Function at 0x4bfaab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x380
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x5c]
mov eax, 0
mov ecx, 9
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call sym._memset
call dbg.set_priority_windows_thread
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x58a2a0
mov dword [esp + 8], dbg.w_rootcheck_thread@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
test eax, eax
jne 0x4bfb64
mov dword [esp + 0xc], str._1109_:_Unable_to_create_new_pthread.
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0xe6
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
mov eax, dword [0x58a2d4]
test eax, eax
jne 0x4bfb76
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4bfb80
mov dword [0x58a2bc], 0x93a80
mov dword [esp + 0xc], 0x50d592
mov dword [esp + 8], str._s_file_
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x160]
mov dword [esp], eax
call sym._snprintf_77
lea eax, [ebp - 0x160]
mov dword [esp], eax
call dbg.cldir_ex
cmp eax, 0xffffffff
jne 0x4bfc17
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 2
je 0x4bfc17
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x160]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_clear_directory__s:__s___d_
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0xfa
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
mov dword [esp + 0xc], 0x50d592
mov dword [esp + 8], str._s_registry_
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x264]
mov dword [esp], eax
call sym._snprintf_77
lea eax, [ebp - 0x264]
mov dword [esp], eax
call dbg.cldir_ex
cmp eax, 0xffffffff
jne 0x4bfcae
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 2
je 0x4bfcae
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x264]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_clear_directory__s:__s___d_
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0xff
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
mov dword [esp + 0xc], 0x50d592
mov dword [esp + 8], str._s_local_
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x368]
mov dword [esp], eax
call sym._snprintf_77
lea eax, [ebp - 0x368]
mov dword [esp], eax
call dbg.cldir_ex
cmp eax, 0xffffffff
jne 0x4bfd45
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 2
je 0x4bfd45
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov ebx, dword [eax]
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x368]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_clear_directory__s:__s___d_
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x104
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
mov eax, dword [0x58a2a4]
test eax, eax
jne 0x4c01fd
mov dword [esp + 0xc], str._6000_:_Starting_daemon...
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x10b
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._minfo
mov eax, dword [0x58a2d8]
test eax, eax
je 0x4bfdae
mov eax, dword [0x58a2dc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6342_:_Maximum_number_of_files_to_be_monitored:__u
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x10e
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._mdebug2
jmp 0x4bfdda
mov dword [esp + 0x10], 0x50d63a
mov dword [esp + 0xc], str._6343_:_No_limit_set_to_maximum_number_of__s_entries_to_be_monitored
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x110
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._mdebug2
mov eax, dword [0x58a32c]
test eax, eax
je 0x4bfe12
mov eax, dword [0x58a330]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6370_:_Maximum_number_of_registry_values_to_be_monitored:__u
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x115
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._mdebug2
jmp 0x4bfe3e
mov dword [esp + 0x10], 0x50d6c8
mov dword [esp + 0xc], str._6343_:_No_limit_set_to_maximum_number_of__s_entries_to_be_monitored
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x117
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._mdebug2
mov eax, dword [0x58a2bc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6010_:_File_integrity_monitoring_scan_frequency:__d_seconds
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x11c
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._minfo
call dbg.fim_scan
movzx eax, byte [0x58a2c4]
and eax, 4
test al, al
je 0x4bfe83
call sym._fim_run_integrity
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x58a2a0
mov dword [esp + 8], dbg.fim_run_realtime@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
test eax, eax
jne 0x4bfee4
mov dword [esp + 0xc], str._1109_:_Unable_to_create_new_pthread.
mov dword [esp + 8], str.start_daemon
mov dword [esp + 4], 0x12d
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
movzx eax, byte [0x58a2c4]
and eax, 2
test al, al
je 0x4bfef7
call dbg.fim_whodata_initialize
mov dword [esp], 0
call sym._time_28
mov dword [ebp - 0x14], eax
mov eax, dword [0x58a2d4]
test eax, eax
jne 0x4bff1c
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4c0023
mov dword [esp], 0
call sym._time_28
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dbg.localtime_s
test eax, eax
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
mov eax, dword [tm_result.tm_sec]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._02d:_02d:_02d
mov dword [esp + 4], 9
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call sym._snprintf_77
mov eax, dword [tm_result.tm_min]
mov dword [ebp - 0x10], eax
mov eax, dword [0x58a2d4]
test eax, eax
je 0x4bffcd
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4bffcd
mov eax, dword [0x58a2d4]
mov dword [esp + 4], eax
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call dbg.OS_IsAfterTime
test eax, eax
je 0x4c0022
mov edx, dword [0x58a2d0]
mov eax, dword [tm_result.tm_mon]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OS_IsonDay
test eax, eax
je 0x4c0022
mov dword [ebp - 0xc], 1
jmp 0x4c0022
mov eax, dword [0x58a2d4]
test eax, eax
je 0x4bfff7
mov eax, dword [0x58a2d4]
mov dword [esp + 4], eax
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call dbg.OS_IsAfterTime
test eax, eax
je 0x4c0023
mov dword [ebp - 0xc], 1
jmp 0x4c0023
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4c0023
mov edx, dword [0x58a2d0]
mov eax, dword [tm_result.tm_mon]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OS_IsonDay
test eax, eax
je 0x4c0023
mov dword [ebp - 0xc], 1
jmp 0x4c0023
nop
mov dword [ebp - 0x18], 0
mov dword [esp], 0
call sym._time_28
mov dword [ebp - 0x2c], eax
call dbg.os_check_restart_syscheck
mov dword [ebp - 0x18], eax
mov eax, dword [0x58a2d4]
test eax, eax
jne 0x4c0057
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4c01c8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dbg.localtime_s
test eax, eax
mov eax, dword [tm_result.tm_min]
cmp dword [ebp - 0x10], eax
je 0x4c008c
mov dword [ebp - 0xc], 0
mov eax, dword [tm_result.tm_min]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x4c0128
mov eax, dword [0x58a2d4]
test eax, eax
je 0x4c0128
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4c0128
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
mov eax, dword [tm_result.tm_sec]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._02d:_02d:_02d
mov dword [esp + 4], 9
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call sym._snprintf_77
mov eax, dword [0x58a2d4]
mov dword [esp + 4], eax
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call dbg.OS_IsAfterTime
test eax, eax
je 0x4c01c7
mov edx, dword [0x58a2d0]
mov eax, dword [tm_result.tm_mon]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OS_IsonDay
test eax, eax
je 0x4c01c7
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x18], 1
jmp 0x4c01c7
cmp dword [ebp - 0xc], 0
jne 0x4c018f
mov eax, dword [0x58a2d4]
test eax, eax
je 0x4c018f
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
mov eax, dword [tm_result.tm_sec]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._02d:_02d:_02d
mov dword [esp + 4], 9
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call sym._snprintf_77
mov eax, dword [0x58a2d4]
mov dword [esp + 4], eax
lea eax, [tm_result.tm_yday]
mov dword [esp], eax
call dbg.OS_IsAfterTime
test eax, eax
je 0x4c01c8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 1
jmp 0x4c01c8
cmp dword [ebp - 0xc], 0
jne 0x4c01c8
mov eax, dword [0x58a2d0]
test eax, eax
je 0x4c01c8
mov edx, dword [0x58a2d0]
mov eax, dword [tm_result.tm_mon]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OS_IsonDay
test eax, eax
je 0x4c01c8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 1
jmp 0x4c01c8
nop
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x14]
mov edx, eax
mov eax, dword [0x58a2bc]
cmp edx, eax
jg 0x4c01df
cmp dword [ebp - 0x18], 0
je 0x4c01e7
call dbg.fim_scan
mov dword [ebp - 0x14], eax
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x4c0023
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret