Function at 0x450e08
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x20144
call fcn.004d7290
sub esp, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0x4f7002
mov dword [ebp - 0x38], str.windows_registry
mov dword [ebp - 0x3c], 0x4f701f
mov dword [ebp - 0x40], 0x4f7029
mov dword [ebp - 0x44], 0x4f7032
mov dword [ebp - 0x48], 0x4f703b
mov dword [ebp - 0x4c], 0x4f7045
mov dword [ebp - 0x50], 0x4f6d58
mov dword [ebp - 0x54], 0x4f7050
mov dword [ebp - 0x58], 0x4f7058
mov dword [ebp - 0x5c], 0x4f7067
mov dword [ebp - 0x60], str.registry_ignore
mov dword [ebp - 0x64], str.registry_ignore_value
mov dword [ebp - 0x68], str.auto_ignore
mov dword [ebp - 0x6c], str.alert_new_files
mov dword [ebp - 0x70], str.remove_old_diff
mov dword [ebp - 0x74], 0x4f70c0
mov dword [ebp - 0x78], 0x4f70c9
mov dword [ebp - 0x7c], 0x4f70d7
mov dword [ebp - 0x80], 0x4f70e5
mov dword [ebp - 0x84], 0x4f70ee
mov dword [ebp - 0x88], 0x4f70f7
mov dword [ebp - 0x8c], 0x4f7100
mov dword [ebp - 0x90], 0x4f6f0f
mov dword [ebp - 0x94], str.restart_audit
mov dword [ebp - 0x98], 0x4f7118
mov dword [ebp - 0x9c], 0x4f712f
mov dword [ebp - 0xa0], 0x4f6796
mov dword [ebp - 0xa4], 0x4f679b
mov dword [ebp - 0xa8], 0x4f67a1
mov dword [ebp - 0xac], str.both
mov dword [ebp - 0xb0], 0x4f6b68
mov dword [ebp - 0xb4], str.audit_key
mov dword [ebp - 0xb8], str.startup_healthcheck
mov dword [ebp - 0xbc], 0x4f7162
mov dword [ebp - 0xc0], 0x4f7173
mov dword [ebp - 0xc4], 0x4f6d92
mov dword [ebp - 0xc8], 0x4f7183
mov dword [ebp - 0xcc], 0x4f719e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x100ec], 0
lea eax, [ebp - 0x100e8]
mov edx, 0xfffc
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
cmp eax, 0xfffffffe
jne 0x450fc4
mov eax, dword [ebp - 0xd0]
mov dword [eax + 4], 0xffffffff
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xcc]
test eax, eax
jne 0x45104e
mov dword [esp + 4], 4
mov dword [esp], 1
call sym._calloc
mov edx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xcc], edx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xcc]
test eax, eax
jne 0x45104e
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x695
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov dword [ebp - 0xc], 0
jmp 0x4537bd
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4510a0
mov dword [esp + 0xc], 0x4f71a4
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x699
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4510fe
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f71d8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x69c
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4511cd
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
add eax, 8
mov dword [esp], eax
call dbg.fim_adjust_path
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0xffff
mov dword [esp + 4], eax
lea eax, [statbuf.st_mtime]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [statbuf.st_mtime]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.read_attr
test eax, eax
jne 0x4537b9
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45125c
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
lea ebx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ebx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.read_reg
test eax, eax
jne 0x4537b9
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x98]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451335
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_StrIsNum
test eax, eax
jne 0x451308
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6ba
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._atoi
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0xb4], eax
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4513da
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f7206
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451399
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xec], 1
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f720d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4537b9
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xec], 0
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4514ad
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_StrIsNum
test eax, eax
jne 0x451483
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6d1
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._atoi
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0x1c], eax
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x48]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45156c
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_IsValidUniqueTime
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x34]
test eax, eax
jne 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6db
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451667
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_IsValidDay
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f7214
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6e4
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6e5
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451939
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4537ac
mov dword [ebp - 0x10], 0
jmp 0x4518f6
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x50]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4517d3
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451730
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x38], 1
jmp 0x4518f2
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45176a
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x38], 0
jmp 0x4518f2
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6f8
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4518f2
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_StrIsNum
test eax, eax
jne 0x451887
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x6ff
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._atoi
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x3c]
test eax, eax
jns 0x4518f2
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0xc], str.Maximum_value_allowed_for_file_limit_is__d
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x707
mov dword [esp], str.config_syscheck_config.c
call dbg._mdebug2
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x3c], 0x7fffffff
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x4516cb
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x38]
test eax, eax
jne 0x451929
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x3c], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x58]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451c20
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4537af
mov dword [ebp - 0x10], 0
jmp 0x451bd7
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x50]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451aab
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451a05
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x8c], 1
jmp 0x451bd3
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451a42
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x8c], 0
jmp 0x451bd3
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x723
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451bd3
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_StrIsNum
test eax, eax
jne 0x451b5f
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x72a
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._atoi
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0x90], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x90]
test eax, eax
jns 0x451bd3
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0xc], str.Maximum_value_allowed_for_registry_limit_is__d
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x732
mov dword [esp], str.config_syscheck_config.c
call dbg._mdebug2
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x90], 0x7fffffff
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x45199d
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0x8c]
test eax, eax
jne 0x451c10
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x90], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x78]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451d1d
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451c85
mov eax, dword [ebp - 0xd0]
mov dword [eax + 8], 1
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451cbf
mov eax, dword [ebp - 0xd0]
mov dword [eax + 8], 0
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x747
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x74]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451e1a
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451d82
mov eax, dword [ebp - 0xd0]
mov dword [eax + 4], 1
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451dbc
mov eax, dword [ebp - 0xd0]
mov dword [eax + 4], 0
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x753
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x80]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451f1d
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451e82
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
or edx, 1
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451ebf
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
and edx, 0xfffffffe
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x761
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x84]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452023
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451f88
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
or edx, 2
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x451fc5
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
and edx, 0xfffffffd
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x76f
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x88]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452129
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45208e
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
or edx, 4
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4520cb
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
and edx, 0xfffffffb
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x77d
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x8c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45222f
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452194
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
or edx, 8
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4521d1
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x14]
and edx, 0xfffffff7
mov byte [eax + 0x14], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x78b
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4523fb
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4523d0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4523d0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4523d0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x4523d0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], 0x4f6f5b
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45236a
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp + 4], str.sregex
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45236a
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xd0]
add edx, 0x44
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x4f7067
call dbg.process_option_regex
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jg 0x4523ca
mov eax, dword [ebp - 0xec]
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6679_:_Invalid_attribute__s_for__s_option.
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x79a
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
nop
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xd0]
add edx, 0x40
mov dword [esp + 4], eax
mov dword [esp], edx
call dbg.process_option
jmp 0x4537b9
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0xc]
lea ecx, [edx*4]
mov edx, dword [ebp + 0xc]
add edx, ecx
mov edx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strncmp
test eax, eax
jne 0x452892
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._strcmp
test eax, eax
sete al
movzx eax, al
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x45271a
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x45271a
mov dword [ebp - 0x1c], 0
jmp 0x4526f4
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], 0x4f6f5b
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452528
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], str.sregex
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452528
mov dword [ebp - 0x14], 1
jmp 0x4526f0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xa0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452688
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xa4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4525a0
mov dword [ebp - 0x18], 0
jmp 0x4526f0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xa8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4525e0
mov dword [ebp - 0x18], 1
jmp 0x4526f0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xac]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452620
mov dword [ebp - 0x18], 2
jmp 0x4526f0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x1c]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f68c8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x7b9
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x1c]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f68c8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x7bd
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x4524b8
cmp dword [ebp - 0x14], 0
je 0x4527db
cmp dword [ebp - 0x18], 2
je 0x452766
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xe8]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.dump_registry_ignore_regex
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xe8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.dump_registry_ignore_regex
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xe8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.dump_registry_ignore_regex
jmp 0x4537b9
cmp dword [ebp - 0x18], 2
je 0x45281d
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xe8]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.dump_registry_ignore
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xe8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.dump_registry_ignore
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xe8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.dump_registry_ignore
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x90]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452a61
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x452a36
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x452a36
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x452a36
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x452a36
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], 0x4f6f5b
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4529d0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp + 4], str.sregex
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4529d0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xd0]
add edx, 0x6c
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x4f6f0f
call dbg.process_option_regex
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x452a30
mov eax, dword [ebp - 0xe4]
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6679_:_Invalid_attribute__s_for__s_option.
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x7df
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
nop
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xd0]
add edx, 0x68
mov dword [esp + 4], eax
mov dword [esp], edx
call dbg.process_option
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x68]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x7c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452c7c
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0xffff
lea edx, [ebp - 0x100ec]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
test eax, eax
jne 0x452b65
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp - 0xc]
lea ecx, [edx*4]
mov edx, dword [ebp + 0xc]
add edx, ecx
mov edx, dword [edx]
mov edx, dword [edx + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Could_not_expand_the_environment_variable__s___ld_
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x7ef
mov dword [esp], str.config_syscheck_config.c
call dbg._merror
jmp 0x4537b9
lea eax, [ebp - 0x100ec]
mov dword [ebp - 0x20], eax
jmp 0x452b8e
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov edx, eax
mov eax, dword [ebp - 0x20]
mov byte [eax], dl
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test al, al
jne 0x452b70
lea eax, [ebp - 0x100ec]
movzx eax, byte [eax]
test al, al
je 0x4537b9
mov dword [esp + 8], 0xffff
lea eax, [ebp - 0x100ec]
mov dword [esp + 4], eax
lea eax, [statbuf.st_mtime]
mov dword [esp], eax
call sym._strncpy
mov byte [ebp - 0x100fd], 0
mov dword [esp + 4], 0x20
lea eax, [statbuf.st_mtime]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x452bfe
mov eax, dword [ebp - 0xe0]
mov byte [eax], 0
lea eax, [ebp - 0x20120]
mov dword [esp + 4], eax
lea eax, [statbuf.st_mtime]
mov dword [esp], eax
call sym._stat
test eax, eax
je 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x801
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x70]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x94]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452dad
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452d12
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x24]
or edx, 1
mov byte [eax + 0x24], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452d4f
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x24]
and edx, 0xfffffffe
mov byte [eax + 0x24], dl
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x80f
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xb0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45326d
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4537b2
mov dword [ebp - 0x10], 0
jmp 0x453244
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xb4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x452fe5
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xdc], 0x4f7299
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
lea edx, [ebp - 0x100f0]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xdc]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.strtok_r
mov dword [ebp - 0x28], eax
jmp 0x452fd6
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test al, al
je 0x452fd6
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xcc]
mov edx, dword [ebp - 0x24]
shl edx, 2
lea ebx, [eax + edx]
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x452f09
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x825
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0x24]
add eax, 2
lea edx, [eax*4]
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xcc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0xcc], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xcc]
test eax, eax
jne 0x452f92
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x826
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xcc]
mov edx, dword [ebp - 0x24]
add edx, 1
shl edx, 2
add eax, edx
mov dword [eax], 0
lea eax, [ebp - 0x100f0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp + 4], eax
mov dword [esp], 0
call dbg.strtok_r
mov dword [ebp - 0x28], eax
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x28], 0
jne 0x452e8b
jmp 0x453240
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xb8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4530f6
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453050
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xd0], 1
jmp 0x453240
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45308d
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xd0], 0
jmp 0x453240
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x833
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x94]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453207
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453161
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x24]
or edx, 1
mov byte [eax + 0x24], dl
jmp 0x453240
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45319e
mov eax, dword [ebp - 0xd0]
movzx edx, byte [eax + 0x24]
and edx, 0xfffffffe
mov byte [eax + 0x24], dl
jmp 0x453240
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x83e
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
mov dword [esp + 0xc], 0x4f71a4
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x843
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
mov eax, 0xffffffff
jmp 0x453adf
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x452e14
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xbc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453363
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x100f4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strtol
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffec
jl 0x4532ee
cmp dword [ebp - 0xd8], 0x13
jg 0x4532ee
mov eax, dword [ebp - 0x100f4]
movzx eax, byte [eax]
test al, al
je 0x45334c
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x84f
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xd8]
mov dword [eax + 0xf4], edx
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4533df
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4537b5
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call dbg.parse_synchronization
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xcc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453462
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4537b8
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.parse_diff
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453556
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x100f8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strtol
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
js 0x4534e6
cmp dword [ebp - 0xd4], 0xf4240
jg 0x4534e6
mov eax, dword [ebp - 0x100f8]
movzx eax, byte [eax]
test al, al
je 0x45353f
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x86d
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
jmp 0x4537b9
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xd4]
mov dword [eax + 0x84], edx
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453699
mov eax, dword [ebp + 0x18]
and eax, 0x1000
test eax, eax
je 0x4535c7
mov eax, dword [ebp - 0xc8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s_option_cant_be_changed_using_centralized_configuration__agent.conf_.
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x874
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
add dword [ebp - 0xc], 1
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x453601
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0xf8], 1
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45363b
mov eax, dword [ebp - 0xd0]
mov byte [eax + 0xf8], 0
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x87e
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x9c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45376e
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.OS_StrIsNum
test eax, eax
jne 0x453745
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x884
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, 0xffffffff
jmp 0x453adf
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._atoi
mov edx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0x64], edx
jmp 0x4537b9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6db8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x88a
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
jmp 0x4537b9
nop
jmp 0x4537b9
nop
jmp 0x4537b9
nop
jmp 0x4537b9
nop
jmp 0x4537b9
nop
add dword [ebp - 0xc], 1
cmp dword [ebp + 0xc], 0
je 0x4537dc
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x45105a
movzx eax, byte [ebp - 0x100ec]
test al, al
je 0x453ada
mov eax, dword [ebp + 0x18]
and eax, 0x1000
test eax, eax
je 0x45380c
mov eax, dword [ebp - 0xd0]
movzx eax, byte [eax + 0xf8]
test al, al
je 0x453a8b
mov dword [ebp - 0x2c], 2
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 4
mov dword [esp], eax
call sym._calloc
mov edx, eax
mov eax, dword [ebp - 0xd0]
mov dword [eax + 0xf0], edx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xf0]
test eax, eax
jne 0x45388c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x895
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
lea eax, [ebp - 0x100fc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4f72e7
lea eax, [ebp - 0x100ec]
mov dword [esp], eax
call dbg.strtok_r
mov eax, dword [ebp - 0xd0]
mov ebx, dword [eax + 0xf0]
lea eax, [ebp - 0x100ec]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x453916
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x897
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xf0]
add eax, 4
mov dword [eax], 0
jmp 0x453a6e
mov eax, dword [ebp - 0x2c]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xf0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov edx, dword [ebp - 0xd0]
mov dword [edx + 0xf0], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xf0]
test eax, eax
jne 0x4539b9
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x89b
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xf0]
mov edx, dword [ebp - 0x2c]
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [ebp - 0x100fc]
mov edx, dword [ebp - 0xd0]
mov edx, dword [edx + 0xf0]
mov ecx, dword [ebp - 0x2c]
add ecx, 0x3fffffff
shl ecx, 2
lea ebx, [edx + ecx]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x453a4c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x89d
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
add dword [ebp - 0x2c], 1
lea eax, [ebp - 0x100fc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4f72e7
mov dword [esp], 0
call dbg.strtok_r
mov eax, dword [ebp - 0x100fc]
test eax, eax
je 0x453ad9
mov eax, dword [ebp - 0x100fc]
movzx eax, byte [eax]
test al, al
jne 0x453930
jmp 0x453ad9
mov eax, dword [ebp - 0xd0]
movzx eax, byte [eax + 0xf8]
xor eax, 1
test al, al
je 0x453ada
mov eax, dword [ebp - 0xc8]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x100ec]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6905_:_Ignoring_prefilter_option__s._Enable___s__to_use_it.
mov dword [esp + 8], str.Read_Syscheck
mov dword [esp + 4], 0x8a2
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
jmp 0x453ada
nop
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret