Function at 0x4c6b5c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x10444
call fcn.004d7290
sub esp, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
mov dword [esp], str.tmp_backup_policies
call dbg.IsFile
test eax, eax
jne 0x4c6bfb
mov dword [esp], str.tmp_backup_policies
call sym._remove
test eax, eax
je 0x4c6bfb
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.tmp_backup_policies
mov dword [esp + 0xc], str._6660_:__s_could_not_be_removed:__s___d_.
mov dword [esp + 8], str.set_policies
mov dword [esp + 4], 0x4ea
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
jmp 0x4c6e78
mov dword [esp + 0xc], str.tmp_backup_policies
mov dword [esp + 8], str.auditpol__backup__file:__s_
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x1041c]
mov dword [esp], eax
call sym._snprintf_79
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 5
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x1041c]
mov dword [esp], eax
call dbg.wm_exec
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c6c5e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c6c8e
mov dword [ebp - 0x10], 2
mov dword [esp + 0xc], str._6915_:_Audit_policies_could_not_be_auto_configured_due_to_the_Windows_version._Check_if_they_are_correct_for_whodata_mode.
mov dword [esp + 8], str.set_policies
mov dword [esp + 4], 0x4f4
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
jmp 0x4c6e78
mov dword [esp + 4], 0x50fbf0
mov dword [esp], str.tmp_backup_policies
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4c6cfe
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.tmp_backup_policies
mov dword [esp + 0xc], str._6661_:__s_could_not_be_opened:__s___d_.
mov dword [esp + 8], str.set_policies
mov dword [esp + 4], 0x4f9
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
jmp 0x4c6e78
mov dword [esp + 4], 0x50fc21
mov dword [esp], str.tmp_new_policies
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c6d83
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.tmp_new_policies
mov dword [esp + 0xc], str._6661_:__s_could_not_be_opened:__s___d_.
mov dword [esp + 8], str.set_policies
mov dword [esp + 4], 0x4fd
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
jmp 0x4c6e78
lea eax, [ebp - 0x1001c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fprintf_15
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xffc4
lea eax, [ebp - 0x1001c]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x4c6d6e
mov eax, dword [global_WPOL_FILE_SYSTEM_SUC]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fprintf_15
mov eax, dword [global_WPOL_HANDLE_SUC]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fprintf_15
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0xc], str.tmp_new_policies
mov dword [esp + 8], str.auditpol__restore__file:__s_
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x1041c]
mov dword [esp], eax
call sym._snprintf_79
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 5
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x1041c]
mov dword [esp], eax
call dbg.wm_exec
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c6e3a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c6e67
mov dword [ebp - 0x10], 2
mov dword [esp + 0xc], str._6915_:_Audit_policies_could_not_be_auto_configured_due_to_the_Windows_version._Check_if_they_are_correct_for_whodata_mode.
mov dword [esp + 8], str.set_policies
mov dword [esp + 4], 0x512
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_whodata_win_whodata.c
call dbg._merror
jmp 0x4c6e78
mov dword [ebp - 0x10], 0
mov dword [0x58a3b0], 1
cmp dword [ebp - 0xc], 0
je 0x4c6e89
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
leave
ret