Function at 0x47f30e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [esp + 4], 0x500718
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], str.buffer
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 4], str.length
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._cJSON_GetObjectItem_8
sub esp, 8
mov dword [ebp - 0x14], eax
movzx eax, byte [0x588b20]
test al, al
jne 0x47f3bb
mov dword [esp + 0x14], str.write
mov dword [esp + 0x10], str._8127_:_At__s:_File_not_opened._Agent_might_have_been_auto_restarted_during_upgrade.
mov dword [esp + 0xc], str.wm_agent_upgrade_com_write
mov dword [esp + 8], 0xfd
mov dword [esp + 4], str.wazuh_modules_agent_upgrade_agent_wm_agent_upgrade_com.c
mov dword [esp], str.wazuh_modulesd:agent_upgrade
call dbg._mterror
mov eax, dword [str.File_not_opened._Agent_might_have_been_auto_restarted_during_upgrade]
mov dword [esp + 4], eax
mov dword [esp], 7
call dbg.wm_agent_upgrade_command_ack
jmp 0x47f5a0
cmp dword [ebp - 0xc], 0
je 0x47f3f0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
cmp eax, 0x10
jne 0x47f3f0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.incoming
lea eax, [ebp - 0x11d]
mov dword [esp], eax
call dbg._jailfile
test eax, eax
jns 0x47f43e
mov dword [esp + 0x14], str.write
mov dword [esp + 0x10], str._8126_:_At__s:_Invalid_file_name.
mov dword [esp + 0xc], str.wm_agent_upgrade_com_write
mov dword [esp + 8], 0x102
mov dword [esp + 4], str.wazuh_modules_agent_upgrade_agent_wm_agent_upgrade_com.c
mov dword [esp], str.wazuh_modulesd:agent_upgrade
call dbg._mterror
mov eax, dword [str.Invalid_file_name]
mov dword [esp + 4], eax
mov dword [esp], 5
call dbg.wm_agent_upgrade_command_ack
jmp 0x47f5a0
lea eax, [ebp - 0x11d]
mov dword [esp + 4], eax
mov dword [esp], 0x588b20
call sym._strcmp
test eax, eax
je 0x47f4ae
mov dword [esp + 0x18], 0x588b20
mov dword [esp + 0x14], str.write
mov dword [esp + 0x10], str._8128_:_At__s:_The_target_file_doesnt_match_the_opened_file__s
mov dword [esp + 0xc], str.wm_agent_upgrade_com_write
mov dword [esp + 8], 0x107
mov dword [esp + 4], str.wazuh_modules_agent_upgrade_agent_wm_agent_upgrade_com.c
mov dword [esp], str.wazuh_modulesd:agent_upgrade
call dbg._mterror
mov eax, dword [str.The_target_file_doesnt_match_the_opened_file]
mov dword [esp + 4], eax
mov dword [esp], 9
call dbg.wm_agent_upgrade_command_ack
jmp 0x47f5a0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call dbg.decode_base64
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
je 0x47f535
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
cmp eax, 8
jne 0x47f535
cmp dword [ebp - 0x18], 0
je 0x47f535
mov eax, dword [0x588c28]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fwrite
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x14]
cmp eax, edx
jne 0x47f535
cmp dword [ebp - 0x18], 0
je 0x47f51e
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x18], 0
mov eax, dword [0x4e9300]
mov dword [esp + 4], eax
mov dword [esp], 0
call dbg.wm_agent_upgrade_command_ack
jmp 0x47f5a0
cmp dword [ebp - 0x18], 0
je 0x47f54d
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x11d]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.write
mov dword [esp + 0x10], str._8129_:_At__s:_Cannot_write_on__s
mov dword [esp + 0xc], str.wm_agent_upgrade_com_write
mov dword [esp + 8], 0x111
mov dword [esp + 4], str.wazuh_modules_agent_upgrade_agent_wm_agent_upgrade_com.c
mov dword [esp], str.wazuh_modulesd:agent_upgrade
call dbg._mterror
mov eax, dword [str.Cannot_write_file]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call dbg.wm_agent_upgrade_command_ack
leave
ret