Function at 0x140094540
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor edx, edx
call fcn.1400d14d0
nop
mov qword [r14 + 0x58], rbx
mov qword [r14 + 0x60], rdi
lea rax, [rsi + 0x98]
xor ebp, ebp
test rsi, rsi
cmove rax, rbp
mov qword [r14 + 0x68], rax
lea rax, vtable.ServiceNtfsMftScanner.0
mov qword [r14], rax
lea rax, vtable.ServiceNtfsMftScanner.1.0
mov qword [r14 + 0x40], rax
lea rax, vtable.ServiceNtfsMftScanner.2.0
mov qword [r14 + 0x48], rax
lea rax, vtable.ServiceNtfsMftScanner.3.0
mov qword [r14 + 0x50], rax
lea rax, str.mft_scanning_state
mov qword [r14 + 0x70], rax
mov dword [r14 + 0x78], 2
mov qword [r14 + 0x80], rbx
mov qword [r14 + 0x88], rdi
mov qword [r14 + 0x90], rsi
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x98], rax
lea rcx, [r14 + 0xa0]
mov rdx, rsi
call fcn.1400bcac0
lea rax, vtable.ServiceThread.0
mov qword [r14 + 0x128], rax
mov qword [r14 + 0x130], rbp
mov qword [r14 + 0x138], rbp
mov qword [r14 + 0x140], rbp
mov dword [r14 + 0x148], ebp
mov qword [r14 + 0x150], rbp
lea rcx, [r14 + 0x158]
mov edx, 0x80000400
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
mov dword [r14 + 0x180], 0xffffffff
lea rax, vtable.ServiceNtfsMftScanner::ServiceNtfsMftScannerThread.0
mov qword [r14 + 0x128], rax
mov qword [r14 + 0x188], r14
mov qword [r14 + 0x190], rbp
mov rax, qword [r14 + 0x80]
add rax, 0x10
lea rdi, vtable.SqliteStatement.0
mov qword [r14 + 0x198], rdi
mov dword [r14 + 0x1a0], ebp
mov qword [r14 + 0x1a8], rax
lea rdx, str.UPDATE_FILES_SET_DIRTY__1_WHERE_FILE_ID_IN__SELECT_FILE_ID_FROM_FILES_WHERE_DIRTY____1_LIMIT__param_
mov qword [r14 + 0x1b0], rdx
mov qword [r14 + 0x1b8], rbp
mov qword [r14 + 0x1c0], rbp
mov byte [r14 + 0x1c8], bpl
lea r8d, [rbp + 6]
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x1400946c5
mov byte [r14 + 0x1c8], 1
lea rbx, vtable.TransactionSafeStatement.0
mov qword [r14 + 0x198], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x1d0], rdi
mov dword [r14 + 0x1d8], ebp
mov qword [r14 + 0x1e0], rax
lea rdx, str.UPDATE_HIERARCHY_SET_DIRTY__1_WHERE___rowid___IN__SELECT___rowid___FROM_HIERARCHY_WHERE_DIRTY____1_LIMIT__param_
mov qword [r14 + 0x1e8], rdx
mov qword [r14 + 0x1f0], rbp
mov qword [r14 + 0x1f8], rbp
mov byte [r14 + 0x200], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x140094734
mov byte [r14 + 0x200], 1
mov qword [r14 + 0x1d0], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x208], rdi
mov dword [r14 + 0x210], ebp
mov qword [r14 + 0x218], rax
lea rdx, str.SELECT_COUNT___FROM_HIERARCHY_WHERE_DIRTY__0
mov qword [r14 + 0x220], rdx
mov qword [r14 + 0x228], rbp
mov qword [r14 + 0x230], rbp
mov byte [r14 + 0x238], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x14009479c
mov byte [r14 + 0x238], 1
mov qword [r14 + 0x208], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x240], rdi
mov dword [r14 + 0x248], ebp
mov qword [r14 + 0x250], rax
lea rdx, str.SELECT_COUNT___FROM_FILES_WHERE_DIRTY__0
mov qword [r14 + 0x258], rdx
mov qword [r14 + 0x260], rbp
mov qword [r14 + 0x268], rbp
mov byte [r14 + 0x270], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x140094804
mov byte [r14 + 0x270], 1
mov qword [r14 + 0x240], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x278], rdi
mov dword [r14 + 0x280], ebp
mov qword [r14 + 0x288], rax
lea rdx, str.SELECT_COUNT___FROM_HIERARCHY
mov qword [r14 + 0x290], rdx
mov qword [r14 + 0x298], rbp
mov qword [r14 + 0x2a0], rbp
mov byte [r14 + 0x2a8], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x14009486c
mov byte [r14 + 0x2a8], 1
mov qword [r14 + 0x278], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x2b0], rdi
mov dword [r14 + 0x2b8], ebp
mov qword [r14 + 0x2c0], rax
lea rdx, [0x1402311d8]
mov qword [r14 + 0x2c8], rdx
mov qword [r14 + 0x2d0], rbp
mov qword [r14 + 0x2d8], rbp
mov byte [r14 + 0x2e0], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x1400948d4
mov byte [r14 + 0x2e0], 1
mov qword [r14 + 0x2b0], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x2e8], rdi
mov dword [r14 + 0x2f0], ebp
mov qword [r14 + 0x2f8], rax
lea rdx, str.DELETE_FROM_HIERARCHY_WHERE___rowid___IN__SELECT___rowid___FROM_HIERARCHY_WHERE_DIRTY__1_LIMIT__param_
mov qword [r14 + 0x300], rdx
mov qword [r14 + 0x308], rbp
mov qword [r14 + 0x310], rbp
mov byte [r14 + 0x318], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x14009493c
mov byte [r14 + 0x318], 1
mov qword [r14 + 0x2e8], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x320], rdi
mov dword [r14 + 0x328], ebp
mov qword [r14 + 0x330], rax
lea rdx, str.DELETE_FROM_FILES_WHERE_FILE_ID_IN__SELECT_FILE_ID_FROM_FILES_WHERE_DIRTY__1_LIMIT__param_
mov qword [r14 + 0x338], rdx
mov qword [r14 + 0x340], rbp
mov qword [r14 + 0x348], rbp
mov byte [r14 + 0x350], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x1400949a4
mov byte [r14 + 0x350], 1
mov qword [r14 + 0x320], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x358], rdi
mov dword [r14 + 0x360], ebp
mov qword [r14 + 0x368], rax
lea rdx, str.SELECT_COUNT___FROM_HIERARCHY_WHERE_DIRTY__1
mov qword [r14 + 0x370], rdx
mov qword [r14 + 0x378], rbp
mov qword [r14 + 0x380], rbp
mov byte [r14 + 0x388], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x140094a0c
mov byte [r14 + 0x388], 1
mov qword [r14 + 0x358], rbx
mov rax, qword [r14 + 0x80]
add rax, 0x10
mov qword [r14 + 0x390], rdi
mov dword [r14 + 0x398], ebp
mov qword [r14 + 0x3a0], rax
lea rdx, str.SELECT_COUNT___FROM_FILES_WHERE_DIRTY__1
mov qword [r14 + 0x3a8], rdx
mov qword [r14 + 0x3b0], rbp
mov qword [r14 + 0x3b8], rbp
mov byte [r14 + 0x3c0], bpl
mov r8d, 6
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x140094a74
mov byte [r14 + 0x3c0], 1
mov qword [r14 + 0x390], rbx
lea rcx, [r14 + 0x3c8]
mov edx, 0x80000400
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
mov byte [r14 + 0x3f0], bpl
mov qword [r14 + 0x410], rbp
lea rcx, [r14 + 0x400]
call qword [sym.imp.KERNEL32.DLL_InitializeSListHead]
mov qword [r14 + 0x410], rbp
mov qword [r14 + 0x420], rbp
mov qword [r14 + 0x428], rbp
mov dword [r14 + 0x430], ebp
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret