Function at 0x44fafc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x84
mov dword [ebp - 0x28], 0x4f6ef4
mov dword [ebp - 0x2c], 0x4f6d58
mov dword [ebp - 0x30], 0x4f6eff
mov dword [ebp - 0x34], 0x4f6f05
mov dword [ebp - 0x38], 0x4f6d58
mov dword [ebp - 0x3c], 0x4f6eff
mov dword [ebp - 0x40], 0x4f6f0f
mov dword [ebp - 0x44], 0x4f6f16
mov dword [ebp - 0x48], 0x4f6796
mov dword [ebp - 0x4c], 0x4f679b
mov dword [ebp - 0x50], 0x4f67a1
mov dword [ebp - 0x54], str.both
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
jmp 0x450d96
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4502b2
mov dword [ebp - 0x5c], 0
mov dword [esp + 4], 1
mov dword [esp], 0x800
call sym._calloc
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x44fc19
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x56e
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0x7ff
mov edx, dword [ebp - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
test eax, eax
jne 0x44fca4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp - 0xc]
lea ecx, [edx*4]
mov edx, dword [ebp + 0x10]
add edx, ecx
mov edx, dword [edx]
mov edx, dword [edx + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Could_not_expand_the_environment_variable__s___ld_
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x571
mov dword [esp], str.config_syscheck_config.c
call dbg._merror
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._free
jmp 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], eax
jmp 0x44fce6
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov edx, eax
mov eax, dword [ebp - 0x18]
mov byte [eax], dl
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test al, al
jne 0x44fcc8
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x5c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4500c7
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4500c7
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4500c7
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x4500c7
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], 0x4f6f5b
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450066
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [esp + 4], str.sregex
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450066
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x44fe77
mov dword [esp + 4], 4
mov dword [esp], 2
call sym._calloc
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x6c], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x44fe53
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x580
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
add eax, 4
mov dword [eax], 0
jmp 0x44ff19
add dword [ebp - 0x14], 1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x44fe73
mov eax, dword [ebp - 0x14]
add eax, 2
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x44ff02
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x589
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 0x14]
add edx, 1
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 0x14]
shl edx, 2
lea ebx, [eax + edx]
mov dword [esp + 4], 0x18
mov dword [esp], 1
call sym._calloc
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x44ff8c
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x590
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Found_nodiff_regex_node__s
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x591
mov dword [esp], str.config_syscheck_config.c
call dbg._mdebug1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.OSMatch_Compile
test eax, eax
jne 0x4500c1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._1450_:_Syntax_error_on_regex:__s:__d.
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x595
mov dword [esp], str.config_syscheck_config.c
call dbg._merror
jmp 0x450e03
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._6679_:_Invalid_attribute__s_for__s_option.
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x59a
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
jmp 0x450e03
nop
jmp 0x4502b2
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call dbg.os_IsStrOnArray
test eax, eax
jne 0x4502b2
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
test eax, eax
jne 0x450195
mov dword [esp + 4], 4
mov dword [esp], 2
call sym._calloc
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x68], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
test eax, eax
jne 0x450171
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5a1
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
add eax, 4
mov dword [eax], 0
jmp 0x450237
add dword [ebp - 0x14], 1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 0x14]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x450191
mov eax, dword [ebp - 0x14]
add eax, 2
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._realloc
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x68], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
test eax, eax
jne 0x450220
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5ab
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 0x14]
add edx, 1
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x68]
mov ecx, dword [ebp - 0x14]
shl ecx, 2
lea ebx, [edx + ecx]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jne 0x4502b2
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5b0
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4507f1
mov dword [ebp - 0x64], 0
mov dword [esp + 4], 1
mov dword [esp], 0x800
call sym._calloc
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x450349
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f66f8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5b7
mov dword [esp], str.config_syscheck_config.c
call dbg._merror_exit
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0x7ff
mov edx, dword [ebp - 0x64]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
test eax, eax
jne 0x4503d4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, dword [ebp - 0xc]
lea ecx, [edx*4]
mov edx, dword [ebp + 0x10]
add edx, ecx
mov edx, dword [edx]
mov edx, dword [edx + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Could_not_expand_the_environment_variable__s___ld_
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5ba
mov dword [esp], str.config_syscheck_config.c
call dbg._merror
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
jmp 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x64]
mov dword [eax + 8], edx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4506c7
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4506c7
mov dword [ebp - 0x24], 0
jmp 0x45067f
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], 0x4f6f5b
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4504c9
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], str.sregex
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4504c9
mov dword [ebp - 0x1c], 1
jmp 0x45067b
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x48]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450618
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x45053b
mov dword [ebp - 0x20], 0
jmp 0x45067b
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450578
mov dword [ebp - 0x20], 1
jmp 0x45067b
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4505b5
mov dword [ebp - 0x20], 2
jmp 0x45067b
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f68c8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5d5
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
jmp 0x450e03
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f68c8
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5d9
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
jmp 0x450e03
add dword [ebp - 0x24], 1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x4506c7
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x24]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x450459
cmp dword [ebp - 0x1c], 0
je 0x450761
cmp dword [ebp - 0x20], 2
je 0x450706
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.dump_registry_nodiff_regex
jmp 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.dump_registry_nodiff_regex
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.dump_registry_nodiff_regex
jmp 0x450d92
cmp dword [ebp - 0x20], 2
je 0x450796
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.dump_registry_nodiff
jmp 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.dump_registry_nodiff
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.dump_registry_nodiff
jmp 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450ac1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x450d8e
mov dword [ebp - 0x10], 0
jmp 0x450a98
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450952
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4508b7
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x48], 1
jmp 0x450a94
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4508ee
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x48], 0
jmp 0x450a94
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x5ff
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450e03
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450a94
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
test eax, eax
je 0x450a40
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.read_data_unit
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x4c]
cmp eax, 0xffffffff
jne 0x450a2a
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x609
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450e03
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x4c]
test eax, eax
jg 0x450a94
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x4c], 1
jmp 0x450a94
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], 0x4f6fb4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x613
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450e03
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x450855
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450d92
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.OS_GetElementsbyNode
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x450d91
mov dword [ebp - 0x10], 0
jmp 0x450d68
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450c22
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f6969
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450b87
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x50], 1
jmp 0x450d64
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4f696d
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450bbe
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x50], 0
jmp 0x450d64
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x62a
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450e03
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x450d64
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
test eax, eax
je 0x450d10
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.read_data_unit
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x54], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jne 0x450cfa
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, ecx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x634
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450e03
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x54]
test eax, eax
jg 0x450d64
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x54], 1
jmp 0x450d64
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], 0x4f6fb4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4f6904
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x63e
mov dword [esp], str.config_syscheck_config.c
call dbg._mwarn
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450e03
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp - 0x58]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x450b25
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dbg.OS_ClearNode
jmp 0x450d92
nop
jmp 0x450d92
nop
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp + 0x10]
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x44fb82
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
test eax, eax
je 0x450e03
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x54]
cmp edx, eax
jge 0x450e03
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x54]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x4c], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x4c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Setting_disk_quota_to__d__disk_quota_must_be_greater_than_file_size
mov dword [esp + 8], str.parse_diff
mov dword [esp + 4], 0x64c
mov dword [esp], str.config_syscheck_config.c
call dbg._mdebug2
mov ebx, dword [ebp - 4]
leave
ret