Function at 0x1800de620
Capabilities:
Reference sql statements
Resolve function by parsing pe exports

Disassembly:
jmp 0x1800de620
push rbp
push r12
push r14
push r15
sub rsp, 0x88
mov r14, rcx
mov r15d, r9d
add rcx, 0x68
mov r12, r8
mov rbp, rdx
call fcn.1800046dd
test eax, eax
je 0x1800de65c
mov eax, 0x80004005
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0x80], r13
test rbp, rbp
jne 0x1800de697
mov edx, 0x200
xor ecx, ecx
call fcn.180005df3
xor ebx, ebx
mov rsi, rax
mov word [rax], bx
jmp 0x1800de6d4
xor ebx, ebx
mov rax, rbp
mov edi, ebx
cmp bx, word [rbp]
je 0x1800de6af
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de6a4
lea edx, [rdi + 0x100]
xor ecx, ecx
add rdx, rdx
call fcn.180005df3
lea r8d, [rdi + 1]
mov rdx, rbp
add r8, r8
mov rcx, rax
mov rsi, rax
call fcn.180004e58
test rsi, rsi
jne 0x1800de706
cmp dword [r14 + 0x3c], esi
ja 0x1800de6f9
mov rcx, qword [r14 + 0x30]
mov edx, 0x200
mov dword [r14 + 0x3c], 0xff
call fcn.180005df3
mov qword [r14 + 0x30], rax
mov dword [r14 + 0x38], ebx
mov rax, qword [r14 + 0x30]
mov word [rax], bx
jmp 0x1800de75d
mov edi, ebx
mov rax, rsi
cmp bx, word [rsi]
je 0x1800de71b
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de710
cmp edi, dword [r14 + 0x3c]
jb 0x1800de73e
mov rcx, qword [r14 + 0x30]
lea eax, [rdi + 0xff]
lea edx, [rax + 1]
mov dword [r14 + 0x3c], eax
add rdx, rdx
call fcn.180005df3
mov qword [r14 + 0x30], rax
mov dword [r14 + 0x38], edi
lea r8d, [rdi + 1]
mov rcx, qword [r14 + 0x30]
add r8, r8
mov rdx, rsi
call fcn.180004e58
mov rcx, rsi
call fcn.180003427
mov rax, qword [rsp + 0xd0]
mov edi, ebx
mov qword [r14 + 0x50], rax
lea rax, str.SELECT_rowid__size__pid__shadowStackId_FROM_ClrObject_WHERE_Snapshot_id____AND_pid____AND_classId___
mov qword [r14 + 0x40], r12
mov dword [r14 + 0x48], r15d
nop word [rax + rax]
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de780
lea edx, [rdi + 0x100]
xor ecx, ecx
add rdx, rdx
lea esi, [rdi + 0xff]
call fcn.180005df3
lea r8d, [rdi + 1]
mov rcx, rax
add r8, r8
lea rdx, str.SELECT_rowid__size__pid__shadowStackId_FROM_ClrObject_WHERE_Snapshot_id____AND_pid____AND_classId___
mov r15, rax
call fcn.180004e58
mov r12d, dword [rsp + 0xd8]
test r12d, r12d
je 0x1800de922
mov ebp, ebx
lea rax, str._ORDER_BY
lea rax, [rax + 2]
lea ebp, [rbp + 1]
cmp bx, word [rax]
jne 0x1800de7d4
lea r13d, [rdi + rbp]
cmp r13d, esi
jb 0x1800de805
lea edx, [r13 + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [r13 + 0xff]
call fcn.180005df3
mov r15, rax
lea r8d, [rbp + 1]
add r8, r8
lea rcx, [r15 + rdi*2]
lea rdx, str._ORDER_BY
call fcn.180004e58
mov edi, ebx
sub r12d, 1
je 0x1800de85d
cmp r12d, 1
je 0x1800de841
lea r12, str._name
mov rax, r12
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de834
jmp 0x1800de87b
lea r12, str._pid
mov rax, r12
nop dword [rax + rax]
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de850
jmp 0x1800de87b
lea r12, str._size
mov rax, r12
nop word [rax + rax]
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de870
lea ebp, [rdi + r13]
cmp ebp, esi
jb 0x1800de89d
lea edx, [rbp + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [rbp + 0xff]
call fcn.180005df3
mov r15, rax
lea r8d, [rdi + 1]
mov rdx, r12
add r8, r8
lea rcx, [r15 + r13*2]
call fcn.180004e58
cmp dword [rsp + 0xe0], 2
lea rax, str._DESC
lea r12, str._ASC
mov r13d, ebx
cmove r12, rax
mov rax, r12
cmp bx, word [r12]
je 0x1800de8ec
nop word [rax + rax]
inc r13d
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800de8e0
mov edi, ebp
add edi, r13d
cmp edi, esi
jb 0x1800de90f
lea edx, [rdi + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [rdi + 0xff]
call fcn.180005df3
mov r15, rax
lea r8d, [r13 + 1]
mov rdx, r12
add r8, r8
lea rcx, [r15 + rbp*2]
call fcn.180004e58
cmp dword [rsp + 0xe8], 0
je 0x1800deae0
mov ebp, ebx
lea rax, str._LIMIT
nop dword [rax]
lea rax, [rax + 2]
lea ebp, [rbp + 1]
cmp bx, word [rax]
jne 0x1800de940
lea r13d, [rdi + rbp]
cmp r13d, esi
jb 0x1800de971
lea edx, [r13 + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [r13 + 0xff]
call fcn.180005df3
mov r15, rax
lea r8d, [rbp + 1]
add r8, r8
lea rcx, [r15 + rdi*2]
lea rdx, str._LIMIT
call fcn.180004e58
mov edx, dword [rsp + 0xf8]
lea rcx, [rsp + 0x38]
call fcn.18000112c
mov rdi, rax
mov ebp, dword [rax + 8]
mov r12d, ebp
add r12d, r13d
cmp r12d, esi
jb 0x1800de9c8
lea edx, [r12 + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [r12 + 0xff]
call fcn.180005df3
mov r15, rax
mov rdx, qword [rdi]
lea r8d, [rbp + 1]
add r8, r8
lea rcx, [r15 + r13*2]
call fcn.180004e58
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800de9ea
call fcn.180003427
mov edi, ebx
lea rax, str._OFFSET
lea rax, [rax + 2]
lea edi, [rdi + 1]
cmp bx, word [rax]
jne 0x1800de9f3
lea ebp, [rdi + r12]
cmp ebp, esi
jb 0x1800dea21
lea edx, [rbp + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [rbp + 0xff]
call fcn.180005df3
mov r15, rax
lea r8d, [rdi + 1]
add r8, r8
lea rcx, [r15 + r12*2]
lea rdx, str._OFFSET
call fcn.180004e58
mov edx, dword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
call fcn.18000112c
mov rdi, rax
mov r12d, dword [rax + 8]
lea r13d, [r12 + rbp]
cmp r13d, esi
jb 0x1800dea75
lea edx, [r13 + 0x100]
mov rcx, r15
add rdx, rdx
lea esi, [r13 + 0xff]
call fcn.180005df3
mov r15, rax
mov rdx, qword [rdi]
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [r15 + rbp*2]
call fcn.180004e58
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800dea98
call fcn.180003427
mov edi, ebx
lea rax, [0x180174e58]
lea rax, [rax + 2]
lea edi, [rdi + 1]
cmp bx, word [rax]
jne 0x1800deaa1
lea eax, [rdi + r13]
cmp eax, esi
jb 0x1800deac9
lea edx, [rax + 0x100]
mov rcx, r15
add rdx, rdx
call fcn.180005df3
mov r15, rax
lea r8d, [rdi + 1]
add r8, r8
lea rcx, [r15 + r13*2]
lea rdx, [0x180174e58]
call fcn.180004e58
lea rax, [r14 + 0x88]
mov qword [rsp + 0x68], rax
test r15, r15
jne 0x1800deb18
mov edx, 0x200
mov dword [rsp + 0x7c], 0xff
xor ecx, ecx
call fcn.180005df3
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], ebx
mov word [rax], bx
jmp 0x1800deb68
mov edi, ebx
mov rax, r15
cmp bx, word [r15]
je 0x1800deb2e
inc edi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800deb23
lea eax, [rdi + 0xff]
xor ecx, ecx
lea edx, [rdi + 0x100]
mov dword [rsp + 0x7c], eax
add rdx, rdx
call fcn.180005df3
lea r8d, [rdi + 1]
mov qword [rsp + 0x38], rax
add r8, r8
mov qword [rsp + 0x70], rax
mov rcx, rax
mov dword [rsp + 0x78], edi
mov rdx, r15
call fcn.180004e58
lea rax, [rsp + 0x68]
mov dword [rsp + 0xb0], ebx
mov qword [rsp + 0x30], rax
nop dword [rax]
mov rdi, qword [rax]
mov r12, qword [rax + 8]
mov r13, qword [r14 + 0x70]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800deb9c
call qword [0x1802495e0]
mov qword [rdi], rbx
test r12, r12
jne 0x1800debb5
mov edx, 0x200
xor ecx, ecx
call fcn.180005df3
mov rbp, rax
mov word [rax], bx
jmp 0x1800debf1
mov esi, ebx
mov rax, r12
cmp bx, word [r12]
je 0x1800debcc
inc esi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800debc1
lea edx, [rsi + 0x100]
xor ecx, ecx
add rdx, rdx
call fcn.180005df3
lea r8d, [rsi + 1]
mov rdx, r12
add r8, r8
mov rcx, rax
mov rbp, rax
call fcn.180004e58
test rbp, rbp
jne 0x1800dec20
cmp dword [rdi + 0x24], ebp
ja 0x1800dec14
mov rcx, qword [rdi + 0x18]
mov edx, 0x200
mov dword [rdi + 0x24], 0xff
call fcn.180005df3
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x20], ebx
mov rax, qword [rdi + 0x18]
mov word [rax], bx
jmp 0x1800dec7a
mov esi, ebx
mov rax, rbp
cmp bx, word [rbp]
je 0x1800dec3b
nop dword [rax + rax]
inc esi
lea rax, [rax + 2]
cmp bx, word [rax]
jne 0x1800dec30
cmp esi, dword [rdi + 0x24]
jb 0x1800dec5c
mov rcx, qword [rdi + 0x18]
lea eax, [rsi + 0xff]
lea edx, [rax + 1]
mov dword [rdi + 0x24], eax
add rdx, rdx
call fcn.180005df3
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x20], esi
lea r8d, [rsi + 1]
mov rcx, qword [rdi + 0x18]
add r8, r8
mov rdx, rbp
call fcn.180004e58
mov rcx, rbp
call fcn.180003427
mov rcx, r12
mov qword [rdi + 8], r13
call qword [0x180259130]
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov rdx, r12
mov rcx, r13
lea r8d, [rax + rax]
call qword [0x1802495f0]
mov dword [rdi + 0x10], eax
test eax, eax
je 0x1800ded4b
cmp eax, 0x65
je 0x1800ded4b
mov rcx, r13
call qword [0x180249668]
cmp dword [0x1802492d4], 0
mov rsi, rax
je 0x1800dedae
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1800047e1
mov rcx, rax
lea rdx, str.DeleakerSDK::SQLiteWrappers::CStmt::Prepare
call fcn.180002621
mov rcx, rax
lea rdx, str.:_sqlite3_prepare16__
call fcn.180001faa
mov rcx, rax
mov rdx, r12
call fcn.180001faa
mov rcx, rax
lea rdx, str.___failed__error_
call fcn.180002621
mov edx, dword [rdi + 0x10]
mov rcx, rax
call fcn.1800010a0
mov rcx, rax
lea rdx, str.__message:__
call fcn.180002621
mov rcx, rax
mov rdx, rsi
call fcn.180001faa
mov rcx, rax
lea rdx, [0x180158e9c]
call fcn.180002621
lea rcx, [rsp + 0x48]
jmp 0x1800deda9
cmp dword [0x1802492d4], 0
je 0x1800dedae
cmp dword [0x1802492d8], 4
jb 0x1800dedae
mov edx, 4
lea rcx, [rsp + 0x58]
call fcn.1800047e1
mov rcx, rax
lea rdx, str.DeleakerSDK::SQLiteWrappers::CStmt::Prepare
call fcn.180002621
mov rcx, rax
lea rdx, str.:_sqlite3_prepare16__
call fcn.180001faa
mov rcx, rax
mov rdx, r12
call fcn.180001faa
mov rcx, rax
lea rdx, str.___returned_OK_r_n
call fcn.180002621
lea rcx, [rsp + 0x58]
call fcn.18000561e
cmp dword [rdi + 0x10], 0
jne 0x1800dee42
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.180002928
mov rcx, rax
test rax, rax
je 0x1800dedd7
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
jmp 0x1800dedda
mov rcx, rbx
mov rax, qword [r14 + 0x78]
mov qword [rcx + 8], rbx
test rax, rax
jne 0x1800dedf0
mov qword [rcx], rbx
mov qword [r14 + 0x78], rcx
jmp 0x1800dee05
mov rax, qword [r14 + 0x80]
mov qword [rcx], rax
mov rax, qword [r14 + 0x80]
mov qword [rax + 8], rcx
mov edx, dword [rsp + 0xb0]
mov rax, qword [rsp + 0x30]
inc edx
add rax, 0x18
mov qword [r14 + 0x80], rcx
mov dword [rsp + 0xb0], edx
mov qword [rsp + 0x30], rax
cmp edx, 1
jb 0x1800deb80
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x20]
test eax, eax
jne 0x1800dee47
jmp 0x1800dee49
mov eax, 0x80004005
mov ebx, eax
mov rcx, qword [rsp + 0x38]
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
test rcx, rcx
je 0x1800dee70
call fcn.180003427
test r15, r15
je 0x1800dee7d
mov rcx, r15
call fcn.180003427
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbp
ret