Function at 0x1400c4120
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea rax, vtable.ServiceThread.0
mov qword [rcx], rax
xor r15d, r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov dword [rcx + 0x20], r15d
mov qword [rcx + 0x28], r15
add rcx, 0x30
mov edx, 0x80000400
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSectionAndSpinCount]
or rbx, 0xffffffffffffffff
mov dword [r14 + 0x58], ebx
lea rax, vtable.UsnJournalThread.0
mov qword [r14], rax
mov qword [r14 + 0x60], rdi
mov qword [r14 + 0x68], rsi
mov rsi, qword [rsp + 0x80]
mov qword [r14 + 0x70], rsi
mov qword [r14 + 0x78], rbp
mov rax, qword [rsp + 0x88]
mov qword [r14 + 0x80], rax
mov eax, dword [rsp + 0x90]
mov dword [r14 + 0x88], eax
mov dword [r14 + 0x8c], 0x3e8
mov qword [r14 + 0x90], rbx
mov qword [r14 + 0x98], r15
mov qword [r14 + 0xa0], r15
mov qword [r14 + 0xa8], r15
mov qword [r14 + 0xb0], r15
mov qword [r14 + 0xc8], r15
xor eax, eax
mov qword [r14 + 0xd0], rax
mov qword [r14 + 0xd8], rax
mov qword [r14 + 0xe0], rax
mov qword [r14 + 0xe8], rax
mov qword [r14 + 0xf0], rax
lea rdi, [r14 + 0xf8]
mov qword [rsp + 0x80], rdi
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov rcx, rdi
call fcn.1400c48a0
mov qword [rdi], rax
mov qword [r14 + 0x108], rbx
mov qword [r14 + 0xdf8], r15
mov qword [r14 + 0xe00], r15
mov qword [r14 + 0xe08], r15
mov qword [r14 + 0xe10], r15
mov qword [r14 + 0xe18], r15
lea rcx, [r14 + 0xe20]
call fcn.14007a090
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [r14 + 0xe40]
call fcn.14019bdd0
mov qword [r14 + 0x1048], r15
mov qword [r14 + 0x1050], r15
mov qword [r14 + 0x1058], r15
mov qword [r14 + 0x1060], r15
mov qword [r14 + 0x1068], r15
mov qword [r14 + 0x1070], r15
mov qword [r14 + 0x1078], r15
mov dword [r14 + 0x1080], r15d
mov byte [r14 + 0x1088], r15b
lea rcx, [r14 + 0x1090]
mov edx, 0x80000400
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSectionAndSpinCount]
nop
mov rcx, qword [r14 + 0x60]
lea r12, vtable.SqliteStatement.0
mov qword [r14 + 0x10b8], r12
mov dword [r14 + 0x10c0], r15d
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, r15
mov qword [r14 + 0x10c8], rax
lea rdx, str.SELECT_FILE_ID_FROM_PINNED_APPLICATIONS_WHERE_PIN_ACTION__1
mov qword [r14 + 0x10d0], rdx
mov qword [r14 + 0x10d8], r15
mov qword [r14 + 0x10e0], r15
mov byte [r14 + 0x10e8], r15b
lea r8d, [r15 + 6]
lea rcx, [0x1402441c0]
call fcn.1401a7c50
test eax, eax
jne 0x1400c4349
mov byte [r14 + 0x10e8], 1
lea rbp, vtable.TransactionSafeStatement.0
mov qword [r14 + 0x10b8], rbp
mov rcx, qword [r14 + 0x60]
mov qword [r14 + 0x10f0], r12
mov dword [r14 + 0x10f8], r15d
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, r15
mov qword [r14 + 0x1100], rax
lea rdx, str.SELECT_FILE_ID__PATH_FROM_PINNED_APPLICATIONS_WHERE_PIN_ACTION__2
mov qword [r14 + 0x1108], rdx
mov qword [r14 + 0x1110], r15
mov qword [r14 + 0x1118], r15
mov byte [r14 + 0x1120], 0
mov r8d, 6
lea rcx, [0x1402441c0]
call fcn.1401a7c50
test eax, eax
jne 0x1400c43bd
mov byte [r14 + 0x1120], 1
mov qword [r14 + 0x10f0], rbp
mov rdx, qword [r14 + 0x60]
mov qword [r14 + 0x1128], r12
mov dword [r14 + 0x1130], r15d
lea rax, [rdx + 0x10]
test rdx, rdx
cmove rax, r15
mov qword [r14 + 0x1138], rax
lea rdx, str.SELECT_FILE_ID__PATH_FROM_PINNED_APPLICATIONS_WHERE_PIN_ACTION__3
mov qword [r14 + 0x1140], rdx
mov qword [r14 + 0x1148], r15
mov qword [r14 + 0x1150], r15
mov byte [r14 + 0x1158], 0
mov r8d, 6
lea rcx, [0x1402441c0]
call fcn.1401a7c50
test eax, eax
jne 0x1400c442a
mov byte [r14 + 0x1158], 1
mov qword [r14 + 0x1128], rbp
lea rax, str.P_a_
mov rcx, qword [str.P_a_]
cmp rcx, rax
je 0x1400c4468
test dword [rcx + 0x44], 0x20000
je 0x1400c4468
cmp byte [rcx + 0x41], 3
jb 0x1400c4468
mov edx, 0xa
lea r8, [0x14021d598]
mov rcx, qword [rcx + 0x38]
call fcn.140022ad0
mov rcx, r14
call fcn.1400c5ce0
mov qword [r14 + 0x90], rax
lea r8, [rsi + 0x68]
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [r8 + rbx*2], 0
jne 0x1400c4480
lea r9, [rbx + rbx]
mov edx, 0x208
lea rcx, [r14 + 0xe40]
call fcn.1400c9100
mov word [r14 + rbx*2 + 0xe40], r15w
mov rcx, r14
call fcn.1400c7940
nop
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret