Function at 0x40957b
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1f4
call dbg.enable_dll_verification
mov dword [ebp - 0x14], 0x4ea826
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4ea831
mov dword [esp], 0x4ea837
call dbg.getDefine_Int
mov dword [0x5500b8], eax
mov eax, dword [0x5500b8]
mov dword [ebp - 0x10], eax
jmp 0x4095cd
call dbg.nowDebug
sub dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jne 0x4095c4
mov dword [esp], str.sysinfo
call dbg.so_get_module_handle
mov dword [0x5500bc], eax
mov eax, dword [0x5500bc]
test eax, eax
je 0x409621
mov eax, dword [0x5500bc]
mov dword [esp + 4], str.sysinfo_free_result
mov dword [esp], eax
call dbg.so_get_function_sym
mov dword [0x5500c4], eax
mov eax, dword [0x5500bc]
mov dword [esp + 4], str.sysinfo_networks
mov dword [esp], eax
call dbg.so_get_function_sym
mov dword [0x5500c0], eax
call dbg.w_logging_init
mov dword [esp + 4], 0x4c
mov dword [esp], 1
call sym._calloc
mov dword [0x5701f4], eax
mov eax, dword [0x5701f4]
test eax, eax
jne 0x409690
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ea86c
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x5c
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dbg.File_DateofChange
test eax, eax
jns 0x4096ca
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ea8b4
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x60
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
lea eax, [ebp - 0x1c4]
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x40970d
mov dword [esp + 0xc], str.WSAStartup___failed
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x65
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov dword [esp + 0xc], str.Reading_agent_configuration.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x69
mov dword [esp], str.win32_win_utils.c
call dbg._mdebug1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dbg.ClientConf
test eax, eax
jns 0x40976c
mov dword [esp + 0x10], str._1215_:_No_client_configured._Exiting.
mov dword [esp + 0xc], global___func__.142
mov dword [esp + 8], 0x6b
mov dword [esp + 4], str.win32_win_utils.c
mov dword [esp], 3
call dbg._mlerror_exit
mov eax, dword [0x5701f4]
mov eax, dword [eax]
mov dword [esp], eax
call dbg.Validate_Address
xor eax, 1
test al, al
je 0x4097df
mov eax, dword [0x5701f4]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._4112_:_Invalid_server_address_found:__s
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x6f
mov dword [esp], str.win32_win_utils.c
call dbg._merror
mov dword [esp + 0x10], str._1215_:_No_client_configured._Exiting.
mov dword [esp + 0xc], global___func__.142
mov dword [esp + 8], 0x70
mov dword [esp + 4], str.win32_win_utils.c
mov dword [esp], 3
call dbg._mlerror_exit
mov eax, dword [0x5701f4]
mov eax, dword [eax]
mov dword [esp], eax
call dbg.Validate_IPv6_Link_Local_Interface
xor eax, 1
test al, al
je 0x409845
mov dword [esp + 0xc], str._4114_:_All_server_addresses_are_IPv6_link_local_and_no_interface_to_any__server__block_has_been_configured.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x74
mov dword [esp], str.win32_win_utils.c
call dbg._merror
mov dword [esp + 0x10], str._1215_:_No_client_configured._Exiting.
mov dword [esp + 0xc], global___func__.142
mov dword [esp + 8], 0x75
mov dword [esp + 4], str.win32_win_utils.c
mov dword [esp], 3
call dbg._mlerror_exit
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x40985d
mov eax, dword [0x5701f4]
mov dword [eax + 0x1c], 0xa
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x20]
test eax, eax
jne 0x409875
mov eax, dword [0x5701f4]
mov dword [eax + 0x20], 0x3c
mov eax, dword [0x5701f4]
mov edx, dword [eax + 0x20]
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x1c]
cmp edx, eax
jg 0x4098dc
mov eax, dword [0x5701f4]
mov edx, dword [eax + 0x1c]
mov ecx, dword [0x5701f4]
mov eax, edx
add eax, eax
add eax, edx
mov dword [ecx + 0x20], eax
mov eax, dword [0x5701f4]
mov edx, dword [eax + 0x20]
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Max_time_to_reconnect_cant_be_less_than_notify_time__d___using_notify_time3___d_
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], str.win32_win_utils.c
call dbg._minfo
mov eax, dword [0x5701f4]
mov edx, dword [eax + 0x20]
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Using_notify_time:__d_and_max_time_to_reconnect:__d
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x82
mov dword [esp], str.win32_win_utils.c
call dbg._minfo
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x40997a
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], 1
mov dword [esp], eax
call dbg.w_seconds_to_time_unit
mov ebx, eax
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call dbg.w_seconds_to_time_value
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Using_force_reconnect_interval__Wazuh_Agent_will_reconnect_every__ld__s
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x84
mov dword [esp], str.win32_win_utils.c
call dbg._minfo
mov dword [esp + 0xc], str.Reading_logcollector_configuration.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x89
mov dword [esp], str.win32_win_utils.c
call dbg._mdebug1
call dbg.w_msg_hash_queues_init
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dbg.LogCollectorConfig
test eax, eax
jns 0x4099e5
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4eaac0
mov dword [esp + 0xc], global___func__.142
mov dword [esp + 8], 0x8f
mov dword [esp + 4], str.win32_win_utils.c
mov dword [esp], 3
call dbg._mlerror_exit
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x409a08
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x48]
movzx eax, byte [eax + 0x10]
test al, al
je 0x409a08
call dbg.OS_PassEmptyKeyfile
jmp 0x409a35
call dbg.OS_CheckKeys
test eax, eax
jne 0x409a35
mov dword [esp + 0xc], 0x4eaae8
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x98
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov dword [esp + 0xc], 0x4eab1c
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x9c
mov dword [esp], str.win32_win_utils.c
call dbg._minfo
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0x5701c0
call dbg.OS_ReadKeys
mov eax, dword [0x57ffa8]
test eax, eax
jne 0x409b65
mov dword [esp + 4], 0xa0
mov dword [esp], 2
call sym._calloc
mov dword [0x57ffa8], eax
mov eax, dword [0x57ffa8]
test eax, eax
jne 0x409aec
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ea86c
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xa3
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov eax, dword [0x57ffa8]
mov dword [eax + 0x18], 0
mov eax, dword [0x57ffa8]
mov dword [eax + 0x14], 0
mov eax, dword [0x57ffa8]
mov dword [eax + 0x1c], 0
mov eax, dword [0x57ffa8]
mov dword [eax + 0x90], 0
mov eax, dword [0x57ffa8]
add eax, 0xa0
mov dword [eax + 0x18], 0
mov eax, dword [0x57ffa8]
add eax, 0xa0
mov dword [eax + 0x1c], 0
mov dword [esp + 0xc], str._1905_:_No_file_configured_to_monitor.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xab
mov dword [esp], str.win32_win_utils.c
call dbg._minfo
mov eax, dword [0x57ffb0]
test eax, eax
jne 0x409c46
mov dword [esp + 4], 0x18
mov dword [esp], 2
call sym._calloc
mov dword [0x57ffb0], eax
mov eax, dword [0x57ffb0]
test eax, eax
jne 0x409bdc
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4ea86c
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xb0
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov eax, dword [0x57ffb0]
mov dword [eax], 0
mov eax, dword [0x57ffb0]
mov dword [eax + 4], 0
mov eax, dword [0x57ffb0]
mov dword [eax + 8], 0
mov eax, dword [0x57ffb0]
mov dword [eax + 0xc], 0
mov eax, dword [0x57ffb0]
add eax, 0x18
mov dword [eax], 0
mov eax, dword [0x57ffb0]
add eax, 0x18
mov dword [eax + 4], 0
mov eax, dword [0x57ffb0]
add eax, 0x18
mov dword [eax + 8], 0
mov eax, dword [0x57ffb0]
add eax, 0x18
mov dword [eax + 0xc], 0
call dbg.WinExecdStart
test eax, eax
jne 0x409c5b
mov eax, dword [0x5701f4]
mov dword [eax + 0xc], 0xffffffff
call dbg.sender_init
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
call dbg.os_random
call dbg.wm_children_pool_init
mov eax, dword [0x5701f4]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x409cf7
call dbg.buffer_init
lea eax, [ebp - 0x1c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.dispatch_buffer@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x409d1b
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xcd
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov dword [esp + 0xc], str.Agent_buffer_disabled.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xd4
mov dword [esp], str.win32_win_utils.c
call dbg._minfo
call dbg.w_agentd_state_init
lea eax, [ebp - 0x1c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.state_main@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x409d88
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xd9
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov eax, dword [0x5701f4]
mov dword [eax + 8], 0xffffffff
mov dword [esp + 0xc], str.Creating_thread_mutex.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xe4
mov dword [esp], str.win32_win_utils.c
call dbg._mdebug1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov dword [0x5500b4], eax
mov eax, dword [0x5500b4]
test eax, eax
jne 0x409e0b
mov dword [esp + 0xc], str.Error_creating_mutex.
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xe7
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
lea eax, [ebp - 0x1c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.skthread@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x409e73
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xea
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4eabda
mov dword [esp], 0x4eabe5
call dbg.getDefine_Int
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x409f08
lea eax, [ebp - 0x1c8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.w_rotate_log_thread@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x409f08
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0xf4
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
call dbg.os_setwait
mov dword [esp], 1
call dbg.start_agent
call dbg.os_delwait
mov dword [esp + 4], 0xc
mov dword [esp], 0
call dbg.w_agentd_state_update
call dbg.req_init
lea eax, [ebp - 0x1cc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.receiver_thread@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x409f9f
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x105
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
lea eax, [ebp - 0x1cc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.req_receiver@4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x40a007
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x10d
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
call dbg.wm_config
test eax, eax
jns 0x40a043
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4eaac0
mov dword [esp + 0xc], global___func__.142
mov dword [esp + 8], 0x117
mov dword [esp + 4], str.win32_win_utils.c
mov dword [esp], 3
call dbg._mlerror_exit
call dbg.wm_check
test eax, eax
jne 0x40a0d8
mov eax, dword [0x588a84]
mov dword [ebp - 0xc], eax
jmp 0x40a0d2
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x1cc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x40a0c9
mov dword [esp + 0xc], 0x4eab70
mov dword [esp + 8], global___func__.142
mov dword [esp + 4], 0x11e
mov dword [esp], str.win32_win_utils.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a05a
mov dword [esp], dbg.send_agent_stopped_message
call dbg.atexit
call dbg.LogCollectorStart