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x407fc5
mov ecx, dword [0x53e04c]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x64]
lea eax, [esp + 0x10]
push eax
call fcn.0040ed70
jmp 0x406eab
shr eax, 1
cmp eax, 3
jne 0x4061ae
lea ecx, [esp + 0x98]
push 3
push 0x51a161
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406abb
mov eax, esp
mov dword [esp], 0x51a904
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x98]
push eax
call fcn.004ef560
mov eax, dword [esp + 0xb8]
lea ecx, [esp + 0x49]
mov byte [esp + 0x58], al
mov byte [esp + 0x59], bh
mov dword [ecx + 0x17], 0
mov dword [ecx + 0x13], 0
mov dword [ecx + 0x1f], 0
mov dword [ecx + 0x1b], 0
mov dword [ecx + 0x27], 0
mov dword [ecx + 0x23], 0
mov dword [ecx + 0x2f], 0
mov dword [ecx + 0x2b], 0
mov dword [ecx + 0x33], 0
lea ecx, [esp + 0x48]
call fcn.00402270
mov esi, dword [esp + 0x74]
test esi, esi
je 0x4069c0
mov eax, dword [esp + 0x78]
cmp eax, esi
je 0x4069b1
test byte [eax - 0xc], 1
lea edi, [eax - 0x10]
je 0x406253
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x40623f
mov eax, dword [esp + 0x74]
lea edi, [esp + 0x28]
jmp 0x4069b3
mov al, 1
lea esi, [esp + 0x1c]
mov dword [esp + 0xb4], eax
test byte [esp + 0x48], 1
jne 0x4079a3
jmp 0x4079af
mov eax, dword [esp + 0x18]
mov byte [eax], 0
mov dword [esp + 0x14], 0
test byte [esp + 0x10], 1
je 0x4062ad
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
jmp 0x406d62
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xb0], 0
jmp 0x4068aa
lea ebx, [esp + 0x48]
lea esi, [esp + 0x1c]
mov ecx, ebx
mov edx, esi
call fcn.00408c30
mov ecx, dword [0x53e04c]
push 0
push 0
push ebx
call fcn.00410080
test byte [esp + 0x48], 1
jne 0x407613
jmp 0x40761f
shr eax, 1
lea esi, [esp + 0x1c]
cmp eax, 3
jne 0x40633d
lea ecx, [esp + 0x98]
push 3
push 0x51a161
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406bba
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 1]
mov byte [esp], 0x14
mov word [eax + 8], 0x7069
mov dword [eax + 4], 0x7a2e6574
mov dword [eax], 0x61647075
mov byte [esp + 0xb], 0
cmp ecx, dword [esp + 0x20]
je 0x4065af
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
test byte [esp], 1
jne 0x40671f
mov word [esp], 0
jmp 0x406747
mov al, 1
mov dword [esp + 0xc0], eax
test byte [esp + 0x48], 1
je 0x4079af
jmp 0x4079a3
mov eax, dword [esp + 0x40]
mov byte [eax], 0
mov dword [esp + 0x3c], 0
test byte [esp + 0x38], 1
je 0x4063d6
push dword [esp + 0x40]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xb0], 0
cmp ecx, dword [esp + 0x20]
mov dword [esp + 0x40], eax
movsd qword [esp + 0x38], xmm0
je 0x4068aa
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
test byte [esp + 0xa8], 1
jne 0x406857
mov word [esp + 0xa8], 0
jmp 0x406890
mov eax, dword [esp + 0x18]
mov byte [eax], 0
mov dword [esp + 0x14], 0
test byte [esp + 0x10], 1
je 0x40646b
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x40]
movsd xmm0, qword [esp + 0x38]
mov dword [esp + 0x18], eax
movsd qword [esp + 0x10], xmm0
lea edi, [esp + 0x38]
lea eax, [esp + 0x10]
lea edx, [esp + 0x48]
mov ecx, edi
push eax
lea eax, [esp + 4]
push eax
call fcn.00408e60
add esp, 8
mov ecx, dword [0x53e04c]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov byte [esp + 0xa8], 0x10
mov dword [esp + 0xad], 0x676d692e
mov dword [esp + 0xa9], 0x746f6f62
mov byte [esp + 0xb1], 0
push 0
push 0
push edi
lea eax, [esp + 0xb4]
push eax
call fcn.0040ecb0
test byte [esp + 0xa8], 1
je 0x406513
push dword [esp + 0xb0]
call fcn.00493cf0
add esp, 4
mov ecx, dword [0x53e04c]
push 0
push 0
call fcn.0040dec0
mov eax, dword [esp + 0x38]
test eax, eax
je 0x406537
mov dword [esp + 0x3c], eax
push eax
call fcn.00493cf0
add esp, 4
test byte [esp + 0x10], 1
lea edi, [esp + 0x28]
je 0x40654e
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
je 0x40787d
push dword [esp + 8]
jmp 0x407875
lea esi, [esp + 0x1c]
lea eax, [esp + 0x49]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov byte [esp + 0x48], 6
mov edx, esi
mov byte [eax + 2], 0x6d
mov word [eax], 0x656f
mov byte [esp + 0x4c], 0
call fcn.004092a0
test byte [esp + 0x48], 1
jne 0x407888
jmp 0x407bf4
mov al, 0x14
jmp 0x40675d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x407fe7
sub eax, ecx
cmp eax, 0xc
jne 0x407ff5
movzx edx, byte [ecx]
mov edi, dword [ecx + 4]
mov eax, edx
mov esi, edi
shr eax, 1
and dl, 1
cmove esi, eax
cmp esi, 6
jne 0x406611
push 6
push str.unlock
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4066ce
mov ecx, dword [esp + 0x1c]
movzx eax, byte [ecx]
mov edi, dword [ecx + 4]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, edi
cmove esi, eax
cmp esi, 4
jne 0x406646
push 4
push str.lock
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4066ce
mov ecx, dword [esp + 0x1c]
movzx eax, byte [ecx]
mov edi, dword [ecx + 4]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, edi
cmove esi, eax
cmp esi, 0xf
jne 0x406677
push 0xf
push str.unlock_critical
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4066ce
mov ecx, dword [esp + 0x1c]
movzx eax, byte [ecx]
mov edi, dword [ecx + 4]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, edi
cmove esi, eax
cmp esi, 0xd
jne 0x4066a8
push 0xd
push str.lock_critical
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4066ce
mov ecx, dword [esp + 0x1c]
movzx eax, byte [ecx]
mov edi, dword [ecx + 4]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
cmovne eax, edi
cmp eax, 0x12
jne 0x407ff5
push 0x12
push str.get_unlock_ability
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
jne 0x407ff1
lea esi, [esp + 0x1c]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov byte [esp + 0x48], 0x10
mov dword [esp + 0x4d], 0x676e6968
mov dword [esp + 0x49], 0x73616c66
mov byte [esp + 0x51], 0
mov edx, esi
call fcn.004092a0
test byte [esp + 0x48], 1
jne 0x405fe3
jmp 0x405fef
mov eax, dword [esp + 8]
mov byte [eax], 0
mov dword [esp + 4], 0
test byte [esp], 1
je 0x406747
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
mov dword [esp], 0
movsd xmm0, qword [esp + 0x48]
mov eax, dword [esp + 0x50]
movsd qword [esp], xmm0
mov dword [esp + 8], eax
mov al, byte [esp]
test al, 1
lea esi, [esp + 1]
je 0x406769
mov esi, dword [esp + 8]
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00412a40
add esp, 8
test eax, eax
jne 0x408004
cmp byte [esp + 0xb8], 0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0x51a8f4
lea ecx, [esp + 0x4c]
setne bl
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
or bl, byte [esp + 0x34]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x98]
push eax
call fcn.004ef560
lea ecx, [esp + 0x48]
lea eax, [esp + 0x49]
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], 0
mov dword [eax + 0x17], 0
mov dword [eax + 0x13], 0
mov dword [eax + 0x1f], 0
mov dword [eax + 0x1b], 0
mov dword [eax + 0x27], 0
mov dword [eax + 0x23], 0
mov dword [eax + 0x2f], 0
mov dword [eax + 0x2b], 0
mov dword [eax + 0x33], 0
call fcn.00402270
push dword [esp + 0x38]
call fcn.00412b80
add esp, 4
mov esi, dword [esp + 0x74]
test esi, esi
je 0x406a0e
mov eax, dword [esp + 0x78]
cmp eax, esi
je 0x4069ff
test byte [eax - 0xc], 1
lea edi, [eax - 0x10]
je 0x406844
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x406830
mov eax, dword [esp + 0x74]
lea edi, [esp + 0x28]
jmp 0x406a01
mov eax, dword [esp + 0xb0]
mov byte [eax], 0
mov dword [esp + 0xac], 0
test byte [esp + 0xa8], 1
je 0x406890
push dword [esp + 0xb0]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0xa8], 0
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
mov dword [esp + 0xb0], eax
movsd qword [esp + 0xa8], xmm0
lea edi, [esp + 0xc8]
lea eax, [esp + 0xa8]
lea edx, [esp + 0x10]
mov ecx, edi
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00408e60
add esp, 8
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x48], 0x51c988
mov dword [esp + 0x4c], edi
lea edx, [esp + 0x98]
mov ebx, eax
mov dword [esp + 0x58], eax
push 1
push eax
call fcn.00403c00
add esp, 8
mov ecx, dword [esp + 0x58]
cmp ebx, ecx
je 0x40690d
mov bh, byte [esp + 0x44]
test ecx, ecx
je 0x406916
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x406916
mov eax, dword [ecx]
call dword [eax + 0x10]
mov bh, byte [esp + 0x44]
mov eax, dword [esp + 0xc8]
lea edi, [esp + 0x28]
test eax, eax
je 0x406935
mov dword [esp + 0xcc], eax
push eax
call fcn.00493cf0
add esp, 4
test byte [esp + 0xa8], 1
je 0x406e85
push dword [esp + 0xb0]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x38], 1
jne 0x406e8c
jmp 0x406e98
lea ebx, [esp + 0x48]
lea esi, [esp + 0x1c]
mov ecx, ebx
mov edx, esi
call fcn.00408c30
mov edi, esp
mov edx, esi
mov ecx, edi
call fcn.00408c30
mov ecx, dword [0x53e04c]
push edi
push ebx
call fcn.0040e0f0
test byte [esp], 1
je 0x40699d
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x48], 1
mov bh, byte [esp + 0x44]
jne 0x405fe3
jmp 0x405fef
mov eax, esi
mov dword [esp + 0x78], esi
push eax
call fcn.00493cf0
add esp, 4
mov esi, dword [esp + 0x68]
test esi, esi
je 0x406f07
mov eax, dword [esp + 0x6c]
cmp eax, esi
je 0x406ef8
test byte [eax - 0xc], 1
lea edi, [eax - 0x10]
je 0x4069ec
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x4069d8
mov eax, dword [esp + 0x68]
lea edi, [esp + 0x28]
jmp 0x406efa
mov eax, esi
mov dword [esp + 0x78], esi
push eax
call fcn.00493cf0
add esp, 4
mov esi, dword [esp + 0x68]
test esi, esi
je 0x406a51
mov eax, dword [esp + 0x6c]
cmp eax, esi
je 0x406a42
test byte [eax - 0xc], 1
lea edi, [eax - 0x10]
je 0x406a32
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x406a1e
mov eax, dword [esp + 0x68]
lea edi, [esp + 0x28]
jmp 0x406a44
mov eax, esi
mov dword [esp + 0x6c], esi
push eax
call fcn.00493cf0
add esp, 4
test byte [esp + 0x5c], 1
je 0x406a64
push dword [esp + 0x64]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x4c], 1
lea esi, [esp + 0x1c]
je 0x406a7b
push dword [esp + 0x54]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
je 0x406f31
push dword [esp + 8]
jmp 0x406f29
lea ebx, [esp + 0x48]
lea esi, [esp + 0x1c]
mov ecx, ebx
mov edx, esi
call fcn.00408c30
mov ecx, dword [0x53e04c]
push ebx
call fcn.0040e2a0
test byte [esp + 0x48], 1
jne 0x407613
jmp 0x40761f
push 2
call dword [0x519454]
add esp, 4
push str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
push eax
call fcn.004d17b0
add esp, 8
mov eax, esp
mov dword [esp], 0x51a904
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x98]
push eax
call fcn.004ef560
lea ecx, [esp + 0x48]
lea eax, [esp + 0x49]
mov byte [esp + 0x58], 1
mov byte [esp + 0x59], bh
mov dword [eax + 0x17], 0
mov dword [eax + 0x13], 0
mov dword [eax + 0x1f], 0
mov dword [eax + 0x1b], 0
mov dword [eax + 0x27], 0
mov dword [eax + 0x23], 0
mov dword [eax + 0x2f], 0
mov dword [eax + 0x2b], 0
mov dword [eax + 0x33], 0
call fcn.00402270
mov esi, dword [esp + 0x74]
test esi, esi
je 0x406ec9
mov eax, dword [esp + 0x78]
cmp eax, esi
je 0x406eba
test byte [eax - 0xc], 1
lea edi, [eax - 0x10]
je 0x406b73
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x406b5f
mov eax, dword [esp + 0x74]
lea edi, [esp + 0x28]
jmp 0x406ebc
lea ebx, [esp + 0x48]
mov edx, esi
mov ecx, ebx
call fcn.00408c30
mov edi, esp
mov edx, esi
mov ecx, edi
call fcn.00408c30
mov ecx, dword [0x53e04c]
push edi
push ebx
call fcn.0040e9d0
test byte [esp], 1
jne 0x406991
jmp 0x40699d
push 2
call dword [0x519454]
add esp, 4
push str.Warning:_slot_set_to_all._Secondary_slots_will_not_be_flashed._n
push eax
call fcn.004d17b0
add esp, 8
mov al, 1
mov dword [esp + 0x34], eax
jmp 0x406345
mov esi, dword [edi]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0
push esi
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x408019
mov ebx, eax
cmp eax, 0xb
jae 0x406cc0
mov eax, ebx
lea edi, [esp + 0x49]
add al, bl
test ebx, ebx
mov byte [esp + 0x48], al
jne 0x406cec
jmp 0x406cf7
mov ecx, dword [0x53e04c]
lea eax, [esp + 0x11]
mov byte [esp + 0x10], 0x14
mov dword [esp], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov byte [esp], 0x10
mov dword [esp + 5], 0x65706977
mov dword [esp + 1], 0x3a697367
mov byte [esp + 9], 0
mov word [eax + 8], 0x4953
mov dword [eax + 4], 0x4720676e
mov dword [eax], 0x69706977
mov byte [esp + 0x1b], 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0040dfa0
test byte [esp + 0x10], 1
je 0x406cad
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
lea esi, [esp + 0x1c]
jne 0x406558
jmp 0x40787d
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x34]
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
call fcn.00493b40
add esp, 4
or ebx, 1
mov dword [esp + 0x50], eax
mov edi, eax
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x4c], ebx
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0x38]
lea edx, [esp + 0x48]
mov byte [edi + ebx], 0
call fcn.00404840
test byte [esp + 0x48], 1
je 0x406114
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x10], 1
je 0x40611f
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x1c]
mov byte [eax], 0
mov dword [esp + 0x14], 0
test byte [esp + 0x10], 1
je 0x406d58
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x40]
movsd xmm0, qword [esp + 0x38]
mov dword [esp + 0x18], eax
movsd qword [esp + 0x10], xmm0
movzx eax, byte [esp + 0x10]
test al, 1
je 0x406d82
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x406d8c
jmp 0x408022
shr eax, 1
test eax, eax
je 0x408022
test byte [esp], 1
lea eax, [esp + 1]
mov edi, eax
je 0x406d9c
mov edi, dword [esp + 8]
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
push edi
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x408044
mov ebx, eax
cmp eax, 0xb
mov dword [esp + 0x34], edi
jae 0x406de3
mov eax, ebx
lea edi, [esp + 0x39]
add al, bl
test ebx, ebx
mov byte [esp + 0x38], al
jne 0x406e09
jmp 0x406e17
mov esi, ebx
add esi, 0x10
and esi, 0xfffffff0
push esi
call fcn.00493b40
add esp, 4
or esi, 1
mov dword [esp + 0x40], eax
mov edi, eax
mov dword [esp + 0x38], esi
lea esi, [esp + 0x1c]
mov dword [esp + 0x3c], ebx
push ebx
push dword [esp + 0x38]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0xa7]
mov dword [esp + 0x48], 0x51c7bc
lea ecx, [esp + 0x38]
mov byte [edi + ebx], 0
lea edx, [esp + 0x98]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
mov edi, eax
mov dword [esp + 0x58], eax
push 1
push eax
call fcn.00403c00
add esp, 8
mov ecx, dword [esp + 0x58]
cmp edi, ecx
je 0x406e78
mov bh, byte [esp + 0x44]
test ecx, ecx
lea edi, [esp + 0x28]
je 0x406e85
mov eax, dword [ecx]
call dword [eax + 0x14]
test byte [esp + 0x38], 1
jne 0x406e8c
jmp 0x406e98
mov eax, dword [ecx]
call dword [eax + 0x10]
mov bh, byte [esp + 0x44]
lea edi, [esp + 0x28]
test byte [esp + 0x38], 1
je 0x406e98
push dword [esp + 0x40]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x10], 1
je 0x406eab
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
jne 0x4078a5
jmp 0x407bf4
mov eax, esi
mov dword [esp + 0x78], esi
push eax
call fcn.00493cf0
add esp, 4
mov esi, dword [esp + 0x68]
test esi, esi
je 0x406f07
mov eax, dword [esp + 0x6c]
cmp eax, esi
je 0x406ef8
test byte [eax - 0xc], 1
lea edi, [eax - 0x10]
je 0x406eed
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x406ed9
jmp 0x4069f2
mov eax, esi
mov dword [esp + 0x6c], esi
push eax
call fcn.00493cf0
add esp, 4
test byte [esp + 0x5c], 1
je 0x406f1a
push dword [esp + 0x64]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x4c], 1
lea esi, [esp + 0x1c]
je 0x406f31
push dword [esp + 0x54]
call fcn.00493cf0
add esp, 4
mov al, 1
mov dword [esp + 0x84], eax
test byte [esp + 0x28], 1
jne 0x407bfb
jmp 0x407c07
mov ecx, edi
mov edx, esi
call fcn.00408c30
movzx ecx, byte [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, ecx
mov esi, edx
shr eax, 1
and cl, 1
cmove esi, eax
cmp esi, 6
jne 0x406f9d
mov ecx, edi
push 6
push str.getvar
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4075f2
movzx eax, byte [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, eax
shr eax, 1
and cl, 1
test cl, cl
cmovne eax, edx
cmp eax, 5
jne 0x406fc1
mov ecx, edi
push 5
push str.erase
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x407650
push str.format
push edi
call fcn.00421310
add esp, 8
test al, al
je 0x407070
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov word [esp + 0x48], 0x3a02
mov byte [esp + 0x4a], 0
push eax
push edi
lea eax, [esp + 8]
push eax
call fcn.00421070
add esp, 0xc
test byte [esp + 0x48], 1
je 0x407021
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp]
mov ecx, dword [esp + 4]
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, 1
jbe 0x407633
test byte [eax + 0xc], 1
jne 0x4076a3
add eax, 0xc
inc eax
jmp 0x4076a6
movzx edx, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, edx
mov esi, ecx
shr eax, 1
and dl, 1
cmove esi, eax
cmp esi, 9
jne 0x4070b4
mov ecx, edi
push 9
push str.signature
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4076f6
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 6
jne 0x4070ee
mov ecx, edi
push 6
push 0x51a5a8
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
lea esi, [esp + 0x1c]
je 0x4078c1
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0x11
jne 0x407124
mov ecx, edi
push 0x11
push str.reboot_bootloader
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405df2
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xf
jne 0x40715a
mov ecx, edi
push 0xf
push str.reboot_recovery
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405e00
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xf
jne 0x407190
mov ecx, edi
push 0xf
push str.reboot_fastboot
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405e0e
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 8
jne 0x4071c6
mov ecx, edi
push 8
push str.continue
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405e1c
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 4
jne 0x4071fc
mov ecx, edi
push 4
push str.boot
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405e30
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 5
jne 0x407232
mov ecx, edi
push 5
push str.flash
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405e84
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 9
jne 0x407268
mov ecx, edi
push 9
push str.flash:raw
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405ed9
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 8
jne 0x40729e
mov ecx, edi
push 8
push str.flashall
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405f39
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 6
jne 0x4072d4
mov ecx, edi
push 6
push str.update
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405f5e
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xa
jne 0x40730a
mov ecx, edi
push 0xa
push str.set_active
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x405f97
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 5
jne 0x407340
mov ecx, edi
push 5
push str.stage
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x40612f
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0xa
jne 0x407376
mov ecx, edi
push 0xa
push str.get_staged
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4062e2
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 3
jne 0x4073ac
mov ecx, edi
push 3
push 0x51a70b
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406561
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 8
jne 0x4073e2
mov ecx, edi
push 8
push str.flashing
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x4065b6
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0x18
jne 0x407418
mov ecx, edi
push 0x18
push str.create_logical_partition
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406962
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0x18
jne 0x40744e
mov ecx, edi
push 0x18
push str.delete_logical_partition
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406a8e
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
mov esi, ecx
cmove esi, eax
cmp esi, 0x18
lea esi, [esp + 0x1c]
jne 0x407488
mov ecx, edi
push 0x18
push str.resize_logical_partition
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406b86
movzx eax, byte [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
shr eax, 1
and dl, 1
test dl, dl
cmovne eax, ecx
cmp eax, 3
jne 0x408054
mov ecx, edi
push 3
push 0x51a7d9
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
jne 0x40804d
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
movzx ecx, byte [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov eax, ecx
mov esi, edx
shr eax, 1
and cl, 1
cmove esi, eax
cmp esi, 4
jne 0x407501
lea ecx, [esp + 0x48]
push 4
push str.wipe
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406c2e
movzx eax, byte [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ecx, eax
shr eax, 1
and cl, 1
test cl, cl
cmovne eax, edx
cmp eax, 7
jne 0x40805e
lea ecx, [esp + 0x48]
push 7
push str.disable
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
jne 0x40805e
mov edi, dword [0x53e04c]
push 0x10
call fcn.00493b40
add esp, 4
mov dword [esp + 8], eax
mov dword [esp], 0x11
mov dword [eax + 7], 0x656c6261
mov dword [esp + 4], 0xb
mov dword [eax + 4], 0x61736964
mov dword [eax], 0x3a697367
mov byte [eax + 0xb], 0
push 0x10
call fcn.00493b40
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x11
mov dword [esp + 0x14], 0xd
mov dword [eax + 8], 0x53472067
mov dword [eax + 4], 0x6e696c62
mov dword [eax], 0x61736964
mov word [eax + 0xc], 0x49
mov ecx, edi
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0040dfa0
test byte [esp + 0x10], 1
lea esi, [esp + 0x1c]
je 0x4075cc
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
je 0x4075de
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
lea edi, [esp + 0x28]
test byte [esp + 0x48], 1
jne 0x407888
jmp 0x407bf4
lea ebx, [esp + 0x48]
lea esi, [esp + 0x1c]
mov ecx, ebx
mov edx, esi
call fcn.00408c30
mov ecx, ebx
mov edx, ebx
call fcn.00408d00
test byte [esp + 0x48], 1
je 0x40761f
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
mov bh, byte [esp + 0x44]
test byte [esp + 0x28], 1
jne 0x407bfb
jmp 0x407c07
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0
jmp 0x4079dc
mov edi, esp
lea esi, [esp + 0x1c]
mov ecx, edi
mov edx, esi
call fcn.00408c30
lea eax, [esp + 0x48]
mov ecx, edi
mov dword [esp + 0x48], 0x51c5ac
lea edx, [esp + 0x98]
mov ebx, eax
mov dword [esp + 0x58], eax
push 1
push eax
call fcn.00403c00
add esp, 8
mov ecx, dword [esp + 0x58]
cmp ebx, ecx
je 0x40788e
test ecx, ecx
je 0x407893
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x407893
mov eax, dword [eax + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.004ee530
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, 3
jb 0x4079dc
test byte [eax + 0x18], 1
jne 0x4079cf
add eax, 0x18
inc eax
jmp 0x4079d2
lea edi, [esp + 0x48]
lea esi, [esp + 0x1c]
mov ecx, edi
mov edx, esi
call fcn.00408c30
mov eax, esp
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
push eax
push edi
call fcn.004015e0
add esp, 8
test al, al
je 0x408068
mov eax, dword [esp + 4]
sub eax, dword [esp]
cmp eax, 0x100
jne 0x408075
mov ecx, dword [0x53e04c]
lea eax, [esp + 0x11]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x10], 0x12
mov byte [eax + 8], 0x65
mov dword [eax + 4], 0x72757461
mov dword [eax], 0x6e676973
mov byte [esp + 0x1a], 0
push 0
push 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0040ecb0
test byte [esp + 0x10], 1
je 0x4077a7
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
mov edi, dword [0x53e04c]
lea eax, [esp + 0x11]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x10], 0x12
mov byte [eax + 8], 0x65
mov dword [eax + 4], 0x72757461
mov dword [eax], 0x6e676973
mov byte [esp + 0x1a], 0
push 0x20
call fcn.00493b40
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], 0x21
mov dword [esp + 0x3c], 0x14
mov dword [eax + 0x10], 0x65727574
mov dword [eax + 0xc], 0x616e6769
mov dword [eax + 8], 0x7320676e
mov dword [eax + 4], 0x696c6c61
mov dword [eax], 0x74736e69
mov byte [eax + 0x14], 0
mov ecx, edi
push 0
push 0
push 0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040dfa0
test byte [esp + 0x38], 1
je 0x407852
push dword [esp + 0x40]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x10], 1
je 0x407865
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp]
lea edi, [esp + 0x28]
test eax, eax
je 0x40787d
mov dword [esp + 4], eax
push eax
call fcn.00493cf0
add esp, 4
test byte [esp + 0x48], 1
je 0x407bf4
push dword [esp + 0x50]
jmp 0x4078a9
mov eax, dword [ecx]
call dword [eax + 0x10]
test byte [esp], 1
mov bh, byte [esp + 0x44]
lea edi, [esp + 0x28]
je 0x407bf4
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x28], 1
jne 0x407bfb
jmp 0x407c07
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edx, ecx
sub edx, eax
cmp edx, 0xc
mov dl, 1
mov dword [esp + 0x84], edx
jne 0x4079c2
lea ecx, [esp + 0x48]
mov edx, esi
call fcn.00408c30
movzx eax, byte [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ecx, eax
mov esi, edx
shr ecx, 1
and al, 1
cmove esi, ecx
cmp esi, 0xa
jne 0x40792e
lea ecx, [esp + 0x48]
push 0xa
push str.bootloader
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406266
movzx ecx, byte [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov eax, ecx
shr ecx, 1
and al, 1
test al, al
mov esi, edx
cmove esi, ecx
cmp esi, 8
lea esi, [esp + 0x1c]
jne 0x407969
lea ecx, [esp + 0x48]
push 8
push str.recovery
push 0xffffffffffffffff
push 0
call fcn.004d5240
test eax, eax
je 0x406393
movzx ecx, byte [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov eax, ecx
shr ecx, 1
and al, 1
test al, al
cmovne ecx, edx
cmp ecx, 8
jne 0x408086
lea ecx, [esp + 0x48]
push 8
push str.fastboot
push 0xffffffffffffffff
push 0
call fcn.004d5240
mov cl, 1
test eax, eax
mov dword [esp + 0xbc], ecx
jne 0x408080
test byte [esp + 0x48], 1
je 0x4079af
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x84], 0
cmp eax, ecx
je 0x407bf4
jmp 0x408090
mov eax, dword [eax + 0x20]
lea ecx, [esp + 0x38]
push eax
call fcn.004ee530
lea ecx, [esp + 0xa8]
mov edx, esi
call fcn.00408c30
test byte [esp + 0xa8], 1
lea eax, [esp + 0xa9]
mov esi, eax
je 0x407a04
mov esi, dword [esp + 0xb0]
mov dword [esp + 0xd0], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xc8], 0
push esi
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x407fb0
mov ebx, eax
cmp eax, 0xb
jae 0x407a56
mov eax, ebx
lea edi, [esp + 0xc9]
add al, bl
test ebx, ebx
mov byte [esp + 0xc8], al
jne 0x407a89
jmp 0x407a94
mov dword [esp + 0x34], esi
mov esi, ebx
add esi, 0x10
and esi, 0xfffffff0
push esi
call fcn.00493b40
add esp, 4
or esi, 1
mov dword [esp + 0xd0], eax
mov edi, eax
mov dword [esp + 0xc8], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0xcc], ebx
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x48], 0x51c6d4
lea ecx, [esp + 0xc8]
mov byte [edi + ebx], 0
lea edx, [esp + 0x98]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
mov esi, eax
mov dword [esp + 0x58], eax
push 1
push eax
call fcn.00403c00
add esp, 8
mov ecx, dword [esp + 0x58]
cmp esi, ecx
je 0x407b73
mov bh, byte [esp + 0x44]
test ecx, ecx
lea edi, [esp + 0x28]
je 0x407af0
mov eax, dword [ecx]
call dword [eax + 0x14]
test byte [esp + 0xc8], 1
jne 0x407b8e
test byte [esp + 0xa8], 1
jne 0x407bab
test byte [esp + 0x38], 1
jne 0x407bc5
test byte [esp + 0x10], 1
je 0x407b2a
push dword [esp + 0x18]
call fcn.00493cf0
add esp, 4
mov esi, dword [esp]
test esi, esi
je 0x407bf0
mov eax, dword [esp + 4]
cmp eax, esi
je 0x407be1
nop word cs:[eax + eax]
nop dword [eax + eax]
test byte [eax - 0xc], 1
lea edi, [eax - 0xc]
je 0x407b64
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x407b50
mov eax, dword [esp]
lea edi, [esp + 0x28]
jmp 0x407be3
mov eax, dword [ecx]
call dword [eax + 0x10]
mov bh, byte [esp + 0x44]
lea edi, [esp + 0x28]
test byte [esp + 0xc8], 1
je 0x407afe
push dword [esp + 0xd0]
call fcn.00493cf0
add esp, 4
test byte [esp + 0xa8], 1
je 0x407b0c
push dword [esp + 0xb0]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x38], 1
je 0x407b17
push dword [esp + 0x40]
call fcn.00493cf0
add esp, 4
test byte [esp + 0x10], 1
jne 0x407b1e
jmp 0x407b2a
mov eax, esi
mov dword [esp + 4], esi
push eax
call fcn.00493cf0
add esp, 4
lea esi, [esp + 0x1c]
test byte [esp + 0x28], 1
je 0x407c07
push dword [esp + 0x30]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x20]
jne 0x406f50
jmp 0x405a34
mov ecx, dword [0x53e04c]
mov byte [esp + 0xf4], 0x14
mov word [esp + 0xfd], 0x7265
mov dword [esp + 0xf9], 0x64616f6c
mov dword [esp + 0xf5], 0x746f6f62
mov byte [esp + 0xff], 0
lea eax, [esp + 0xf4]
push 0
push 0
push eax
call fcn.0040e920
test byte [esp + 0xf4], 1
je 0x407cef
push dword [esp + 0xfc]
jmp 0x407ce7
mov ecx, dword [0x53e04c]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xdc], 0
mov byte [esp + 0xd8], 0x10
mov dword [esp + 0xdd], 0x79726576
mov dword [esp + 0xd9], 0x6f636572
mov byte [esp + 0xe1], 0
lea eax, [esp + 0xd8]
push 0
push 0
push eax
call fcn.0040e920
test byte [esp + 0xd8], 1
je 0x407cef
push dword [esp + 0xe0]
call fcn.00493cf0
add esp, 4
mov ecx, dword [0x53e04c]
call fcn.00410710
push 2
call dword [0x519454]
add esp, 4
mov esi, eax
call fcn.0040dc60
fstp qword [esp + 0x1b0]
movsd xmm0, qword [esp + 0x1b0]
subsd xmm0, qword [esp + 0x1a8]
sub esp, 0x10
mov dword [esp], esi
movsd qword [esp + 8], xmm0
mov dword [esp + 4], str.Finished._Total_time:__.3fs_n
call fcn.004d17b0
add esp, 0x10
mov ecx, dword [0x53e04c]
push 0
call fcn.00410b90
test eax, eax
je 0x407d59
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x407d9f
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x407d90
nop dword [eax]
test byte [eax - 0xc], 1
lea edi, [eax - 0xc]
je 0x407d84
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x407d70
mov eax, dword [esp + 0x1c]
jmp 0x407d92
mov eax, esi
mov dword [esp + 0x20], esi
push eax
call fcn.00493cf0
add esp, 4
lea ecx, [esp + 0x100]
call fcn.0040de50
mov ecx, dword [esp + 0x1a0]
lea eax, [esp + 0x190]
cmp eax, ecx
je 0x407dc8
test ecx, ecx
je 0x407dcd
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x407dcd
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esp + 0x188]
lea eax, [esp + 0x178]
cmp eax, ecx
je 0x407dea
test ecx, ecx
je 0x407def
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x407def
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esp + 0x170]
lea eax, [esp + 0x160]
cmp eax, ecx
je 0x407e13
test ecx, ecx
je 0x405539
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x405539
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x405539
mov esi, dword [0x53e04c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0
push 0x10
call fcn.00493b40
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0x11
mov dword [esp + 0x20], 0xc
mov dword [eax + 8], 0x746f6c73
mov dword [eax + 4], 0x2d746e65
mov dword [eax], 0x72727563
mov byte [eax + 0xc], 0
lea eax, [esp + 0x48]
lea edx, [esp + 0x1c]
mov ecx, esi
push 0
push eax
push edx
call fcn.0040e5a0
test byte [esp + 0x1c], 1
mov esi, eax
je 0x407e99
push dword [esp + 0x24]
call fcn.00493cf0
add esp, 4
test esi, esi
je 0x407ebb
mov esi, dword [ebp + 8]
mov dword [esp + 0xc4], 0
test byte [esp + 0x48], 1
je 0x40587e
jmp 0x407f47
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x48]
push 0
call fcn.004089a0
add esp, 4
test byte [esp + 0x88], 1
jne 0x407ee6
mov esi, dword [ebp + 8]
mov word [esp + 0x88], 0
jmp 0x407f22
mov eax, dword [esp + 0x90]
mov esi, dword [ebp + 8]
mov byte [eax], 0
mov dword [esp + 0x8c], 0
test byte [esp + 0x88], 1
je 0x407f22
push dword [esp + 0x90]
call fcn.00493cf0
add esp, 4
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x24]
movsd xmm0, qword [esp + 0x1c]
mov dword [esp + 0x90], eax
movsd qword [esp + 0x88], xmm0
test byte [esp + 0x48], 1
je 0x40587e
push dword [esp + 0x50]
call fcn.00493cf0
add esp, 4
jmp 0x40587e
call sub.msvcrt.dll_abort
mov eax, dword [0x53921c]
push dword [eax]
push str.invalid_sparse_limit__s
call fcn.0040dca0
lea ecx, [esp + 0x100]
call fcn.004d7ad0
mov eax, dword [esp + 0xf0]
shl eax, 4
push dword [esp + eax + 0x20c]
push str.unknown_option__s
call fcn.0040dca0
push str.invalid_page_size
call fcn.0040dca0
mov ecx, esi
call fcn.004d7ad0
push str.no_command
call fcn.004083e0
lea ecx, [esp + 0xc8]
call fcn.004d7ad0
lea ecx, [esp + 0x1c]
call fcn.004d7ab0
test byte [esp], 1
je 0x407fd6
mov eax, dword [esp + 8]
mov dword [esp + 0xd4], eax
push dword [esp + 0xd4]
push str.cannot_load__s
call fcn.0040dca0
push str.missing_flashing_command
call fcn.004083e0
mov ecx, dword [esp + 0x1c]
test byte [ecx], 1
jne 0x40809a
inc ecx
jmp 0x40809d
push eax
call fcn.00413ab0
add esp, 4
push eax
push esi
push str.failed_to_open_zip_file__s:__s
call fcn.0040dca0
lea ecx, [esp + 0x48]
call fcn.004d7ad0
test byte [esp], 1
je 0x408033
mov eax, dword [esp + 8]
mov dword [esp + 0xe8], eax
push dword [esp + 0xe8]
push str.cannot_determine_image_filename_for__s
call fcn.0040dca0
lea ecx, [esp + 0x38]
call fcn.004d7ad0
mov dl, byte [esp + 0x28]
and dl, 1
test dl, dl
je 0x4080a8
mov eax, dword [esp + 0x30]
jmp 0x4080ac
push str.expected_wipe_or_disable
call fcn.004083e0
test byte [esp + 0x48], 1
je 0x4080c6
mov esi, dword [esp + 0x50]
jmp 0x4080ca
push eax
push str.signature_must_be_256_bytes__got__zu_
call fcn.0040dca0
mov al, byte [esp + 0x48]
and al, 1
test al, al
je 0x4080b7
mov eax, dword [esp + 0x50]
jmp 0x4080bb
push str.junk_after_reboot_command
call fcn.004083e0
mov ecx, dword [ecx + 8]
push ecx
push str.unknown_flashing_command__s
call fcn.004083e0
lea eax, [esp + 0x29]
push eax
push str.unknown_command__s
call fcn.004083e0
lea eax, [esp + 0x49]
push eax
push str.unknown_reboot_target__s
call fcn.004083e0
lea esi, [esp + 0x49]
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 4
push eax
push esi
push str.could_not_load__s:__s
call fcn.0040dca0
nop word cs:[eax + eax]
push esi
sub esp, 0xc
mov esi, dword [esp + 0x18]
lea eax, [esp + 8]
mov ecx, esp
lea edx, [esp + 4]
push eax
push ecx
push edx
push str._u__u__u
push esi
call fcn.004d1790
add esp, 0x14
cmp eax, 3
jne 0x40815f
mov eax, dword [esp + 4]
lea ecx, [eax - 0x7d0]
cmp ecx, 0x80
jae 0x40816a
mov ecx, dword [esp]
lea edx, [ecx - 1]
cmp edx, 0xc
jae 0x408175
mov edx, dword [esp + 0x14]
mov esi, 0xfffff800
shl eax, 4
and ecx, 0xf
add eax, 0x300
and eax, 0x7f0
or ecx, eax
and esi, dword [edx + 0x2c]
or ecx, esi
mov dword [edx + 0x2c], ecx
add esp, 0xc
pop esi
ret 8
push esi
push str.OS_patch_level_should_be_YYYY_MM_DD:__s
call fcn.004083e0
push eax
push str.year_out_of_range:__d
call fcn.004083e0
push ecx
push str.month_out_of_range:__d
call fcn.004083e0
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
push edi
call sub.msvcrt.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x4083d4
mov ebx, eax
cmp eax, 0xb
jae 0x4081e8
mov eax, ebx
lea esi, [esp + 1]
add al, bl
test ebx, ebx
mov byte [esp], al
jne 0x40820e
jmp 0x408219
mov edi, ebx
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
call fcn.00493b40
add esp, 4
or ebx, 1
mov dword [esp + 8], eax
mov esi, eax
mov dword [esp], ebx
mov ebx, edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], ebx
push ebx
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
mov byte [esi + ebx], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov word [esp + 0x28], 0x2e02
mov byte [esp + 0x2a], 0
mov ecx, esp
lea edx, [esp + 0x10]
push eax
push ecx
push edx
call fcn.00421070
add esp, 0xc
test byte [esp + 0x28], 1
je 0x408269
push dword [esp + 0x30]
call fcn.00493cf0
add esp, 4
test byte [esp], 1
je 0x40827b
push dword [esp + 8]
call fcn.00493cf0
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub ecx, eax
je 0x4083c9
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
cmp ecx, 3
ja 0x4083c9
test byte [eax], 1
je 0x4082a7
mov eax, dword [eax + 8]
jmp 0x4082a8
inc eax
lea ecx, [esp + 0x24]
push 0
push 0xffffffffffffffff
push ecx
push eax
call fcn.004d2600
add esp, 0x10
test al, al
je 0x4083c9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, ecx
sub edx, eax
sar edx, 2
imul edx, edx, 0xaaaaaaab
cmp edx, 2
jb 0x40830c
test byte [eax + 0xc], 1
je 0x4082e7
mov eax, dword [eax + 0x14]
jmp 0x4082ea
add eax, 0xd
lea ecx, [esp + 0x20]
push 0
push 0xffffffffffffffff
push ecx
push eax
call fcn.004d2600
add esp, 0x10
test al, al
je 0x4083c9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub ecx, eax
cmp ecx, 0x24
jne 0x40833b
test byte [eax + 0x18], 1
je 0x40831e
mov eax, dword [eax + 0x20]
jmp 0x408321
add eax, 0x19
lea ecx, [esp + 0x1c]
push 0
push 0xffffffffffffffff
push ecx
push eax
call fcn.004d2600
add esp, 0x10
test al, al
je 0x4083c9
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov esi, edx
or esi, eax
or esi, ecx
cmp esi, 0x80
jae 0x4083c9
mov esi, dword [ebp + 8]
mov edi, 0x7ff
and ecx, 0x7f
and eax, 0x7f
shl edx, 0x19
shl ecx, 0x12
shl eax, 0xb
or ecx, edx
or eax, ecx
and edi, dword [esi + 0x2c]
or eax, edi
mov dword [esi + 0x2c], eax
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4083bf
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4083b0
nop dword [eax + eax]
test byte [eax - 0xc], 1
lea edi, [eax - 0xc]
je 0x4083a4
push dword [eax - 4]
call fcn.00493cf0
add esp, 4
cmp esi, edi
mov eax, edi
jne 0x408390
mov eax, dword [esp + 0x10]
jmp 0x4083b2
mov eax, esi
mov dword [esp + 0x14], esi
push eax
call fcn.00493cf0
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push edi
push str.bad_OS_version:__s
call fcn.004083e0
mov ecx, esp
call fcn.004d7ad0
nop dword [eax + eax]