Function at 0x140008cd0
Capabilities:
Execute command
Query environment variable
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
mov rsi, rcx
mov rbx, r8
cmp edx, 2
je 0x140008fa8
lea rcx, str.VISUAL
call sym.getenv
mov rdi, rax
test rdi, rdi
je 0x140008fbd
mov rcx, qword [rbx]
call sym.sqlite3_value_type
cmp eax, 5
je 0x140009068
mov rcx, rsi
call sym.sqlite3_context_db_handle
xor edx, edx
lea r9, [rsp + 0x30]
mov r8d, 0x10
mov qword [rsp + 0x30], 0
mov rcx, rax
call sym.sqlite3_file_control
cmp qword [rsp + 0x30], 0
je 0x140008fe0
mov rcx, qword [rbx]
call sym.sqlite3_value_type
mov r12d, eax
cmp eax, 4
je 0x140008e30
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140150c43]
call sym.fopen
mov rbp, rax
test rax, rax
je 0x140009048
mov rcx, qword [rbx]
xor r14d, r14d
call sym.sqlite3_value_bytes
mov rcx, qword [rbx]
movsxd r15, eax
call sym.sqlite3_value_text
mov r13, r15
mov rcx, rax
test rax, rax
je 0x140008dbb
lea rdx, [0x140150ba1]
xor r14d, r14d
call sym.strstr
test rax, rax
setne r14b
mov rcx, qword [rbx]
call sym.sqlite3_value_text
mov r9, rbp
mov r8, r15
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rcx, rbp
mov rbx, rax
call sym.fclose
cmp rbx, r13
je 0x140008e8a
mov r8d, 0xffffffff
lea rdx, str.edit___could_not_write_the_whole_file
mov rcx, rsi
call sym.sqlite3_result_error
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
mov rcx, qword [rsp + 0x30]
call sym.sqlite3_free
mov rcx, rbx
call sym.sqlite3_free
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1401508ee]
call sym.fopen
mov rbp, rax
test rax, rax
je 0x140009048
mov rcx, qword [rbx]
xor r14d, r14d
call sym.sqlite3_value_bytes
mov rcx, qword [rbx]
movsxd r13, eax
call sym.sqlite3_value_blob
mov r9, rbp
mov r8, r13
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rcx, rbp
mov rbx, rax
call sym.fclose
cmp rbx, r13
jne 0x140008dea
mov r8, qword [rsp + 0x30]
mov rdx, rdi
lea rcx, str._s___s_
call sym.sqlite3_mprintf
mov rbx, rax
test rax, rax
je 0x1400090f0
mov rcx, rax
call sym.system
mov rcx, rbx
mov edi, eax
call sym.sqlite3_free
test edi, edi
jne 0x140009028
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1401508f1]
call sym.fopen
mov rdi, rax
test rax, rax
je 0x140009120
mov r8d, 2
xor edx, edx
mov rcx, rax
call sym.fseek
mov rcx, rdi
call sym.ftell
mov rcx, rdi
movsxd rbp, eax
call sym.rewind
lea rcx, [rbp + 1]
call sym.sqlite3_malloc64
mov rbx, rax
test rax, rax
je 0x140009088
mov rcx, rax
mov r9, rdi
mov r8, rbp
mov edx, 1
call sym.fread
mov rcx, rdi
mov r13, rbp
mov r15, rax
call sym.fclose
cmp rbp, r15
jne 0x140009100
cmp r12d, 4
je 0x1400090a0
test r14d, r14d
jne 0x1400090c7
mov byte [rbx + rbp], 0
test rbp, rbp
jle 0x14000913a
xor edx, edx
xor eax, eax
jmp 0x140008f88
add rdx, 1
add rax, 1
mov byte [rbx + rdx - 1], cl
mov r13, rdx
cmp rbp, rax
jle 0x1400090c0
movzx ecx, byte [rbx + rax]
cmp cl, 0xd
jne 0x140008f70
cmp byte [rbx + rax + 1], 0xa
jne 0x140008f70
add rax, 1
mov ecx, 0xa
jmp 0x140008f70
mov rcx, qword [r8 + 8]
call sym.sqlite3_value_text
mov rdi, rax
test rdi, rdi
jne 0x140008d10
mov r8d, 0xffffffff
lea rdx, str.no_editor_for_edit__
mov rcx, rsi
call sym.sqlite3_result_error
jmp 0x140008e1f
lea rdx, [rsp + 0x38]
mov ecx, 8
mov qword [rsp + 0x38], 0
call sym.sqlite3_randomness
mov rdx, qword [rsp + 0x38]
lea rcx, str.temp_llx
call sym.sqlite3_mprintf
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140008d53
mov rcx, rsi
call sym.sqlite3_result_error_nomem
jmp 0x140008e1f
mov r8d, 0xffffffff
lea rdx, str.EDITOR_returned_non_zero
mov rcx, rsi
call sym.sqlite3_result_error
jmp 0x140008dff
mov r8d, 0xffffffff
lea rdx, str.edit___cannot_open_temp_file
mov rcx, rsi
call sym.sqlite3_result_error
jmp 0x140008dff
mov r8d, 0xffffffff
lea rdx, str.NULL_input_to_edit__
mov rcx, rsi
call sym.sqlite3_result_error
jmp 0x140008e1f
mov rcx, rsi
call sym.sqlite3_result_error_nomem
mov rcx, rdi
call sym.fclose
jmp 0x140008dff
lea r9, [sym.sqlite3_free]
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call sym.sqlite3_result_blob64
jmp 0x140008dff
lea rax, [rbx + rdx]
mov byte [rax], 0
lea r9, [sym.sqlite3_free]
mov r8, r13
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x20], 1
call sym.sqlite3_result_text64
jmp 0x140008dff
mov rcx, rsi
call sym.sqlite3_result_error_nomem
jmp 0x140008dff
mov r8d, 0xffffffff
lea rdx, str.could_not_read_back_the_whole_file
mov rcx, rsi
call sym.sqlite3_result_error
jmp 0x140008e01
mov r8d, 0xffffffff
lea rdx, str.edit___cannot_reopen_temp_file_after_edit
mov rcx, rsi
call sym.sqlite3_result_error
jmp 0x140008dff
mov rax, rbx
xor r13d, r13d
jmp 0x1400090c4