Function at 0x475335
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov eax, 0x1910
call fcn.004d7290
sub esp, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xca8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [esp + 8], 0x402
mov dword [esp + 4], 0
lea eax, [ebp - 0x4a2]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x801
mov dword [esp + 4], 0
lea eax, [ebp - 0xca3]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
je 0x4753c0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
jmp 0x4753c5
mov eax, 0
mov dword [ebp - 0x18], eax
jmp 0x476dae
cmp dword [ebp + 0x1c], 0
je 0x4753f6
mov dword [esp + 8], str.Requirements_check
mov dword [esp + 4], 0x32
lea eax, [ebp - 0x18f2]
mov dword [esp], eax
call sym._snprintf_48
jmp 0x475486
mov dword [esp + 4], 0x4fd8d9
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x47541f
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x47545e
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Skipping_check._Check_ID_is_invalid._Offending_check_number:__d
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x3d4
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
mov dword [ebp - 0xc], 1
jmp 0x476da6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.id:__d
mov dword [esp + 4], 0x32
lea eax, [ebp - 0x18f2]
mov dword [esp], eax
call sym._snprintf_48
mov dword [esp + 4], str.title
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4754af
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x4754fb
lea eax, [ebp - 0x18f2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Skipping_check_with__s:_Check_name_is_invalid.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x3dd
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
cmp dword [ebp + 0x1c], 0
je 0x476d9c
mov dword [ebp - 0xc], 1
jmp 0x476dc3
mov dword [esp + 4], str.condition
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x475524
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x47557a
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x18f2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Skipping_check__s:__s:_Check_condition_not_found.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x3e7
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
cmp dword [ebp + 0x1c], 0
je 0x476d9f
mov dword [ebp - 0xc], 1
jmp 0x476dc3
mov dword [ebp - 0xcac], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + 0x10]
lea edx, [ebp - 0xcac]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.wm_sca_set_condition
mov eax, dword [ebp - 0xcac]
cmp eax, 0x10
jne 0x475607
mov eax, dword [ebp - 0x60]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x18f2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Skipping_check__s:__s:_Check_condition___s__is_invalid.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x3f3
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
cmp dword [ebp + 0x1c], 0
je 0x476da2
mov dword [ebp - 0xc], 1
jmp 0x476dc3
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xcac]
and eax, 2
test eax, eax
jne 0x475628
mov eax, dword [ebp - 0xcac]
and eax, 8
test eax, eax
je 0x475631
mov dword [ebp - 0x1c], 0
jmp 0x475645
mov eax, dword [ebp - 0xcac]
and eax, 1
test eax, eax
je 0x475645
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x18f2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Beginning_evaluation_of_check__s__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x404
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Rule_aggregation_strategy_for_this_check_is__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x405
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Initial_rule_aggregator_value_por_this_type_of_rule_is__d
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x406
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov dword [esp + 0x10], str.Beginning_rules_evaluation.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x407
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov dword [esp + 4], str.rules
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x47578f
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x18f2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Skipping_check__s__s:_No_rules_found.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x40b
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
cmp dword [ebp + 0x1c], 0
je 0x476da5
mov dword [ebp - 0xc], 1
jmp 0x476dc3
mov dword [ebp - 0xcb0], 0
mov dword [esp + 4], str.regex_type
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x47580a
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sym._cJSON_GetStringValue_4
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x4fe2b4
call sym._strcmp
test eax, eax
jne 0x4757f2
mov dword [esp + 4], 4
lea eax, [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_calloc_expression_t
jmp 0x47584f
mov dword [esp + 4], 0
lea eax, [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_calloc_expression_t
jmp 0x47584f
mov eax, dword [ebp + 0x34]
mov dword [esp + 4], eax
mov dword [esp], 0x4fe2b4
call sym._strcmp
test eax, eax
jne 0x475839
mov dword [esp + 4], 4
lea eax, [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_calloc_expression_t
jmp 0x47584f
mov dword [esp + 4], 0
lea eax, [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_calloc_expression_t
mov eax, dword [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_expression_get_regex_type
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.SCA_will_use__s_engine_to_check_the_rules.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x422
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x64], 0
je 0x4758a2
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 8]
jmp 0x4758a7
mov eax, 0
mov dword [ebp - 0x24], eax
jmp 0x4768b7
cmp dword [ebp - 0x20], 0
je 0x4758c7
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x47592f
mov dword [esp + 0x10], str.Field_rule_must_be_a_string.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x42c
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xcb0]
test eax, eax
je 0x476dc2
mov eax, dword [ebp - 0xcb0]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xcb0], 0
jmp 0x476dc2
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Considering_rule:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x432
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4759c4
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x434
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14bf], 0
lea eax, [ebp - 0x14bb]
mov ecx, 0x7fc
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x800
lea eax, [ebp - 0x14bf]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x14bf]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Rule_after_variable_expansion:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x43b
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x28], 0
je 0x475ae1
mov dword [esp + 8], 4
mov dword [esp + 4], str.NOT
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strncmp
test eax, eax
je 0x475aaa
mov dword [esp + 8], 4
mov dword [esp + 4], str.not
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strncmp
test eax, eax
jne 0x475ae1
mov dword [esp + 0x10], str.Rule_is_negated.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x445
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov dword [ebp - 0x2c], 1
add dword [ebp - 0x28], 4
lea eax, [ebp - 0xa0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dbg.wm_sca_get_value
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x475b83
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Invalid_rule:__s._Skipping_policy.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x44f
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
cmp dword [ebp - 0x20], 0
je 0x475b51
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xcb0]
test eax, eax
je 0x4768a2
mov eax, dword [ebp - 0xcb0]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xcb0], 0
jmp 0x4768a2
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0xa0]
cmp eax, 1
jne 0x475e5f
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dbg.wm_sca_get_pattern
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x475c17
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x45d
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
cmp dword [ebp + 0x30], 0
je 0x475da1
mov dword [ebp - 0x38], 0
jmp 0x475d88
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x475d84
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Variable__s_found_at_rule__s._Replacing_it.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x463
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.OSStore_Get
mov edx, dword [ebp - 0x38]
lea ecx, [edx*4]
mov edx, dword [ebp + 0x30]
add edx, ecx
mov edx, dword [edx]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dbg.wstr_replace
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x34], 0
je 0x475cff
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x475d51
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Invalid_variable_replacement:__s._Skipping_check.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x468
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
jmp 0x475da1
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Variable_replaced:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x46b
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x475c2d
cmp dword [ebp - 0x34], 0
je 0x4768a8
mov eax, dword [ebp - 0xcb0]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xca8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dbg.wm_sca_check_file_list
mov dword [ebp - 0x98], eax
mov eax, 1
cmp dword [ebp - 0x98], eax
je 0x475df4
mov eax, 2
cmp dword [ebp - 0x98], eax
jne 0x475dfd
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._File:__s
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x18c0]
mov dword [esp], eax
call sym._snprintf_48
lea eax, [ebp - 0x18c0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dbg.append_msg_to_vm_scat
cmp dword [ebp - 0x34], 0
je 0x47678d
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x34], 0
jmp 0x47678d
mov eax, dword [ebp - 0xa0]
cmp eax, 5
jne 0x4762ef
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dbg.wm_sca_get_pattern
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x475eec
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x484
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 0x28]
and eax, 1
test al, al
jne 0x47600e
cmp dword [ebp + 0x24], 0
je 0x47600e
mov dword [esp + 4], 0x4fdb28
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov eax, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Ignoring_check_for_policy__s._The_internal_option_sca.remote_commands_is_disabled.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x487
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtwarn
mov eax, dword [ebp - 0xca8]
test eax, eax
jne 0x476002
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Ignoring_check_for_running_command__s._The_internal_option_sca.remote_commands_is_disabled
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._snprintf_48
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0xca8], eax
mov eax, dword [ebp - 0xca8]
test eax, eax
jne 0x475fe5
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x489
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
mov eax, dword [ebp - 0xca8]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Ignoring_check_for_running_command__s._The_internal_option_sca.remote_commands_is_disabled
mov dword [esp], eax
call sym._sprintf_3
mov dword [ebp - 0x30], 2
jmp 0x47628d
cmp dword [ebp + 0x30], 0
je 0x476198
mov dword [ebp - 0x40], 0
jmp 0x47617f
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x47617b
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Variable__s_found_at_rule__s._Replacing_it.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x493
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.OSStore_Get
mov edx, dword [ebp - 0x40]
lea ecx, [edx*4]
mov edx, dword [ebp + 0x30]
add edx, ecx
mov edx, dword [edx]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dbg.wstr_replace
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x3c], 0
je 0x4760f6
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x476148
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Invalid_variable:__s._Skipping_check.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x498
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
jmp 0x476198
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Variable_replaced:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x49b
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
add dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x476024
cmp dword [ebp - 0x3c], 0
je 0x4768ab
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Running_command:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4a4
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov eax, dword [ebp - 0xcb0]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xca8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dbg.wm_sca_read_command
mov dword [ebp - 0x8c], eax
mov eax, 1
cmp dword [ebp - 0x8c], eax
jne 0x47624d
mov dword [esp + 0x10], str.Command_output_matched.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4a7
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov dword [ebp - 0x30], 1
jmp 0x47628d
mov eax, 2
cmp dword [ebp - 0x8c], eax
jne 0x47628d
mov dword [esp + 0x10], str.Command_output_did_not_match.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4aa
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov dword [ebp - 0x30], 2
mov byte [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._Command:__s
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x18c0]
mov dword [esp], eax
call sym._snprintf_48
lea eax, [ebp - 0x18c0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dbg.append_msg_to_vm_scat
cmp dword [ebp - 0x3c], 0
je 0x47678d
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x3c], 0
jmp 0x47678d
mov eax, dword [ebp - 0xa0]
cmp eax, 4
jne 0x4765d0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Processing_directory_rule__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4b7
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dbg.wm_sca_get_pattern
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4763a9
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x4bc
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
cmp dword [ebp + 0x30], 0
je 0x47652d
mov dword [ebp - 0x48], 0
jmp 0x476514
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x476510
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x44]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Variable__s_found_at_rule__s._Replacing_it.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4c2
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.OSStore_Get
mov edx, dword [ebp - 0x48]
lea ecx, [edx*4]
mov edx, dword [ebp + 0x30]
add edx, ecx
mov edx, dword [edx]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call dbg.wstr_replace
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x44], 0
je 0x47648e
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4764dd
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Invalid_variable:__s._Skipping_check.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4c7
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
jmp 0x47652d
mov eax, dword [ebp - 0x44]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Variable_replaced:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4ca
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
add dword [ebp - 0x48], 1
mov eax, dword [ebp - 0x48]
lea edx, [eax*4]
mov eax, dword [ebp + 0x30]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x4763bf
cmp dword [ebp - 0x44], 0
je 0x4768ae
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call dbg.wm_sca_get_pattern
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0xcb0]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xca8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x80]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dbg.wm_sca_check_dir_list
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Check_directory_rule_result:__d
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4d5
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
cmp dword [ebp - 0x44], 0
je 0x47678d
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x44], 0
jmp 0x47678d
mov eax, dword [ebp - 0xa0]
cmp eax, 3
jne 0x4766f1
cmp dword [ebp - 0x10], 0
jne 0x4765ed
call dbg.w_os_get_process_list
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Checking_process:__s
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4df
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov eax, dword [ebp - 0xcb0]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xca8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dbg.wm_sca_check_process_is_running
test eax, eax
je 0x47667f
mov dword [esp + 0x10], str.Process_found.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4e1
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov dword [ebp - 0x30], 1
jmp 0x4766ab
mov dword [esp + 0x10], str.Process_not_found.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x4e4
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug2
mov byte [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._Process:__s
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x18c0]
mov dword [esp], eax
call sym._snprintf_48
lea eax, [ebp - 0x18c0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dbg.append_msg_to_vm_scat
jmp 0x47678d
mov eax, dword [ebp - 0xa0]
cmp eax, 2
jne 0x47678d
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dbg.wm_sca_get_pattern
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call dbg.wm_sca_get_pattern
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xcb0]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xca8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dbg.wm_sca_is_registry
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._Registry:__s
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x18c0]
mov dword [esp], eax
call sym._snprintf_48
lea eax, [ebp - 0x18c0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dbg.append_msg_to_vm_scat
mov eax, 2
cmp dword [ebp - 0x30], eax
je 0x47679d
mov eax, dword [ebp - 0x2c]
xor dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Result_for_rule__s:__d
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x500
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov eax, dword [ebp - 0xcac]
and eax, 1
test eax, eax
je 0x4767f1
mov eax, 0
cmp dword [ebp - 0x30], eax
je 0x47681f
mov eax, dword [ebp - 0xcac]
and eax, 2
test eax, eax
je 0x476808
mov eax, 1
cmp dword [ebp - 0x30], eax
je 0x47681f
mov eax, dword [ebp - 0xcac]
and eax, 8
test eax, eax
je 0x476864
mov eax, 1
cmp dword [ebp - 0x30], eax
jne 0x476864
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Breaking_from_rule_aggregator__s_with_found___d
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x507
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
jmp 0x4768c1
mov eax, 2
cmp dword [ebp - 0x30], eax
jne 0x4768af
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], str.Rule_evaluation_returned_INVALID._Continuing.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x50f
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
jmp 0x4768af
nop
jmp 0x476dc3
nop
jmp 0x4768af
nop
jmp 0x4768af
nop
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4758af
mov eax, dword [ebp - 0xcac]
and eax, 8
test eax, eax
je 0x4768e5
mov eax, 2
cmp dword [ebp - 0x1c], eax
je 0x4768e5
cmp dword [ebp - 0x1c], 0
sete al
movzx eax, al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x18f2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Result_for_check__s__s_____d
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x517
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov eax, 2
cmp dword [ebp - 0x1c], eax
je 0x476958
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x476958
mov eax, dword [ebp - 0xca8]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xca8], 0
cmp dword [ebp - 0x20], 0
je 0x476970
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x20], 0
cmp dword [ebp + 0x1c], 0
je 0x4769f5
mov eax, 2
cmp dword [ebp - 0x1c], eax
je 0x476986
cmp dword [ebp - 0x1c], 0
jne 0x47698d
mov eax, 1
jmp 0x476992
mov eax, 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4c], 0
jmp 0x4769ce
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x4c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x4c]
shl edx, 2
add eax, edx
mov dword [eax], 0
add dword [ebp - 0x4c], 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x4c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x47699e
lea eax, [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_free_expression_t
jmp 0x476dc3
mov dword [ebp - 0xcb7], 0x6c696166
mov dword [ebp - 0xcb4], 0x64656c
mov dword [ebp - 0xcbe], 0x73736170
mov dword [ebp - 0xcbb], 0x646573
mov byte [ebp - 0xcbf], 0
mov dword [ebp - 0x50], 0
mov eax, 0
cmp dword [ebp - 0x1c], eax
jne 0x476a48
call dbg.wm_sca_summary_increment_failed
lea eax, [ebp - 0xcb7]
mov dword [ebp - 0x50], eax
jmp 0x476b42
mov eax, 1
cmp dword [ebp - 0x1c], eax
jne 0x476a65
call dbg.wm_sca_summary_increment_passed
lea eax, [ebp - 0xcbe]
mov dword [ebp - 0x50], eax
jmp 0x476b42
call dbg.wm_sca_summary_increment_invalid
lea eax, [ebp - 0xcbf]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xca8]
test eax, eax
jne 0x476b42
mov dword [esp + 8], str.Unknown_reason
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._snprintf_48
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0xca8], eax
mov eax, dword [ebp - 0xca8]
test eax, eax
jne 0x476b00
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x540
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
mov eax, dword [ebp - 0xca8]
mov dword [esp + 4], str.Unknown_reason
mov dword [esp], eax
call sym._sprintf_3
mov dword [esp + 0x10], str.A_check_returned_INVALID_for_an_unknown_reason.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x542
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mtdebug1
mov edx, dword [ebp - 0xca8]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x50]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dbg.wm_sca_build_event
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x476ce0
mov eax, dword [0x588abc]
mov edx, dword [ebp + 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x476c6d
mov eax, dword [ebp - 0x14]
add eax, 2
lea edx, [eax*4]
mov eax, dword [0x588abc]
mov ecx, dword [ebp + 0x20]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov ecx, dword [0x588abc]
mov ebx, dword [ebp + 0x20]
shl ebx, 2
add ebx, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x476c30
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fd5a8
mov dword [esp + 8], global___func__.117
mov dword [esp + 4], 0x54a
mov dword [esp], str.wazuh_modules_wm_sca.c
call dbg._merror_exit
mov eax, dword [0x588abc]
mov edx, dword [ebp + 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [0x588abc]
mov edx, dword [ebp + 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
add edx, 1
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [0x588ab4]
mov edx, dword [ebp + 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x9c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x50]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.wm_sca_check_hash
test eax, eax
je 0x476cc9
cmp dword [ebp + 0x28], 0
jne 0x476cc9
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dbg.wm_sca_send_event_check
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._cJSON_Delete_4
sub esp, 4
jmp 0x476d1d
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Error_constructing_event_for_check:__s._Set_debug_mode_for_more_information.
mov dword [esp + 0xc], global___func__.117
mov dword [esp + 8], 0x557
mov dword [esp + 4], str.wazuh_modules_wm_sca.c
mov dword [esp], 0x4fd44c
call dbg._mterror
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x54], 0
jmp 0x476d56
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x54]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x54]
shl edx, 2
add eax, edx
mov dword [eax], 0
add dword [ebp - 0x54], 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x54]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x476d26
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x476d8c
mov eax, dword [ebp - 0xca8]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xca8], 0
lea eax, [ebp - 0xcb0]
mov dword [esp], eax
call dbg.w_free_expression_t
jmp 0x476da6
nop
jmp 0x476da6
nop
jmp 0x476da6
nop
jmp 0x476da6
nop
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4753cd
mov eax, dword [ebp + 0x2c]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
jmp 0x476dc3
nop
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x476de5
mov eax, dword [ebp - 0xca8]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dbg.w_del_plist
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret