joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, dword [rcx + 0x80]
movsxd rax, edx
mov r12, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
call sym.sqlite3Realloc
mov rdi, rax
test rax, rax
je 0x1400438b8
movsxd rdx, r13d
xor ebp, ebp
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r13d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sym.memset
mov qword [r12 + 0x78], rdi
cmp r13d, esi
jl 0x14004386a
jmp 0x1400438e0
lea rdi, [rax + 8]
mov rcx, rax
mov qword [rax], 0
mov qword [rax + 0x1f8], 0
and rdi, 0xfffffffffffffff8
mov rax, rbp
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r14d
mov qword [rbx + 0x10], rdx
mov rax, qword [r12 + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x140043855
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r13d, 1
add rbx, 0x38
mov dword [r12 + 0x80], r13d
cmp r13d, esi
je 0x1400438e0
mov rax, qword [r12 + 0x50]
mov r14d, dword [r12 + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r14d
je 0x1400438d0
mov rax, qword [r12 + 0x60]
test rax, rax
jle 0x1400438d0
mov qword [rbx], rax
mov eax, dword [r12 + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call sym.sqlite3Malloc
mov rdx, rax
test rax, rax
jne 0x1400437f0
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [r12 + 0xb8]
jmp 0x140043888
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14004b0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [rcx + 0x28]
mov rdi, rdx
mov r12, r8
test ebx, ebx
jle 0x14004b172
mov rsi, qword [rcx + 0x20]
xor r13d, r13d
lea rbp, [0x140176460]
nop dword [rax + rax]
mov r10d, r13d
xor r10d, 1
cmp r13d, 2
cmovge r10d, r13d
movsxd rax, r10d
shl rax, 5
add rax, rsi
mov r9, qword [rax + 0x18]
test r12, r12
je 0x14004b151
mov r8, qword [rax]
xor ecx, ecx
jmp 0x14004b13f
movzx edx, byte [rbp + rdx]
cmp byte [rbp + rax], dl
jne 0x14004b188
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [r12 + rcx]
cmp eax, edx
jne 0x14004b130
test eax, eax
jne 0x14004b13b
lea rcx, [r9 + 0x20]
xor r8d, r8d
mov rdx, rdi
call sym.findElementWithHash
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14004b174
add r13d, 1
cmp r13d, ebx
jne 0x14004b100
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r10d, r10d
jne 0x14004b169
mov r8, r12
lea rcx, str.main
jmp 0x14004b1b3
movzx edx, byte [rbp + rdx]
cmp byte [rbp + rax], dl
jne 0x14004b169
add rcx, 1
add r8, 1
movzx eax, byte [rcx]
movzx edx, byte [r8]
cmp eax, edx
jne 0x14004b1a0
test eax, eax
jne 0x14004b1ab
jmp 0x14004b151
Function at 0x140056370
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor ebp, ebp
movzx r13d, byte [rcx + 0x5b]
mov rsi, r13
sub r13d, 1
mov byte [rcx + 0x58], 1
mov r12, rcx
test r13d, r13d
jg 0x1400563b3
jmp 0x1400563fc
cmp qword [rbx + 0x60], 0
je 0x140056400
add ebp, 1
cmp ebp, r13d
je 0x1400564c0
movzx eax, byte [r12 + 0x5a]
lea eax, [rbp + rax + 1]
cdq
idiv r13d
movsxd rdx, edx
lea rbx, [rdx + rdx*2]
lea rcx, [rdx + rdx*2 + 3]
shl rbx, 5
shl rcx, 5
add rbx, r12
lea rdi, [r12 + rcx]
mov eax, dword [rbx + 0x68]
test eax, eax
je 0x1400563a0
mov rcx, rdi
call sym.vdbeSorterJoinThread
test eax, eax
je 0x1400563a0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edi, edi
nop
cmp ebp, r13d
je 0x1400564c0
lea rdx, [r12 + 0x60]
mov rax, rdi
mov rcx, qword [rdi + 0x28]
movdqu xmm0, xmmword [r12 + 0x38]
sub rax, rdx
movabs rdx, 0xaaaaaaaaaaaaaaab
sar rax, 5
imul rax, rdx
mov byte [r12 + 0x5a], al
mov rax, qword [r12 + 0x48]
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi + 0x30], rax
mov qword [r12 + 0x38], 0
mov qword [r12 + 0x48], 0
test rcx, rcx
je 0x140056490
mov qword [r12 + 0x40], rcx
call qword [0x14014eeb8]
mov dword [r12 + 0x54], eax
mov r8, rdi
lea rdx, [sym.vdbeSorterFlushThread]
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.sqlite3ThreadCreate
cmp qword [r12 + 0x40], 0
je 0x14005646a
movsxd rcx, dword [r12 + 0x54]
call sym.sqlite3Malloc
mov qword [r12 + 0x40], rax
test rax, rax
jne 0x14005646a
mov eax, 7
jmp 0x1400563ef
lea rcx, [rsi + rsi*2]
lea rdx, [r12 + 0x38]
shl rcx, 5
add rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.vdbeSorterListToPMA
Function at 0x14005db70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov rax, rcx
mov r10, rdx
movzx ecx, byte [r8 + 8]
mov rsi, r8
mov rdi, r9
cmp byte [rax + 0x16], cl
jne 0x14005dbc0
mov rcx, qword [r8 + 0x10]
mov r8, qword [r10 + 8]
mov edx, dword [rax + 0x10]
mov r9d, dword [r10 + 0x10]
mov qword [rsp + 0x20], r8
mov r8, qword [rax + 8]
call qword [rsi + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rax + 0x18]
movdqu xmm0, xmmword [rax]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x98], rdx
mov rdx, qword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdx
movzx edx, word [rax + 0x14]
test dh, 0x20
jne 0x14005dc0a
and dh, 0x8f
or dh, 0x40
mov word [rsp + 0x54], dx
mov rax, qword [r10 + 0x10]
movdqu xmm1, xmmword [r10]
mov qword [rsp + 0x90], rax
movzx eax, word [r10 + 0x14]
movups xmmword [rsp + 0x80], xmm1
test ah, 0x20
jne 0x14005dc3b
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x94], ax
xor ebx, ebx
and edx, 1
movzx eax, cl
jne 0x14005dc5a
lea rcx, [rsp + 0x40]
mov edx, eax
call sym.valueToText
mov rbx, rax
movzx eax, byte [rsi + 8]
mov ecx, eax
movzx edx, word [rsp + 0x94]
mov r8d, edx
and r8w, 0x202
cmp r8w, 0x202
je 0x14005dd00
and edx, 1
jne 0x14005dcf0
lea rcx, [rsp + 0x80]
mov edx, eax
call sym.valueToText
test rbx, rbx
je 0x14005dcf0
test rax, rax
je 0x14005dcf0
mov rcx, qword [rsi + 0x10]
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov r9d, dword [rsp + 0x90]
call qword [rsi + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x14005dd20
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x14005dbab
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x14005dcf8
mov byte [rdi], 7
xor eax, eax
jmp 0x14005dcb0
cmp cl, byte [rsp + 0x96]
jne 0x14005dc77
mov rax, qword [rsp + 0x88]
jmp 0x14005dc8b
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
jmp 0x14005dcb8
Function at 0x14005dd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
movzx r9d, word [rcx + 0x14]
movzx r10d, word [rdx + 0x14]
mov eax, r9d
or eax, r10d
test al, 1
jne 0x14005ddb0
test al, 0x2c
je 0x14005dd88
mov eax, r9d
and eax, r10d
test al, 0x24
jne 0x14005ddc8
test al, 8
je 0x14005dde0
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x14005ddf2
xor eax, eax
comisd xmm1, xmm0
seta al
jmp 0x14005ddbe
test al, 2
je 0x14005dda1
and r9d, 2
je 0x14005de00
and r10d, 2
je 0x14005ddf2
test r8, r8
jne 0x14005de38
add rsp, 0x28
jmp sym.sqlite3BlobCompare
and r10d, 1
and r9d, 1
mov eax, r10d
sub eax, r9d
add rsp, 0x28
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x14005ddf2
setg al
movzx eax, al
add rsp, 0x28
ret
test r9b, 0x24
je 0x14005de10
test r10b, 8
jne 0x14005de48
and r10d, 0x24
jne 0x14005ddc8
mov eax, 0xffffffff
jmp 0x14005ddbe
mov eax, 1
jmp 0x14005ddbe
and r9d, 8
mov eax, 1
je 0x14005ddbe
and r10d, 0x24
je 0x14005ddf2
mov rax, qword [rdx]
movsd xmm1, qword [rcx]
mov rcx, rax
call sym.sqlite3IntFloatCompare
neg eax
jmp 0x14005ddbe
xor r9d, r9d
add rsp, 0x28
jmp sym.vdbeCompareMemString
mov rcx, qword [rcx]
movsd xmm1, qword [rdx]
add rsp, 0x28
jmp sym.sqlite3IntFloatCompare

Function at 0x1400604c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rdi, [0x14016dbe0]
mov rax, qword [rcx + 8]
mov r13, rcx
mov esi, edx
mov rcx, qword [rax + 8]
mov r15, r8
mov rdx, qword [r13 + 0x18]
movsxd rax, dword [r13 + 0x20]
shl rax, 5
add rax, qword [rdx + 0x88]
mov rdx, qword [r8]
mov rbp, qword [rax - 0x10]
movzx eax, word [rdx + 0x14]
and eax, 0x3f
cmp byte [rdi + rax], 5
je 0x140060558
cmp esi, 1
jle 0x140060577
neg rcx
mov ebx, 1
sbb r12d, r12d
xor r14d, r14d
jmp 0x140060547
movsxd rax, r14d
mov r8, rbp
mov rcx, qword [r15 + rax*8]
call sym.sqlite3MemCompare
xor eax, r12d
cmovns r14d, ebx
add rbx, 1
cmp rsi, rbx
je 0x140060570
mov rdx, qword [r15 + rbx*8]
movzx eax, word [rdx + 0x14]
and eax, 0x3f
cmp byte [rdi + rax], 5
jne 0x140060528
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd r14, r14d
mov rdx, qword [r15 + r14*8]
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3_result_value
Function at 0x140064820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r15d, dword [rsp + 0xb0]
mov rdi, qword [rcx + 0x10]
mov r12, qword [rsp + 0xb8]
mov ebp, dword [rsp + 0xc0]
mov dword [rsp + 0x3c], edx
mov rsi, rcx
mov rcx, qword [rcx]
mov r13d, r8d
lea edx, [r15*8 + 0x30]
mov r14d, r9d
movsxd rdx, edx
call sym.sqlite3DbMallocRawNN
mov rbx, rax
test rax, rax
je 0x140064918
mov qword [rax], 0
cmp ebp, 1
mov r9d, r13d
mov rcx, rdi
mov qword [rax + 8], r12
mov r8d, dword [rsp + 0x3c]
mov edx, 0x41
mov qword [rax + 0x18], 0
adc edx, 0
mov dword [rax + 0x24], 0
mov byte [rax + 0x2a], r15b
mov eax, dword [rdi + 0x90]
mov dword [rbx + 0x20], eax
mov dword [rsp + 0x20], r14d
call sym.sqlite3VdbeAddOp3
mov r9d, 0xfffffff1
mov r8, rbx
mov rcx, rdi
mov edx, eax
call sym.sqlite3VdbeChangeP4
movsxd rax, dword [rdi + 0x90]
test eax, eax
jle 0x1400648ee
shl rax, 5
and ebp, 0x2e
add rax, qword [rdi + 0x88]
mov word [rax - 0x1e], bp
mov rax, qword [rsi + 0xb0]
test rax, rax
cmove rax, rsi
mov byte [rax + 0x21], 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test byte [r12 + 4], 0x10
je 0x140064900
mov rcx, qword [rsi]
mov rdx, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3DbNNFreeNN
Function at 0x140088600
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, qword [rsp + 0x90]
mov dword [rdi], 0
mov dword [rsp + 0x2c], 0
mov r12d, edx
mov rsi, r8
mov r13d, r9d
test rcx, rcx
je 0x1400886cd
mov edx, r9d
sub edx, 1
js 0x14008872d
movsxd rbp, r9d
movsxd rax, edx
mov edx, edx
lea r10, [r8 + rbp - 2]
add rax, r8
sub r10, rdx
mov edx, 0xd
nop word [rax + rax]
movsx r9d, byte [rax]
lea r8d, [rdx*8]
sub rax, 1
xor r8d, r9d
xor edx, r8d
cmp r10, rax
jne 0x140088660
lea eax, [rdx*8]
xor edx, eax
xor edx, r12d
and edx, 0x1ff
lea r14, [rcx + rdx*8]
mov rbx, qword [r14]
test rbx, rbx
jne 0x1400886a9
jmp 0x1400886e0
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400886e0
cmp dword [rbx + 0xc], r12d
jne 0x1400886a0
cmp dword [rbx + 8], r13d
jne 0x1400886a0
mov rcx, qword [rbx]
mov r8, rbp
mov rdx, rsi
call sym.memcmp
test eax, eax
jne 0x1400886a0
mov dword [rdi], 1
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x2c]
call sym.sqlite3Fts5MallocZero
mov rbx, rax
test rax, rax
je 0x14008871a
lea rcx, [rax + 0x18]
mov dword [rax + 8], r13d
mov r8, rbp
mov rdx, rsi
mov qword [rax], rcx
mov dword [rax + 0xc], r12d
call sym.memcpy
mov rax, qword [r14]
mov qword [rbx + 0x10], rax
mov qword [r14], rbx
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0x68
mov edx, 0xd
movsxd rbp, r9d
jmp 0x140088682

Function at 0x1400937b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x14014efd4]
mov ebx, ecx
mov rsi, rdx
test eax, eax
jne 0x140093800
call sym.sqlite3MutexInit
test eax, eax
jne 0x1400937f0
call sym.sqlite3_initialize.part.0
test eax, eax
jne 0x1400937f0
mov rdx, rsi
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.sqlite3_randomness.part.0
add rsp, 0x28
pop rbx
pop rsi
ret
lock or qword [rsp], 0
mov rdx, rsi
mov ecx, ebx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.sqlite3_randomness.part.0
Function at 0x1400ba470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
jne 0x1400ba4a8
movzx eax, byte [rcx + 0x10]
test al, al
je 0x1400ba4a8
cmp al, 1
je 0x1400ba4b0
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
test r8, r8
je 0x1400ba49e
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
jne 0x1400ba4d0
xor eax, eax
ret
jmp sym.btreeBeginTrans
test edx, edx
jne 0x1400ba4a8
test r8, r8
je 0x1400ba4a2
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
jmp 0x1400ba4a2
mov rcx, qword [rcx]
mov edx, dword [r9 + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x1400ba4a2
cmp byte [rcx + 0xa], 0
je 0x1400ba4a2
jmp sym.pagerOpenSavepoint
Function at 0x1400d41b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movups xmmword [rsp + 0x50], xmm6
movzx eax, byte [rdx]
mov rsi, rdx
mov rbx, rcx
mov edx, eax
cmp al, 0xb0
jne 0x1400d41d8
movzx edx, byte [rsi + 2]
cmp dl, 0xb1
je 0x1400d4300
cmp dl, 0x8a
je 0x1400d4210
movups xmm6, xmmword [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3ExprCodeTemp
mov rdx, qword [rsi + 0x20]
mov rdx, qword [rdx + 0x20]
mov edi, dword [rdx]
cmp edi, 1
je 0x1400d41e6
mov dword [r8], 0
cmp al, 0x8a
je 0x1400d4310
mov eax, dword [rbx + 0x38]
lea ebp, [rax + 1]
add eax, edi
mov dword [rbx + 0x38], eax
test edi, edi
jle 0x1400d42e7
lea rax, [sym.sqlite3SelectWalkFail]
lea rcx, [sym.exprNodeIsConstant]
xor r13d, r13d
movq xmm6, rcx
movq xmm0, rax
lea r12, [rsp + 0x20]
punpcklqdq xmm6, xmm0
jmp 0x1400d429a
mov rdx, r14
mov rcx, r12
call sym.sqlite3WalkExprNN
cmp word [rsp + 0x44], 0
jne 0x1400d42d0
mov r8d, r15d
mov rdx, r14
mov rcx, rbx
add r13d, 1
call sym.sqlite3ExprCodeCopy
cmp r13d, edi
je 0x1400d42e7
movsxd rax, r13d
lea r15d, [rbp + r13]
shl rax, 5
add rax, qword [rsi + 0x20]
cmp byte [rbx + 0x23], 0
mov r14, qword [rax + 8]
je 0x1400d4283
mov eax, 2
mov dword [rsp + 0x48], 0
mov word [rsp + 0x44], ax
movups xmmword [rsp + 0x28], xmm6
test r14, r14
jne 0x1400d4270
mov r8d, r15d
mov rdx, r14
mov rcx, rbx
add r13d, 1
call sym.sqlite3ExprCodeRunJustOnce
cmp r13d, edi
jne 0x1400d429a
movups xmm6, xmmword [rsp + 0x50]
mov eax, ebp
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsi + 0x20]
mov edi, dword [rdx]
jmp 0x1400d421a
movups xmm6, xmmword [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3CodeSubselect
Function at 0x1400d7890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r14, qword [rcx + 0x58]
mov r13d, r8d
mov rdi, rcx
mov rsi, rdx
mov ebp, r8d
shr r13d, 0x1f
test r14, r14
je 0x1400d7928
test r13b, r13b
je 0x1400d7928
mov eax, dword [r14]
lea rbx, [r14 + 8]
test eax, eax
jle 0x1400d7928
sub eax, 1
shl rax, 5
lea r12, [r14 + rax + 0x28]
jmp 0x1400d78e1
add rbx, 0x20
cmp r12, rbx
je 0x1400d7928
test byte [rbx + 0x14], 8
je 0x1400d78d8
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400d79c8
test rsi, rsi
je 0x1400d79c8
xor ecx, ecx
mov r9d, 0xffffffff
mov r8, rsi
call sym.sqlite3ExprCompare.part.0
test eax, eax
jne 0x1400d78d8
mov eax, dword [rbx + 0x18]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rdi]
test rsi, rsi
je 0x1400d79c0
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call sym.exprDup
mov rbx, rax
test rax, rax
je 0x1400d79c0
test byte [rax + 4], 8
jne 0x1400d79e0
mov rdx, r14
mov r8, rbx
mov rcx, rdi
call sym.sqlite3ExprListAppend
mov rdx, rax
mov eax, ebp
test rdx, rdx
je 0x1400d79a9
mov eax, dword [rdx]
shl r13d, 3
sub eax, 1
cdqe
mov rcx, rax
shl rcx, 5
lea r8, [rdx + rcx + 0x10]
movzx ecx, byte [r8 + 0xc]
and ecx, 0xfffffff7
or ecx, r13d
mov byte [r8 + 0xc], cl
test ebp, ebp
jns 0x1400d799f
mov esi, dword [rdi + 0x38]
lea ebp, [rsi + 1]
mov dword [rdi + 0x38], ebp
shl rax, 5
mov dword [rdx + rax + 0x20], ebp
mov eax, ebp
mov qword [rdi + 0x58], rdx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ebx, ebx
jmp 0x1400d7954
cmp rdx, rsi
jne 0x1400d78d8
mov eax, dword [rbx + 0x18]
jmp 0x1400d7913
mov rsi, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf
mov dword [rsp + 0x20], 0
mov rcx, rsi
call sym.sqlite3VdbeAddOp3
mov rcx, qword [rdi]
mov byte [rdi + 0x23], 0
mov r12d, eax
mov eax, ebp
cmp byte [rcx + 0x67], 0
jne 0x1400d7a35
test ebp, ebp
js 0x1400d7a80
cmp qword [rdi + 0x10], 0
je 0x1400d7a35
mov r8d, eax
mov rcx, rdi
mov rdx, rbx
mov dword [rsp + 0x3c], eax
call sym.sqlite3ExprCode.part.0
mov rcx, qword [rdi]
mov eax, dword [rsp + 0x3c]
mov byte [rdi + 0x23], 1
mov rdx, rbx
mov dword [rsp + 0x3c], eax
call sym.sqlite3ExprDeleteNN
mov r8, qword [rsi]
mov eax, dword [rsp + 0x3c]
lea rdx, [0x14018a240]
mov ecx, dword [rsi + 0x90]
cmp byte [r8 + 0x67], 0
jne 0x1400d7a6e
movsxd rdx, r12d
shl rdx, 5
add rdx, qword [rsi + 0x88]
mov dword [rdx + 8], ecx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [rdi + 0x38]
add eax, 1
mov dword [rdi + 0x38], eax
jmp 0x1400d7a15
Function at 0x1400d7a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [rcx + 0x23], 0
mov rbx, rcx
je 0x1400d7afc
mov eax, 2
lea rcx, [sym.exprNodeIsConstant]
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rcx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
test rdx, rdx
je 0x1400d7b10
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x20], rdx
call sym.sqlite3WalkExprNN
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rsp + 0x2c]
jne 0x1400d7b10
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp sym.sqlite3ExprCodeCopy
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp sym.sqlite3ExprCodeRunJustOnce

Function at 0x1400d8510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rcx
mov rsi, r8
test rdx, rdx
jne 0x1400d8535
jmp 0x1400d854f
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400d854f
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x1400d85b0
test eax, 0x80000
jne 0x1400d8528
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x1400d8535
movzx eax, byte [rbx + 0x1f]
test al, al
je 0x1400d8640
sub eax, 1
mov byte [rbx + 0x1f], al
movzx eax, al
mov edi, dword [rbx + rax*4 + 0xe8]
mov r8d, edi
mov rcx, rbx
call sym.sqlite3ExprCodeTarget
cmp eax, edi
je 0x1400d8630
test edi, edi
jne 0x1400d8590
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
movzx edx, byte [rbx + 0x1f]
cmp dl, 7
ja 0x1400d8582
lea ecx, [rdx + 1]
mov byte [rbx + 0x1f], cl
mov dword [rbx + rdx*4 + 0xe8], edi
jmp 0x1400d8582
cmp byte [rbx + 0x23], 0
je 0x1400d854f
cmp byte [rdx], 0xb0
je 0x1400d854f
mov eax, 2
lea rcx, [rsp + 0x30]
lea rdi, [sym.exprNodeIsConstant]
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rdi
movq xmm1, rax
mov dword [rsp + 0x58], 0
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call sym.sqlite3WalkExprNN
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x1400d854f
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
jmp sym.sqlite3ExprCodeRunJustOnce
mov dword [rsi], edi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x38]
lea edi, [rax + 1]
mov dword [rbx + 0x38], edi
jmp 0x1400d856b
Function at 0x1400d8650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov r11, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r10, rcx
movzx ecx, byte [rdx]
cmp cl, 0xb0
je 0x1400d8678
cmp cl, 0x8a
je 0x1400d86c0
xor eax, eax
cmp cl, 0xb1
je 0x1400d86a0
pop rbx
ret
movzx eax, byte [rdx + 2]
cmp al, 0xb1
je 0x1400d8700
mov rcx, rdx
cmp al, 0x8a
je 0x1400d86e0
mov eax, dword [rdx + 0x2c]
mov qword [r11], rcx
add eax, r8d
pop rbx
ret
movsxd rax, r8d
mov rcx, r10
mov r8, rbx
shl rax, 5
add rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
mov qword [r11], rdx
pop rbx
jmp sym.sqlite3ExprCodeTemp
mov rdx, qword [rdx + 0x20]
movsxd rax, r8d
shl rax, 5
add rax, qword [rdx + 0x20]
mov rax, qword [rax + 8]
mov qword [r11], rax
lea eax, [r8 + r9]
pop rbx
ret
mov rax, qword [rdx + 0x20]
mov r9, qword [rax + 0x20]
cmp dword [r9], 1
jle 0x1400d868b
movsxd rax, r8d
shl rax, 5
mov rcx, qword [r9 + rax + 8]
jmp 0x1400d868b
mov rcx, qword [rdx + 0x20]
cmp dword [rcx], 1
jle 0x1400d871a
movsxd rax, r8d
shl rax, 5
mov rcx, qword [rcx + rax + 8]
jmp 0x1400d868b
mov rcx, rdx
jmp 0x1400d868b