Function at 0x14008acd0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor edx, edx
call fcn.1400c03d0
nop
mov qword [r14 + 0x58], rbx
mov qword [r14 + 0x60], rdi
lea rax, [rsi + 0x98]
xor ebp, ebp
test rsi, rsi
cmove rax, rbp
mov qword [r14 + 0x68], rax
lea rax, vtable.ServiceNtfsMftScanner.0
mov qword [r14], rax
lea rax, vtable.ServiceNtfsMftScanner.1.0
mov qword [r14 + 0x40], rax
lea rax, vtable.ServiceNtfsMftScanner.2.0
mov qword [r14 + 0x48], rax
lea rax, vtable.ServiceNtfsMftScanner.3.0
mov qword [r14 + 0x50], rax
lea rax, str.mft_scanning_state
mov qword [r14 + 0x70], rax
mov dword [r14 + 0x78], 2
mov qword [r14 + 0x80], rbx
mov qword [r14 + 0x88], rdi
mov qword [r14 + 0x90], rsi
mov rax, qword [rsp + 0x70]
mov qword [r14 + 0x98], rax
lea rcx, [r14 + 0xa0]
mov rdx, rsi
call fcn.1400ae260
lea rax, vtable.ServiceThread.0
mov qword [r14 + 0x128], rax
mov qword [r14 + 0x130], rbp
mov qword [r14 + 0x138], rbp
mov qword [r14 + 0x140], rbp
mov dword [r14 + 0x148], ebp
mov qword [r14 + 0x150], rbp
lea rcx, [r14 + 0x158]
mov edx, 0x80000400
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSectionAndSpinCount]
mov dword [r14 + 0x180], 0xffffffff
lea rax, vtable.ServiceNtfsMftScanner::ServiceNtfsMftScannerThread.0
mov qword [r14 + 0x128], rax
mov qword [r14 + 0x188], r14
mov qword [r14 + 0x190], rbp
mov rcx, qword [r14 + 0x80]
lea rdi, vtable.SqliteStatement.0
mov qword [r14 + 0x198], rdi
mov dword [r14 + 0x1a0], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x1a8], rax
lea rdx, str.UPDATE_FILES_SET_DIRTY__1_WHERE_FILE_ID_IN__SELECT_FILE_ID_FROM_FILES_WHERE_DIRTY____1_LIMIT__param_
mov qword [r14 + 0x1b0], rdx
mov qword [r14 + 0x1b8], rbp
mov qword [r14 + 0x1c0], rbp
mov byte [r14 + 0x1c8], bpl
lea r8d, [rbp + 6]
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008ae65
mov byte [r14 + 0x1c8], 1
lea rbx, vtable.TransactionSafeStatement.0
mov qword [r14 + 0x198], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x1d0], rdi
mov dword [r14 + 0x1d8], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x1e0], rax
lea rdx, str.UPDATE_HIERARCHY_SET_DIRTY__1_WHERE___rowid___IN__SELECT___rowid___FROM_HIERARCHY_WHERE_DIRTY____1_LIMIT__param_
mov qword [r14 + 0x1e8], rdx
mov qword [r14 + 0x1f0], rbp
mov qword [r14 + 0x1f8], rbp
mov byte [r14 + 0x200], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008aedb
mov byte [r14 + 0x200], 1
mov qword [r14 + 0x1d0], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x208], rdi
mov dword [r14 + 0x210], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x218], rax
lea rdx, str.SELECT_COUNT___FROM_HIERARCHY_WHERE_DIRTY__0
mov qword [r14 + 0x220], rdx
mov qword [r14 + 0x228], rbp
mov qword [r14 + 0x230], rbp
mov byte [r14 + 0x238], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008af4a
mov byte [r14 + 0x238], 1
mov qword [r14 + 0x208], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x240], rdi
mov dword [r14 + 0x248], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x250], rax
lea rdx, str.SELECT_COUNT___FROM_FILES_WHERE_DIRTY__0
mov qword [r14 + 0x258], rdx
mov qword [r14 + 0x260], rbp
mov qword [r14 + 0x268], rbp
mov byte [r14 + 0x270], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008afb9
mov byte [r14 + 0x270], 1
mov qword [r14 + 0x240], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x278], rdi
mov dword [r14 + 0x280], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x288], rax
lea rdx, str.SELECT_COUNT___FROM_HIERARCHY
mov qword [r14 + 0x290], rdx
mov qword [r14 + 0x298], rbp
mov qword [r14 + 0x2a0], rbp
mov byte [r14 + 0x2a8], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008b028
mov byte [r14 + 0x2a8], 1
mov qword [r14 + 0x278], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x2b0], rdi
mov dword [r14 + 0x2b8], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x2c0], rax
lea rdx, [0x14020efb8]
mov qword [r14 + 0x2c8], rdx
mov qword [r14 + 0x2d0], rbp
mov qword [r14 + 0x2d8], rbp
mov byte [r14 + 0x2e0], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008b097
mov byte [r14 + 0x2e0], 1
mov qword [r14 + 0x2b0], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x2e8], rdi
mov dword [r14 + 0x2f0], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x2f8], rax
lea rdx, str.DELETE_FROM_HIERARCHY_WHERE___rowid___IN__SELECT___rowid___FROM_HIERARCHY_WHERE_DIRTY__1_LIMIT__param_
mov qword [r14 + 0x300], rdx
mov qword [r14 + 0x308], rbp
mov qword [r14 + 0x310], rbp
mov byte [r14 + 0x318], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008b106
mov byte [r14 + 0x318], 1
mov qword [r14 + 0x2e8], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x320], rdi
mov dword [r14 + 0x328], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x330], rax
lea rdx, str.DELETE_FROM_FILES_WHERE_FILE_ID_IN__SELECT_FILE_ID_FROM_FILES_WHERE_DIRTY__1_LIMIT__param_
mov qword [r14 + 0x338], rdx
mov qword [r14 + 0x340], rbp
mov qword [r14 + 0x348], rbp
mov byte [r14 + 0x350], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008b175
mov byte [r14 + 0x350], 1
mov qword [r14 + 0x320], rbx
mov rcx, qword [r14 + 0x80]
mov qword [r14 + 0x358], rdi
mov dword [r14 + 0x360], ebp
lea rax, [rcx + 0x10]
test rcx, rcx
cmove rax, rbp
mov qword [r14 + 0x368], rax
lea rdx, str.SELECT_COUNT___FROM_HIERARCHY_WHERE_DIRTY__1
mov qword [r14 + 0x370], rdx
mov qword [r14 + 0x378], rbp
mov qword [r14 + 0x380], rbp
mov byte [r14 + 0x388], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008b1e4
mov byte [r14 + 0x388], 1
mov qword [r14 + 0x358], rbx
mov rdx, qword [r14 + 0x80]
mov qword [r14 + 0x390], rdi
mov dword [r14 + 0x398], ebp
lea rax, [rdx + 0x10]
test rdx, rdx
cmove rax, rbp
mov qword [r14 + 0x3a0], rax
lea rdx, str.SELECT_COUNT___FROM_FILES_WHERE_DIRTY__1
mov qword [r14 + 0x3a8], rdx
mov qword [r14 + 0x3b0], rbp
mov qword [r14 + 0x3b8], rbp
mov byte [r14 + 0x3c0], bpl
mov r8d, 6
lea rcx, [0x14023dc20]
call fcn.1401a1b20
test eax, eax
jne 0x14008b253
mov byte [r14 + 0x3c0], 1
mov qword [r14 + 0x390], rbx
lea rcx, [r14 + 0x3c8]
mov edx, 0x80000400
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSectionAndSpinCount]
mov byte [r14 + 0x3f0], bpl
mov qword [r14 + 0x410], rbp
lea rcx, [r14 + 0x400]
call qword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InitializeSListHead]
mov qword [r14 + 0x410], rbp
mov qword [r14 + 0x420], rbp
mov qword [r14 + 0x428], rbp
mov dword [r14 + 0x430], ebp
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret