joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c0d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x20034
call fcn.004d7290
sub esp, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
add eax, 9
mov dword [esp + 4], 0x4f140b
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42c188
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 2
je 0x42c17e
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
add ecx, 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_fopen___existing_bookmark___s__for___s__which_returned____d____s__
mov dword [esp + 8], global___func__.30
mov dword [esp + 4], 0xef
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
mov eax, 0
jmp 0x42c2ba
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10000
mov dword [esp + 4], 2
lea eax, [ebp - 0x20014]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._ferror
test eax, eax
je 0x42c22f
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
add ecx, 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_fread___bookmark___s__for___s__which_returned____d____s__
mov dword [esp + 8], global___func__.30
mov dword [esp + 4], 0xfb
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
mov eax, 0
jmp 0x42c2ba
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0x10], 0
jne 0x42c247
mov eax, 0
jmp 0x42c2ba
mov eax, dword [ebp - 0x10]
mov word [ebp + eax*2 - 0x20014], 0
lea eax, [ebp - 0x20014]
mov dword [esp], eax
call sym._EvtCreateBookmark_4
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c2b7
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
add ecx, 9
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Could_not_EvtCreateBookmark___bookmark___s__for___s__which_returned___lu_
mov dword [esp + 8], global___func__.30
mov dword [esp + 4], 0x111
mov dword [esp], str.logcollector_read_win_event_channel.c
call dbg._merror
mov eax, 0
jmp 0x42c2ba
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42d37d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call dbg.w_logcollector_state_get
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._cJSON_Print_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._cJSON_Delete_4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._realloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42d41f
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f1b20
mov dword [esp + 8], global___func__.187
mov dword [esp + 4], 0x71
mov dword [esp], str.logcollector_state.c
call dbg._merror_exit
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0x14]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
add eax, edx
mov byte [eax], 0
mov dword [ebp - 0x18], 0
mov dword [esp + 4], 0x4f1b6a
mov dword [esp], str.wazuh_logcollector.state
call sym._fopen
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42d4e5
mov eax, dword [ebp - 0x14]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fwrite
test eax, eax
jne 0x42d4d8
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.wazuh_logcollector.state
mov dword [esp + 0xc], 0x4f1b88
mov dword [esp + 8], global___func__.187
mov dword [esp + 4], 0x79
mov dword [esp], str.logcollector_state.c
call dbg._merror
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fclose
jmp 0x42d535
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.wazuh_logcollector.state
mov dword [esp + 0xc], 0x4f1bc0
mov dword [esp + 8], global___func__.187
mov dword [esp + 4], 0x7d
mov dword [esp], str.logcollector_state.c
call dbg._merror
cmp dword [ebp - 0x10], 0
je 0x42d54d
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x10], 0
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42f89c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x4c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
jne 0x42f962
mov dword [esp + 0xc], str.Unable_to_create_active_response_process.
mov dword [esp + 8], global___func__.51
mov dword [esp + 4], 0xe4
mov dword [esp], str.os_execd_exec.c
call dbg._merror
jmp 0x42f99b
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
nop
leave
ret
Function at 0x430a5d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0x4f2623
mov dword [esp], pe_nt_image_headers32
call dbg.queue_init
mov dword [0x57fac0], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.ExecdConfig
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x430ac2
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4f2630
mov dword [esp + 0xc], global___func__.35
mov dword [esp + 8], 0x202
mov dword [esp + 4], str.os_execd_execd.c
mov dword [esp], 3
call dbg._mlerror_exit
cmp dword [ebp - 0x10], 1
jne 0x430af6
mov dword [esp + 0xc], str._1350_:_Active_response_disabled.
mov dword [esp + 8], global___func__.35
mov dword [esp + 4], 0x207
mov dword [esp], str.os_execd_execd.c
call dbg._minfo
mov eax, 0
jmp 0x430bf1
call dbg.OSList_Create
mov dword [0x5888c0], eax
mov eax, dword [0x5888c0]
test eax, eax
jne 0x430b2d
mov dword [esp + 0xc], 0x4f267c
mov dword [esp + 8], global___func__.35
mov dword [esp + 4], 0x20e
mov dword [esp], str.os_execd_execd.c
call dbg._merror_exit
mov eax, dword [0x5888a0]
test eax, eax
je 0x430b42
call dbg.OSHash_Create
mov dword [0x5888c8], eax
jmp 0x430b4c
mov dword [0x5888c8], 0
mov dword [esp], dbg.ExecdShutdown
call dbg.atexit
call sym._getpid
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f26aa
mov dword [esp + 8], global___func__.35
mov dword [esp + 4], 0x21b
mov dword [esp], str.os_execd_execd.c
call dbg._minfo
mov eax, dword [0x57fac0]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], dbg.win_exec_main@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x430bec
mov dword [esp + 0xc], 0x4f26c0
mov dword [esp + 8], global___func__.35
mov dword [esp + 4], 0x21d
mov dword [esp], str.os_execd_execd.c
call dbg._merror_exit
mov eax, 1
leave
ret
Function at 0x4349ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x10144
call fcn.004d7290
sub esp, eax
mov dword [esp + 8], 0x101
mov dword [esp + 4], 0
lea eax, [ebp - 0x115]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x10001
mov dword [esp + 4], 0
lea eax, [ebp - 0x1011d]
mov dword [esp], eax
call sym._memset
mov dword [esp], 0x17
call sym._umask
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s.gz
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x115]
mov dword [esp], eax
call sym._snprintf_35
mov dword [esp + 4], 0x4f3456
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x434bc6
mov dword [esp + 4], 0x4f3458
lea eax, [ebp - 0x115]
mov dword [esp], eax
call sym._gzopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x434acc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x115]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f345c
mov dword [esp + 8], global___func__.47
mov dword [esp + 4], 0x30
mov dword [esp], str.monitord_compress_log.c
call dbg._merror
jmp 0x434bca
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10000
mov dword [esp + 4], 1
lea eax, [ebp - 0x1011d]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x434b5d
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1011d]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._gzwrite
cmp dword [ebp - 0x14], eax
je 0x434acc
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._gzerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Compression_error:__s
mov dword [esp + 8], global___func__.47
mov dword [esp + 4], 0x3a
mov dword [esp], str.monitord_compress_log.c
call dbg._merror
jmp 0x434acc
nop
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._gzclose
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._unlink
cmp eax, 0xffffffff
jne 0x434bc9
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_delete__s_due_to__s
mov dword [esp + 8], global___func__.47
mov dword [esp + 4], 0x43
mov dword [esp], str.monitord_compress_log.c
call dbg._merror
jmp 0x434bc9
nop
jmp 0x434bca
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4677fb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x4678ac
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4000000
jg 0x467886
mov eax, dword [ebp - 0x14]
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0x415]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._memcpy
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
jmp 0x4678ac
mov dword [esp + 0xc], str.String_limit_reached.
mov dword [esp + 8], global___func__.235
mov dword [esp + 4], 0xc6
mov dword [esp], str.wazuh_modules_wm_exec.c
call dbg._mwarn
jmp 0x4678f1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x41c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x400
lea edx, [ebp - 0x415]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x41c]
test eax, eax
jne 0x467816
mov eax, 0
leave
ret 4

Function at 0x467af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0x588a40
call dbg.pthread_mutex_lock
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x467b3e
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fa87d
mov dword [esp + 8], global___func__.82
mov dword [esp + 4], 0xfd
mov dword [esp], str.wazuh_modules_wm_exec.c
call dbg._merror_exit
mov dword [ebp - 0xc], 0
jmp 0x467b6a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x588a60]
mov dword [esp + 4], 0x7f
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 7
jg 0x467b7e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x588a60]
test eax, eax
jne 0x467b47
mov dword [esp], 0x588a40
call dbg.pthread_mutex_unlock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x467bc6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fa899
mov dword [esp + 8], global___func__.82
mov dword [esp + 4], 0x103
mov dword [esp], str.wazuh_modules_wm_exec.c
call dbg._merror_exit
nop
leave
ret
Function at 0x46c9b7
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x134
mov dword [ebp - 0x114], 0
lea edx, [ebp - 0x110]
mov eax, 0
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.wodles
mov dword [esp + 8], 0x4fbc9f
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._snprintf_45
cmp dword [ebp + 0xc], 0
jne 0x46ca19
mov eax, 0x4fbca5
jmp 0x46ca1e
mov eax, 0x4fbca8
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46ca40
mov eax, 0xffffffff
jmp 0x46caa9
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.w_file_cloexec
cmp dword [ebp + 0xc], 0
jne 0x46ca74
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._fwrite
jmp 0x46ca95
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x10]
sub eax, 1
mov edi, dword [ebp - 4]
leave
ret

Function at 0x46caae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x24], 0x746e6f43
mov dword [ebp - 0x20], 0x2d746e65
mov dword [ebp - 0x1c], 0x676e654c
mov dword [ebp - 0x18], 0x3a6874
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46caf2
mov eax, 0
jmp 0x46cb60
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._strlen
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
jmp 0x46cb0c
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
sub eax, 0x30
cmp eax, 9
jbe 0x46cb08
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x20
je 0x46cb08
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strtol
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp - 0xd]
mov byte [eax], dl
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x46d41a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov word [ebp - 0x1a], 0x3b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.IsFile
test eax, eax
jne 0x46d45e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x10], eax
jmp 0x46d5b7
mov dword [esp], str.PATH
call sym._getenv
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1a]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dbg.strtok_r
mov dword [ebp - 0xc], eax
jmp 0x46d5a0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, ebx
add eax, 2
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46d50c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4fbd00
mov dword [esp + 8], global___func__.210
mov dword [esp + 4], 0x1f2
mov dword [esp], str.wazuh_modules_wmodules.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, ebx
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4fbc9f
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._snprintf_45
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dbg.IsFile
test eax, eax
jne 0x46d578
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strdup
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
jmp 0x46d5aa
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1a]
mov dword [esp + 4], eax
mov dword [esp], 0
call dbg.strtok_r
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46d48e
cmp dword [ebp - 0x10], 0
jne 0x46d5b7
mov eax, 0
jmp 0x46d5df
cmp dword [ebp + 0xc], 0
je 0x46d5cf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strdup
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x47fcd4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], str.upgradeupgrade_result
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._remove
test eax, eax
jne 0x47fd0e
mov byte [0x588b00], 1
mov eax, dword [0x4e9300]
mov dword [esp + 4], eax
mov dword [esp], 0
call dbg.wm_agent_upgrade_command_ack
jmp 0x47fd5e
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.clear_upgrade_result
mov dword [esp + 0x10], str._8136_:_At__s:_Could_not_erase_file__s
mov dword [esp + 0xc], str.wm_agent_upgrade_com_clear_result
mov dword [esp + 8], 0x18c
mov dword [esp + 4], str.wazuh_modules_agent_upgrade_agent_wm_agent_upgrade_com.c
mov dword [esp], str.wazuh_modulesd:agent_upgrade
call dbg._mtdebug1
mov eax, dword [str.Could_not_erase_upgrade_result_file]
mov dword [esp + 4], eax
mov dword [esp], 0x13
call dbg.wm_agent_upgrade_command_ack
leave
ret
Function at 0x48033c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
mov dword [esp + 8], 0x21
mov dword [esp + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._memset
mov byte [ebp - 0x6d], 0
cmp dword [ebp + 0x10], 0
jne 0x480371
mov eax, 0x500c40
jmp 0x480376
mov eax, 0x500c43
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.wfopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x480398
mov eax, 0xffffffff
jmp 0x480469
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call sym._MD5_Init
jmp 0x4803cf
lea edx, [ebp - 0x46d]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x46d]
mov dword [esp + 4], eax
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call sym._MD5_Update
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
lea eax, [ebp - 0x46d]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4803a5
lea eax, [ebp - 0x6c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x47d]
mov dword [esp], eax
call sym._MD5_Final
mov dword [ebp - 0xc], 0
jmp 0x480453
lea edx, [ebp - 0x47d]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x500c45
mov dword [esp + 4], 3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._snprintf_50
add dword [ebp + 0xc], 2
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xf
jbe 0x48041b
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, 0
leave
ret