joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eec0
Capabilities:
Check if file exists
Check mutex on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push str.GlobalE4FA4AFA_D58E_4775_84A7_51A2D654D4F4
push 0
push 0x100000
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x40ef87
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x40ef8d
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
add esp, 0x10
call edi
push eax
push str.IsDragonSetupRunning
push 0x1b8
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x1b8
push str.IsDragonSetupRunning
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40ef76
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call edi
pop edi
pop esi
pop ebp
ret
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40f220
Capabilities:
Compare security identifiers
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00538060
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor ebx, ebx
mov dword [ebp - 0x100c], 0
mov word [ebp - 0x1008], 0x500
push edi
test eax, eax
je 0x40f264
mov dword [ebp - 0x1010], eax
jmp 0x40f28b
lea eax, [ebp - 0x1010]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40f32f
mov eax, dword [ebp - 0x1010]
lea ecx, [ebp - 0x1020]
push ecx
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
push 2
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x40f32f
lea eax, [ebp - 0x1018]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40f327
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x1004], ebx
jbe 0x40f315
lea edi, [ebp - 0x1000]
lea esp, [esp]
push dword [edi]
push dword [ebp - 0x1018]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40f310
inc esi
add edi, 8
cmp esi, dword [ebp - 0x1004]
jb 0x40f2f0
jmp 0x40f315
mov ebx, 1
push dword [ebp - 0x1018]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test ebx, ebx
jne 0x40f41b
cmp dword [ebp - 0x1010], 0xffffffff
je 0x40f42d
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x1014], 2
push eax
push 4
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x101c], 0
push eax
push 0x12
lea eax, [ebp - 0x1010]
push eax
call esi
test eax, eax
jne 0x40f40b
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsUserAdmin
push 0x20c
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x20c
push str.IsUserAdmin
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x40f3f1
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x40f440
cmp eax, 3
je 0x40f440
mov eax, dword [ebp - 0x1010]
cmp eax, 0xffffffff
je 0x40f42d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x410e50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
test edi, edi
jne 0x410f16
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push 0x57
push str.WaitForProcessExe
push 0xf7
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0xf7
push str.WaitForProcessExe
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x410efa
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
pop edi
mov eax, 0x57
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x110]
push eax
push edi
call fcn.0040efa0
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x411036
push dword [ebp - 0x10c]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x410fad
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00537300
push dword [0x5c10e4]
push 0x95
push str.LogState
call fcn.00404610
add esp, 0x18
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, 0xffffffff
je 0x410fa4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call ebx
jmp 0x410f20
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call edi
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x10
call ebx
push eax
push str.WaitForProcessExe
push 0x103
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_systemservices.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x103
push str.WaitForProcessExe
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x41102d
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call edi
call ebx
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x411050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x411065
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4110a4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4110a0
lea ebx, [ebx]
cmp esi, edx
jae 0x4110a4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x411090
cmp esi, edx
jb 0x4110a9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x412790
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5ae700
push 0x536b10
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5c2b50]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0x7530
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 1
push dword [0x5c836c]
mov esi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call esi
test eax, eax
jne 0x41292f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4128f9
push dword [ebp - 0x44]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x4128f9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x44]
push eax
push 1
push dword [0x5c836c]
call esi
test eax, eax
je 0x4128e6
xor edi, edi
mov dword [ebp - 0x48], edi
cmp edi, dword [ebp - 0x50]
jae 0x412923
lea eax, [edi + edi*8]
mov ecx, dword [ebp - 0x4c]
movdqu xmm1, xmmword [ecx + eax*4]
movdqu xmm0, xmmword [ecx + eax*4 + 0x10]
movdqu xmmword [ebp - 0x70], xmm0
mov eax, dword [ecx + eax*4 + 0x20]
mov dword [ebp - 0x60], eax
push 0x24
movd eax, xmm1
push eax
push dword [0x5c8368]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x5c], esi
test esi, esi
je 0x4128e6
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4128e6
jmp 0x4128b0
cmp dword [ebp - 0x3c], 1
je 0x4128fd
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x44]
push eax
push 0x24
lea eax, [ebp - 0x40]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4128e6
cmp dword [ebp - 0x3c], 1
je 0x4128fd
call ebx
sub eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x58]
jbe 0x4128b0
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x5c2b50
call fcn.00538630
add esp, 0xc
xor eax, eax
jmp 0x412934
mov dword [ebp - 4], 0
call fcn.0041291b
inc edi
jmp 0x41284e
mov dword [ebp - 4], 0xfffffffe
call fcn.00412950
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x412c30
Capabilities:
Create thread
Print debug messages

Disassembly:
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x5c8408], eax
mov dword [0x5c8354], 0
mov dword [0x5c8360], 0
mov dword [0x5c8350], 5
mov dword [0x5c835c], 0
test eax, eax
jne 0x412c8b
push 0x5c8348
push dword [0x5c8364]
mov dword [0x5c834c], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
ret
push ebx
push 0x5c8348
push dword [0x5c8364]
mov dword [0x5c834c], 4
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0
push 0
push 0
push 0x413320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [0x5c8408]
mov dword [0x5c840c], eax
call fcn.0041c660
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x412d59
push esi
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push ebx
push str.SvcInit
push 0x293
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_servicemain.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x293
push str.SvcInit
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x412d4d
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
pop ebx
ret
Function at 0x413280
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push str.ChromodoUpdater
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x413302
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_failed_with__d
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.00412970
add esp, 0x14
mov dword [ebp - 0xac], str.ChromodoUpdater
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x4167f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push 4
lea eax, [ebp + 8]
push eax
push 3
push str.AutoUpdate
push str.SOFTWAREComodoGroupChromodo
call fcn.0040b600
mov edi, eax
add esp, 0x14
test edi, edi
je 0x41689a
push esi
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.ModifyAutoUpdateRegValue
push 0x124
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_regstate_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x124
push str.ModifyAutoUpdateRegValue
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x41688c
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
pop esi
pop edi
pop ebp
ret

Function at 0x4168a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push 1
lea eax, [ebp + 8]
push eax
push 3
push str.EnableMessageCenter
push str.SOFTWAREComodoGroupChromodo
call fcn.0040b600
mov edi, eax
add esp, 0x14
test edi, edi
je 0x41694a
push esi
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.ModifyCMCRegValue
push 0x134
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_regstate_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x134
push str.ModifyCMCRegValue
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x41693c
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
pop esi
pop edi
pop ebp
ret
Function at 0x416d90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 3
push str.AutoUpdate
push str.SOFTWAREComodoGroupChromodo
call fcn.0040b3c0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x416f05
push ebx
push esi
cmp edi, 2
je 0x416e5b
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.SetAutoUpdateIfNotExists
push 0x108
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_regstate_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x108
push str.SetAutoUpdateIfNotExists
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x416e4b
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call ebx
mov eax, edi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 4]
push eax
push 3
push str.AutoUpdate
push str.SOFTWAREComodoGroupChromodo
call fcn.0040b600
mov esi, eax
add esp, 0x14
test esi, esi
je 0x416e54
cmp esi, 2
je 0x416e54
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov edi, eax
push 0
push edi
call fcn.00537300
push esi
push str.SetAutoUpdateIfNotExists
push 0x114
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_regstate_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push edi
call fcn.00406430
add esp, 0x30
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push 0x114
push str.SetAutoUpdateIfNotExists
call fcn.00404610
add esp, 0xc
test edi, edi
je 0x416ef5
push edi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call ebx
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4175e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
push 4
push str.UpdateState
push str.SOFTWAREComodoGroupChromodo
call fcn.0040b3c0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4177ec
push ebx
push esi
cmp edi, 2
je 0x417695
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.SetUpdateStateIfNotExists
push 0x16
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_regstate_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x16
jmp 0x41771a
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push str.UpdateState
push str.SOFTWAREComodoGroupChromodo
call fcn.0040b600
mov edi, eax
add esp, 0x14
test edi, edi
je 0x41774e
cmp edi, 2
je 0x41774e
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n______________________________________________________________________________________________n
call ebx
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push edi
push str.SetUpdateStateIfNotExists
push 0x22
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservice_regstate_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x22
push str.SetUpdateStateIfNotExists
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x417734
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call ebx
pop esi
pop ebx
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00537300
mov eax, dword [str.0__STATE_ALL_UP_TO_DATE_]
add esp, 0xc
test eax, eax
je 0x417789
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00537b6a
add esp, 0xc
push 0x103
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
push 0
push eax
call fcn.00537300
lea eax, [ebp - 0x108]
push eax
push str.Update_state_value_changed_to:__s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00406430
lea eax, [ebp - 0x20c]
push eax
push 0x8f
push str.LogState
call fcn.00404610
add esp, 0x28
mov eax, edi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
Function at 0x4195e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c2b50]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
cmp word [edx], ax
jne 0x419618
xor ecx, ecx
jmp 0x41962f
mov ecx, edx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419620
sub ecx, esi
sar ecx, 1
push ebx
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.004089f0
push 0x11
push str.___need_show_eula
lea ecx, [ebp - 0x1c]
call fcn.00417850
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
call fcn.0040f810
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41970e
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x800
call fcn.005369fe
push 0x800
mov esi, eax
push 0
push esi
call fcn.00537300
push ebx
push str.CheckIfEulaChanged
push 0x708
push str.c:devdragon_release_sync_srcdragonupdateservicedragonupdateservicedragon_update_api.cpp
push str.CD_Module
push str._s_____s____d____s___returned__d
push 0x800
push esi
call fcn.00406430
add esp, 0x30
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x708
push str.CheckIfEulaChanged
call fcn.00404610
add esp, 0xc
test esi, esi
je 0x4196de
push esi
call fcn.005369c6
add esp, 4
push str._n______________________________________________________________________________________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor esi, esi
cmp dword [ebp - 8], 8
pop ebx
jb 0x4196fd
push dword [ebp - 0x1c]
call fcn.0041e8e8
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00536ab6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4196e9
cmp eax, 1
jne 0x4196e9
mov esi, eax
jmp 0x4196eb