Function at 0x4c05c2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
mov dword [esp], 0x58a378
call dbg.pthread_rwlock_wrlock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c0617
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50d720
mov dword [esp + 8], str.fim_whodata_initialize
mov dword [esp + 4], 0x21c
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror_exit
mov eax, dword [0x58a2c8]
test eax, eax
je 0x4c062f
mov eax, dword [0x58a2c8]
mov dword [esp], eax
call dbg.OSList_GetFirstNode
jmp 0x4c0634
mov eax, 0
mov dword [ebp - 0x10], eax
jmp 0x4c06cb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
and eax, 0x10000
test eax, eax
je 0x4c06b3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.realtime_adddir
cmp eax, 0xfffffffe
jne 0x4c06b4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
and eax, 0xfffffffd
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
or eax, 4
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
and eax, 0xfffeffff
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
movzx eax, byte [0x58a2c4]
or eax, 0x10
mov byte [0x58a2c4], al
jmp 0x4c06b4
nop
mov eax, dword [0x58a2c8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OSList_GetNext
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c063c
mov dword [esp], 0x58a378
call dbg.pthread_rwlock_unlock
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4c071d
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50d740
mov dword [esp + 8], str.fim_whodata_initialize
mov dword [esp + 4], 0x22a
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror_exit
mov eax, dword [0x58a34c]
test eax, eax
jne 0x4c0784
mov eax, dword [0x58a2cc]
test eax, eax
je 0x4c073e
mov eax, dword [0x58a2cc]
mov dword [esp], eax
call dbg.OSList_GetFirstNode
jmp 0x4c0743
mov eax, 0
mov dword [ebp - 0x10], eax
jmp 0x4c077e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
and eax, 0x10000
test eax, eax
je 0x4c0767
call dbg.whodata_audit_start
jmp 0x4c0784
mov eax, dword [0x58a2cc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OSList_GetNext
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c0748
call dbg.run_whodata_scan
test eax, eax
jne 0x4c0802
lea eax, [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.state_checker@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4c094e
mov dword [esp + 0xc], str._6605_:_Could_not_create_the_Whodata_check_thread.
mov dword [esp + 8], str.fim_whodata_initialize
mov dword [esp + 4], 0x23a
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
mov dword [ebp - 0xc], 0xffffffff
jmp 0x4c094e
mov dword [esp + 0xc], str._6710_:_Failed_to_start_the_Whodata_engine._Directories_files_will_be_monitored_in_Realtime_mode
mov dword [esp + 8], str.fim_whodata_initialize
mov dword [esp + 4], 0x23e
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror
call dbg.audit_restore
mov dword [esp], 0x58a378
call dbg.pthread_rwlock_wrlock
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4c0873
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50d720
mov dword [esp + 8], str.fim_whodata_initialize
mov dword [esp + 4], 0x243
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror_exit
mov eax, dword [0x58a2c8]
test eax, eax
je 0x4c088b
mov eax, dword [0x58a2c8]
mov dword [esp], eax
call dbg.OSList_GetFirstNode
jmp 0x4c0890
mov eax, 0
mov dword [ebp - 0x10], eax
jmp 0x4c08f9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
and eax, 0xfffffffd
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
or eax, 4
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
and eax, 0xfffeffff
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
movzx eax, byte [0x58a2c4]
or eax, 0x10
mov byte [0x58a2c4], al
mov eax, dword [0x58a2c8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OSList_GetNext
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c0895
mov dword [ebp - 0xc], 0xffffffff
mov dword [esp], 0x58a378
call dbg.pthread_rwlock_unlock
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4c094e
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50d740
mov dword [esp + 8], str.fim_whodata_initialize
mov dword [esp + 4], 0x24e
mov dword [esp], str._root_wazuh_4.7.2_src_syscheckd_src_run_check.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
leave
ret