joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401693d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movups xmmword [rsp + 0x50], xmm6
movzx eax, byte [rdx]
mov r13, rdx
mov r12, rcx
mov edx, eax
cmp al, 0xb0
jne 0x1401693f9
movzx edx, byte [r13 + 2]
cmp dl, 0xb1
je 0x140169590
cmp dl, 0x8a
je 0x140169430
movups xmm6, xmmword [rsp + 0x50]
mov rdx, r13
mov rcx, r12
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3ExprCodeTemp
mov rdx, qword [r13 + 0x20]
mov rcx, qword [rdx + 0x20]
mov esi, dword [rcx]
cmp esi, 1
je 0x140169407
mov dword [r8], 0
cmp al, 0x8a
je 0x1401695a0
mov eax, dword [r12 + 0x38]
lea r15d, [rax + 1]
add eax, esi
mov dword [r12 + 0x38], eax
test esi, esi
jle 0x140169559
lea rax, [sym.sqlite3SelectWalkFail]
lea rdi, [sym.exprNodeIsConstant]
xor ebx, ebx
movq xmm6, rdi
movq xmm0, rax
punpcklqdq xmm6, xmm0
jmp 0x140169512
mov eax, 2
mov dword [rsp + 0x48], 0
mov word [rsp + 0x44], ax
movups xmmword [rsp + 0x28], xmm6
test r14, r14
je 0x140169578
lea rcx, [rsp + 0x20]
mov rdx, r14
call sym.sqlite3WalkExprNN
cmp word [rsp + 0x44], 0
jne 0x140169578
mov rbp, qword [r12]
mov rdx, r14
mov rcx, rbp
call sym.exprDup.constprop.0
cmp byte [rbp + 0x67], 0
mov r14, rax
jne 0x1401694f7
cmp qword [r12 + 0x10], 0
je 0x1401694f7
mov r8d, edi
mov rdx, rax
mov rcx, r12
call sym.sqlite3ExprCode.part.0
test r14, r14
je 0x140169507
mov rdx, r14
mov rcx, rbp
call sym.sqlite3ExprDeleteNN
add ebx, 1
cmp ebx, esi
je 0x140169559
mov rdx, qword [r13 + 0x20]
movsxd rax, ebx
lea edi, [r15 + rbx]
shl rax, 5
cmp byte [r12 + 0x23], 0
mov r14, qword [rdx + rax + 8]
jne 0x140169490
mov rbp, qword [r12]
test r14, r14
jne 0x1401694cd
cmp byte [rbp + 0x67], 0
jne 0x140169507
cmp qword [r12 + 0x10], 0
je 0x140169507
mov r8d, edi
xor edx, edx
mov rcx, r12
add ebx, 1
call sym.sqlite3ExprCode.part.0
cmp ebx, esi
jne 0x14016950e
movups xmm6, xmmword [rsp + 0x50]
mov eax, r15d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, edi
mov rdx, r14
mov rcx, r12
call sym.sqlite3ExprCodeRunJustOnce
jmp 0x140169507
mov rdx, qword [r13 + 0x20]
mov esi, dword [rdx]
jmp 0x14016943a
movups xmm6, xmmword [rsp + 0x50]
mov rdx, r13
mov rcx, r12
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3CodeSubselect
Function at 0x140171040
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x140171078
movsxd rdx, edx
lea r9, [rcx + rdx]
xor edx, edx
nop dword [rax]
movsx r8d, byte [rcx]
lea eax, [rdx*8]
add rcx, 1
xor eax, r8d
xor edx, eax
cmp rcx, r9
jne 0x140171050
mov eax, edx
and eax, 0x7fffffff
ret
xor eax, eax
ret

Function at 0x140186330
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r9d, edx
test edx, edx
jle 0x140186378
mov rax, rbx
xor ecx, ecx
nop dword [rax]
movsx r8d, byte [rax]
lea edx, [rcx*8]
add rax, 1
xor edx, r8d
xor ecx, edx
mov edx, ebx
sub edx, eax
add edx, r9d
test edx, edx
jg 0x140186348
mov eax, ecx
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rdx, rax
mov r9d, eax
xor eax, eax
test edx, edx
jg 0x14018633f
add rsp, 0x20
pop rbx
ret
Function at 0x1401b1de0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov r8, qword [rcx + 0x18]
mov r9, qword [rcx + 0x20]
mov rbx, rcx
mov ecx, dword [rcx + 0x3c]
mov dword [rsp + 0x44], 0
mov rsi, rdx
mov qword [rsp + 0x48], 0
test ecx, ecx
jne 0x1401b1f40
mov qword [rsp + 0x28], r8
lea r13, [rsp + 0x44]
lea rdx, str.SELECT_t._Q_FROM__Q._Q_AS_t_WHERE_t._Q_MATCH_id
mov qword [rsp + 0x20], r8
mov rcx, r13
call sym.sqlite3Fts5Mprintf
mov r12, rax
test rax, rax
je 0x1401b1e72
lea rax, [rsp + 0x48]
mov rcx, qword [rbx + 0x28]
mov r9d, pe_nt_image_headers64
mov rdx, r12
mov qword [rsp + 0x30], 0
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call sym.sqlite3LockAndPrepare
mov dword [rsp + 0x44], eax
mov rcx, r12
call sym.sqlite3_free
mov eax, dword [rsp + 0x44]
cmp eax, 1
je 0x1401b1ed8
mov rcx, qword [rsp + 0x48]
mov dword [rbx + 0x3c], 1
test rcx, rcx
je 0x1401b1f68
call sym.sqlite3_step
cmp eax, 0x64
je 0x1401b1f80
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
mov dword [rbx + 0x3c], 0
test edx, edx
je 0x1401b1ef8
call sym.sqlite3_finalize
xor eax, eax
mov qword [rsi], rax
mov eax, dword [rsp + 0x44]
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x44], 0
mov dword [rbx + 0x3c], 1
test rcx, rcx
jne 0x1401b1e98
mov dword [rbx + 0x3c], 0
call sym.sqlite3_finalize
xor ecx, ecx
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], eax
test eax, eax
jne 0x1401b1eba
mov rdx, qword [rbx + 0x20]
mov r8, qword [rbx + 0x18]
lea rcx, str.no_such_fts5_table:__s._s
call sym.sqlite3_mprintf
mov dword [rsp + 0x44], 1
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
jmp 0x1401b1eba
mov rdx, r9
lea rcx, str.recursive_definition_for__s._s
call sym.sqlite3_mprintf
mov qword [rbx + 0x10], rax
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
ret
mov dword [rbx + 0x3c], 0
test eax, eax
jne 0x1401b1eba
jmp 0x1401b1ef8
mov rcx, qword [rsp + 0x48]
call sym.sqlite3_column_int64.constprop.0
mov rdx, rax
mov rax, qword [rbx + 0x30]
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x1401b1fad
jmp 0x1401b1ea6
mov rax, qword [rax + 8]
test rax, rax
je 0x1401b1ea6
cmp rdx, qword [rax + 0x18]
jne 0x1401b1fa0
mov r12, qword [rax]
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0x3c], 0
test eax, eax
jne 0x1401b2030
test r12, r12
je 0x1401b203a
mov rcx, r12
call sym.sqlite3Fts5FlushToDisk
mov dword [rsp + 0x44], eax
test eax, eax
jne 0x1401b2030
mov rax, qword [r12 + 0x18]
mov rcx, r13
movsxd rdx, dword [rax + 0x18]
add rdx, 8
shl rdx, 4
call sym.sqlite3Fts5MallocZero.part.0
test rax, rax
je 0x1401b2030
mov rcx, qword [r12 + 0x18]
mov rdx, qword [rsp + 0x48]
mov qword [rax + 0x10], r12
movsxd rcx, dword [rcx + 0x18]
mov qword [rax + 8], rdx
lea rdx, [rax + 0x80]
mov qword [rax + 0x48], rdx
lea rdx, [rdx + rcx*8]
mov qword [rax + 0x50], rdx
jmp 0x1401b1ec1
mov rcx, qword [rsp + 0x48]
jmp 0x1401b1eba
mov rcx, qword [rsp + 0x48]
jmp 0x1401b1ef8
Function at 0x1401b69a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd rdi, dword [rdx]
mov r12, rdx
movzx edx, byte [r8]
mov rbp, rcx
mov rbx, r8
test dl, dl
je 0x1401b69fc
mov rsi, r8
mov eax, edx
lea r8, [0x140344300]
xor r9d, r9d
nop dword [rax]
movzx ecx, al
test byte [r8 + rcx], 6
jne 0x1401b69de
cmp al, 0x5f
jne 0x1401b69ee
movzx eax, byte [rsi + 1]
add rsi, 1
add r9d, 1
test al, al
jne 0x1401b69d0
movzx eax, dl
test byte [r8 + rax], 4
je 0x1401b6a90
mov byte [rbp + rdi], 0x22
movzx edx, byte [rbx]
lea eax, [rdi + 1]
mov r8d, 1
mov edi, eax
test dl, dl
je 0x1401b6a80
movsxd rcx, eax
lea edi, [rax + 1]
mov byte [rbp + rcx], dl
cmp byte [rbx], 0x22
je 0x1401b6a45
nop word [rax + rax]
movzx edx, byte [rbx + 1]
add rbx, 1
test dl, dl
je 0x1401b6a5d
mov eax, edi
movsxd rcx, eax
lea edi, [rax + 1]
mov byte [rbp + rcx], dl
cmp byte [rbx], 0x22
jne 0x1401b6a28
movsxd rdi, edi
add rbx, 1
add eax, 2
mov byte [rbp + rdi], 0x22
movzx edx, byte [rbx]
mov edi, eax
test dl, dl
jne 0x1401b6a34
test r8d, r8d
jne 0x1401b6a80
movsxd rax, edi
mov byte [rbp + rax], 0
mov dword [r12], edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movsxd rax, edi
add edi, 1
mov byte [rbp + rax], 0x22
jmp 0x1401b6a62
mov dword [rsp + 0x2c], 0x3b
cmp r9d, 1
jg 0x1401b6ac0
cmp byte [rsi], 0
setne al
xor r9d, 1
and r9d, 1
or al, r9b
jne 0x1401b69fc
mov eax, edi
xor r8d, r8d
jmp 0x1401b6a13
lea r8, [rsp + 0x2c]
mov edx, r9d
mov rcx, rbx
call sym.keywordCode
cmp dword [rsp + 0x2c], 0x3b
jne 0x1401b69fc
cmp byte [rsi], 0
jne 0x1401b69fc
movzx edx, byte [rbx]
test dl, dl
je 0x1401b6a62
jmp 0x1401b6ab5
Function at 0x1401c3850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
mov r12, rcx
mov rcx, qword [r8]
mov rsi, r8
movzx eax, word [rcx + 0x14]
mov edx, eax
and dx, 0x202
cmp dx, 0x202
je 0x1401c3928
xor ebx, ebx
test al, 1
jne 0x1401c3893
mov edx, 1
call sym.valueToText
mov rcx, qword [rsi]
mov rbx, rax
movzx eax, word [rcx + 0x14]
test al, 2
je 0x1401c38a1
cmp byte [rcx + 0x16], 1
je 0x1401c393e
test al, 0x10
jne 0x1401c3908
xor r8d, r8d
test al, 1
jne 0x1401c38b9
mov edx, 1
call sym.valueBytes
mov r8d, eax
test rbx, rbx
je 0x1401c3919
movsxd rsi, r8d
lea r13, [rsi + 1]
test r12, r12
je 0x1401c3a50
mov rcx, qword [r12]
mov rax, qword [rcx + 0x18]
movsxd rax, dword [rax + 0x88]
cmp r13, rax
jg 0x1401c3950
cmp rsi, 0x7ffffefe
jbe 0x1401c3990
mov rcx, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
jmp sym.sqlite3_result_error_nomem
mov r8d, dword [rcx + 0x10]
test ah, 4
je 0x1401c38b9
add r8d, dword [rcx]
test rbx, rbx
jne 0x1401c38be
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
cmp byte [rcx + 0x16], 1
jne 0x1401c3879
mov rbx, qword [rcx + 8]
test al, 2
je 0x1401c38a1
mov r8d, dword [rcx + 0x10]
jmp 0x1401c38b9
mov dword [r12 + 0x24], 0x12
mov r9d, 1
mov r8, 0xffffffffffffffff
lea rdx, [0x140332721]
mov qword [rsp + 0x20], 0
call sym.sqlite3VdbeMemSetStr
nop
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, dword [0x1402ba6c0]
test eax, eax
jne 0x1401c3a10
mov dword [rsp + 0x3c], r8d
mov ecx, r13d
call qword [0x1402ba6e0]
mov r8d, dword [rsp + 0x3c]
mov r10, rax
test r10, r10
je 0x1401c38ef
xor eax, eax
lea rcx, [0x140344560]
test r8d, r8d
jle 0x1401c39e5
nop word [rax + rax]
movzx edx, byte [rbx + rax]
movzx edx, byte [rcx + rdx]
mov byte [r10 + rax], dl
add rax, 1
cmp rax, rsi
jne 0x1401c39d0
lea rax, [sym.sqlite3_free]
mov r9d, 1
mov rdx, r10
mov rcx, r12
mov qword [rsp + 0x20], rax
call sym.setResultStrOrError
nop
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, qword [0x1402ba340]
test rcx, rcx
je 0x1401c3a2c
mov dword [rsp + 0x3c], r8d
call qword [0x1402ba740]
mov r8d, dword [rsp + 0x3c]
mov rcx, r13
mov dword [rsp + 0x3c], r8d
call sym.sqlite3Malloc.part.0
mov r8d, dword [rsp + 0x3c]
mov r10, rax
jmp 0x1401c39b0
mov eax, dword [0x88]
ud2
Function at 0x1401cbb30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x80]
movsxd rax, edx
mov r13, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
test rcx, rcx
je 0x1401cbd18
test rdx, rdx
je 0x1401cbd30
cmp rdx, 0x7ffffeff
ja 0x1401cbce2
call sym.sqlite3Realloc.part.0
mov rdi, rax
test rdi, rdi
je 0x1401cbce2
movsxd rdx, r14d
lea rbp, [0x1402ba6c0]
xor r12d, r12d
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r14d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sub.msvcrt.dll_memset
mov qword [r13 + 0x78], rdi
cmp r14d, esi
jl 0x1401cbc8c
jmp 0x1401cbd10
mov rcx, qword [0x1402ba340]
test rcx, rcx
je 0x1401cbbfa
call qword [0x1402ba740]
mov ecx, 0x200
call sym.sqlite3Malloc.part.0
mov rdx, rax
test rdx, rdx
je 0x1401cbcd3
lea rdi, [rdx + 8]
mov rcx, rdx
mov rax, r12
mov qword [rdx], 0
mov qword [rdx + 0x1f8], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r15d
mov qword [rbx + 0x10], rdx
mov rax, qword [r13 + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x1401cbc74
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r14d, 1
add rbx, 0x38
mov dword [r13 + 0x80], r14d
cmp r14d, esi
je 0x1401cbd10
mov rax, qword [r13 + 0x50]
mov r15d, dword [r13 + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r15d
je 0x1401cbd00
mov rax, qword [r13 + 0x60]
test rax, rax
jle 0x1401cbd00
mov qword [rbx], rax
mov eax, dword [r13 + 0x3c]
mov dword [rbx + 0x1c], eax
mov eax, dword [rbp]
test eax, eax
jne 0x1401cbbe8
mov ecx, 0x200
call qword [0x1402ba6e0]
mov rdx, rax
test rdx, rdx
jne 0x1401cbc10
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r13 + 0xb8]
jmp 0x1401cbca7
xor eax, eax
jmp 0x1401cbce7
mov rcx, rdx
call sym.sqlite3Malloc
mov rdi, rax
jmp 0x1401cbb8a
call sym.sqlite3_free
mov eax, 7
jmp 0x1401cbce7
Function at 0x1401d46c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov r12, rcx
mov ebx, edx
mov rsi, r8
test rcx, rcx
je 0x1401d4800
mov rax, qword [rcx]
mov rdi, qword [rax + 0x18]
test ebx, ebx
jg 0x1401d46f8
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, qword [rsi]
test rcx, rcx
je 0x1401d46e7
movzx eax, word [rcx + 0x14]
mov edx, eax
and dx, 0x202
cmp dx, 0x202
je 0x1401d47e8
test al, 1
jne 0x1401d46e7
mov edx, 1
call sym.valueToText
mov rdx, rax
test rdx, rdx
je 0x1401d46e7
mov eax, dword [rdi + 0x88]
lea r8, [rsi + 8]
mov ecx, 0x200
sub ebx, 1
lea r13, [rsp + 0x50]
mov qword [rsp + 0x48], r8
lea r8, [rsp + 0x40]
mov word [rsp + 0x6c], cx
mov rcx, r13
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 0
call sym.sqlite3_str_appendf
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x68]
test rdx, rdx
je 0x1401d47b6
mov eax, r8d
mov byte [rdx + rax], 0
mov edx, dword [rsp + 0x64]
test edx, edx
je 0x1401d47b1
test byte [rsp + 0x6d], 4
je 0x1401d4860
mov rdx, qword [rsp + 0x58]
test r12, r12
je 0x1401d4810
lea rax, [sym.sqlite3OomClear]
mov r9d, 1
mov rcx, r12
mov qword [rsp + 0x20], rax
call sym.setResultStrOrError
nop
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
cmp byte [rcx + 0x16], 1
jne 0x1401d4716
mov rdx, qword [rcx + 8]
jmp 0x1401d4727
xor edi, edi
jmp 0x1401d46e3
cmp byte [rdx + 0x67], 0
je 0x1401d46e7
mov eax, dword [rdx + 0xe4]
test eax, eax
jne 0x1401d46e7
mov byte [rdx + 0x67], 0
mov ecx, 0
mov dword [rdx + 0x198], 0
sub dword [rdx + 0x1a0], 1
jne 0x1401d484b
movzx ecx, word [rdx + 0x1a6]
mov word [rdx + 0x1a4], cx
jmp 0x1401d46e7
mov rcx, r13
mov dword [rsp + 0x3c], r8d
call sym.strAccumFinishRealloc
mov r8d, dword [rsp + 0x3c]
mov rdx, rax
jmp 0x1401d47b6
Function at 0x1401db7c0
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov esi, r8d
mov rbx, rdx
mov rdi, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov r12, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [rsp + 0x30], ebp
call sym.sqlite3NestedParse
test esi, esi
je 0x1401db810
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rdi
mov r8, rbx
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, r12
mov dword [rsp + 0x90], ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.sqlite3NestedParse
Function at 0x1401e2000
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
movq xmm1, rax
mov esi, edx
lea rdx, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov rbx, rcx
mov rdi, r8
movsxd rax, esi
movq xmm0, rdx
mov rbp, r9
lea r13, [rax + 4]
punpcklqdq xmm0, xmm1
mov r12, qword [rcx + r13*8 + 8]
movups xmmword [rsp + 0x40], xmm0
test r12, r12
je 0x1401e20f0
mov r9d, dword [rbx + 0x40]
test r9d, r9d
je 0x1401e2068
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edx, edx
mov rcx, r12
call sym.vdbeUnbind
test eax, eax
jne 0x1401e20a7
mov rcx, qword [r12 + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x1401e20e0
mov r8d, 4
mov qword [rcx], rdi
mov word [rcx + 0x14], r8w
mov rax, qword [r12]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401e20a7
call qword [0x1402ba750]
mov rcx, r12
call sym.sqlite3_step
cmp eax, 0x65
je 0x1401e2110
cmp eax, 0x64
je 0x1401e2148
mov rcx, r12
call sym.sqlite3_reset
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x1401e2056
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rdi
call sym.vdbeReleaseAndSetInt64
jmp 0x1401e2094
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call sym.rtreeCheckPrepare
mov qword [rbx + r13*8 + 8], rax
mov r12, rax
jmp 0x1401e204d
test esi, esi
lea rdx, str.__parent
mov r9, rbp
mov r8, rdi
lea rax, str.__rowid
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1401e20bd
mov rcx, r12
call sym.sqlite3_column_int64.constprop.0
mov r9, rax
cmp rbp, rax
je 0x1401e20bd
test esi, esi
lea rdx, str.__parent
mov r8, rdi
mov rcx, rbx
lea rax, str.__rowid
mov qword [rsp + 0x30], rbp
cmove rax, rdx
mov qword [rsp + 0x28], rdi
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1401e20bd
Function at 0x1401e7190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rcx + 0xa], 0
mov r12, rcx
jne 0x1401e7330
movzx eax, byte [r12 + 9]
mov ebx, 1
sub ebx, eax
mov ecx, eax
movsxd rbx, ebx
mov rdx, qword [r12 + rbx*8 + 0x58]
test rdx, rdx
je 0x1401e71d5
mov r8, qword [r12]
sub dword [rdx + 0x10], 1
je 0x1401e7200
mov qword [r12 + rbx*8 + 0x58], 0
test cl, cl
je 0x1401e7210
movzx eax, byte [r12 + 0x50]
sub dword [r12 + rax*4 + 0x80], 1
mov byte [r12 + 9], 0
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp sym.rtreeStepToLeaf
mov rcx, r8
call sym.nodeRelease.part.0
movzx ecx, byte [r12 + 9]
jmp 0x1401e71cc
movsxd rdx, dword [r12 + 0x24]
test edx, edx
je 0x1401e71ee
mov rax, qword [r12 + 0x30]
lea esi, [rdx - 1]
movzx ecx, byte [rax + 0x10]
sub dword [r12 + rcx*4 + 0x80], 1
movsxd rcx, esi
lea rcx, [rcx + rcx*2]
mov dword [r12 + 0x24], esi
lea rcx, [rax + rcx*8]
movdqu xmm2, xmmword [rcx]
movups xmmword [rax], xmm2
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x10], rcx
cmp esi, 3
jle 0x1401e7348
mov ebx, 1
xor edx, edx
movsxd rcx, ebx
lea edi, [rdx + rdx + 2]
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
movsd xmm0, qword [rcx]
cmp esi, edi
jle 0x1401e72a0
movsxd r8, edi
lea r8, [r8 + r8*2]
lea r8, [rax + r8*8]
movsd xmm1, qword [r8]
comisd xmm0, xmm1
ja 0x1401e72f0
comisd xmm1, xmm0
ja 0x1401e72a0
movzx r9d, byte [rcx + 0x10]
cmp byte [r8 + 0x10], r9b
jb 0x1401e72f0
nop dword [rax + rax]
movsxd r8, edx
lea r8, [r8 + r8*2]
lea rax, [rax + r8*8]
movsd xmm1, qword [rax]
comisd xmm1, xmm0
ja 0x1401e72cc
comisd xmm0, xmm1
ja 0x1401e71ee
movzx eax, byte [rax + 0x10]
cmp byte [rcx + 0x10], al
jae 0x1401e71ee
mov r8d, ebx
mov rcx, r12
call sym.rtreeSearchPointSwap
mov edx, ebx
lea ebx, [rdx + rdx + 1]
cmp esi, ebx
jle 0x1401e71ee
mov rax, qword [r12 + 0x30]
jmp 0x1401e725d
movsxd rcx, edx
lea rcx, [rcx + rcx*2]
lea rax, [rax + rcx*8]
movsd xmm0, qword [rax]
comisd xmm0, xmm1
ja 0x1401e731d
comisd xmm1, xmm0
ja 0x1401e71ee
movzx eax, byte [rax + 0x10]
cmp byte [r8 + 0x10], al
jae 0x1401e71ee
mov r8d, edi
mov rcx, r12
call sym.rtreeSearchPointSwap
mov edx, edi
jmp 0x1401e72d9
mov byte [rcx + 0xa], 0
mov rcx, qword [rcx + 0x38]
call sym.sqlite3_reset
jmp 0x1401e71a6
add rdx, 0xa
mov rcx, qword [r12 + rdx*8 + 8]
mov qword [r12 + 0x60], rcx
mov qword [r12 + rdx*8 + 8], 0
cmp esi, 1
jg 0x1401e7256
jmp 0x1401e71ee
Function at 0x1401f4960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
jne 0x1401f49b0
movzx eax, byte [rcx + 0x10]
test al, al
je 0x1401f49b0
cmp al, 1
je 0x1401f49b8
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
test r8, r8
je 0x1401f498e
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x1401f49c8
mov rcx, qword [rcx]
mov edx, dword [r9 + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x1401f49c8
cmp byte [rcx + 0xa], 0
je 0x1401f49c8
jmp sym.pagerOpenSavepoint
jmp sym.btreeBeginTrans
test edx, edx
jne 0x1401f49b0
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
test r8, r8
jne 0x1401f497e
xor eax, eax
ret
Function at 0x140206550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x68
cmp byte [rcx + 0x23], 0
mov r12, rcx
mov ebx, r8d
je 0x140206610
mov eax, 2
lea rcx, [sym.exprNodeIsConstant]
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rcx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
test rdx, rdx
je 0x140206640
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
call sym.sqlite3WalkExprNN
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x140206640
mov r14, qword [r12]
mov rcx, r14
call sym.exprDup.constprop.0
cmp byte [r14 + 0x67], 0
mov r13, rax
jne 0x1402065ef
cmp qword [r12 + 0x10], 0
je 0x1402065ef
mov r8d, ebx
mov rdx, rax
mov rcx, r12
call sym.sqlite3ExprCode.part.0
test r13, r13
je 0x140206660
mov rdx, r13
mov rcx, r14
add rsp, 0x68
pop rbx
pop r12
pop r13
pop r14
jmp sym.sqlite3ExprDeleteNN
mov r14, qword [rcx]
test rdx, rdx
jne 0x1402065c7
cmp byte [r14 + 0x67], 0
jne 0x140206660
cmp qword [rcx + 0x10], 0
je 0x140206660
xor edx, edx
add rsp, 0x68
pop rbx
pop r12
pop r13
pop r14
jmp sym.sqlite3ExprCode.part.0
mov r8d, ebx
mov rcx, r12
add rsp, 0x68
pop rbx
pop r12
pop r13
pop r14
jmp sym.sqlite3ExprCodeRunJustOnce
add rsp, 0x68
pop rbx
pop r12
pop r13
pop r14
ret