joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4113ca
Capabilities:
Execute command

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.__acrt_iob_func]
mov rbx, rcx
mov rcx, qword [rcx + 0x40]
cmp byte [rbx + 0x138], 0x7c
jne 0x4113f4
call qword [sym.imp.msvcrt.dll__pclose]
jmp 0x41149c
call sym.output_file_close
cmp byte [rbx + 0xe], 0
je 0x41149c
mov r8, qword [rbx + 0x98]
lea rdx, str.start
lea rcx, [0x004d5c42]
call sym.sqlite3_mprintf
mov rcx, rax
mov rsi, rax
call sym.system
test eax, eax
je 0x411447
mov ecx, 2
call rbp
lea rdx, str.Failed:___s__n
mov r8, rsi
mov rcx, rax
call sym.utf8_printf
jmp 0x411451
mov ecx, 0x7d0
call sym.sqlite3_sleep
mov rcx, rsi
call sym.sqlite3_free
mov eax, dword [rbx + 0x58]
mov ecx, 5
lea rsi, [rbx + 0xe6]
mov dword [rbx + 0x54], eax
mov eax, dword [rbx + 0x80]
mov dword [rbx + 0x7c], eax
lea rax, [rbx + 0xbe]
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
lea rax, [rbx + 0xd2]
mov ecx, 5
lea rsi, [rbx + 0xfa]
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov byte [rbx + 0xe], 0
mov byte [rbx + 0x138], 0
mov ecx, 1
call rbp
mov qword [rbx + 0x40], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x41640d
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov r12d, edx
mov rbp, rcx
lea rdx, [0x004d4489]
call sym.fopen
test rax, rax
mov rbx, rax
jne 0x416459
test r12d, r12d
je 0x41649a
xor r8d, r8d
mov rdx, rbp
mov esi, 3
lea rcx, str._.zip
call sym.sqlite3_strlike
test eax, eax
jne 0x41649a
jmp 0x41656e
lea rdi, [rsp + 0x2c]
mov r9, rax
mov r8d, 1
mov edx, 0x10
mov rcx, rdi
call sym.fread
dec rax
jne 0x4164a4
lea rdx, [0x004d7b6a]
mov r8d, 0x10
mov rcx, rdi
call sym.memcmp
test eax, eax
jne 0x4164a4
mov rcx, rbx
call sym.fclose
mov esi, 1
jmp 0x41656e
mov r8d, 2
mov edx, 0xffffffe7
mov rcx, rbx
call sym.fseek
mov r9, rbx
mov edx, 0x19
mov rcx, rdi
mov r8d, 1
call sym.fread
dec rax
jne 0x4164f0
mov r8d, 0x11
mov rcx, rdi
mov esi, 2
lea rdx, str.Start_Of_SQLite3_
call sym.memcmp
test eax, eax
je 0x416560
mov r8d, 2
mov edx, 0xffffffea
mov rcx, rbx
call sym.fseek
mov r9, rbx
mov edx, 0x16
mov rcx, rdi
mov r8d, 1
call sym.fread
cmp rax, 1
jne 0x41653b
cmp byte [rsp + 0x2c], 0x50
jne 0x41656a
cmp byte [rsp + 0x2d], 0x4b
jne 0x41656a
cmp byte [rsp + 0x2e], 5
jne 0x41656a
cmp byte [rsp + 0x2f], 6
jmp 0x416559
test rax, rax
jne 0x41656a
test r12d, r12d
je 0x41656a
lea rcx, str._.zip
xor r8d, r8d
mov rdx, rbp
call sym.sqlite3_strlike
test eax, eax
jne 0x41656a
mov esi, 3
mov rcx, rbx
call sym.fclose
jmp 0x41656e
xor esi, esi
jmp 0x416560
mov eax, esi
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x416dbc
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
call sym.clearTempFile
mov rcx, qword [rbx + 0x98]
call sym.sqlite3_free
mov rcx, qword [rbx]
mov qword [rbx + 0x98], 0
test rcx, rcx
je 0x416e00
lea r9, [rbx + 0x98]
mov r8d, 0x10
xor edx, edx
call sym.sqlite3_file_control
mov rdx, qword [rbx + 0x98]
test rdx, rdx
jne 0x416e5d
lea rdx, [rsp + 0x28]
mov ecx, 8
call sym.sqlite3_randomness
lea rcx, str.TEMP
call sym.getenv
test rax, rax
jne 0x416e44
lea rcx, [0x004d7d94]
call sym.getenv
test rax, rax
jne 0x416e44
lea rax, str._tmp
mov r8, qword [rsp + 0x28]
mov r9, rsi
mov rdx, rax
lea rcx, str._s_temp_llx._s
call sym.sqlite3_mprintf
jmp 0x416e6c
lea rcx, str._z._s
mov r8, rsi
call sym.sqlite3_mprintf
mov qword [rbx + 0x98], rax
mov rcx, qword [rbx + 0x98]
call sym.shell_check_oom
nop
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x41fedb
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r9d, r9d
xor r11d, r11d
movsxd rax, dword [rcx + 0xc]
lea r10d, [rax + 1]
add rax, qword [rcx]
mov bl, byte [rdx + r9]
xor byte [rax], bl
movsxd rax, r10d
cmp dword [rcx + 8], r10d
cmovle rax, r11
inc r9
cmp r8d, r9d
jg 0x41fee6
add dword [rcx + 0x10], r8d
mov dword [rcx + 0xc], eax
pop rbx
ret

Function at 0x42d6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
cmp ecx, 0x7f
jg 0x42d6db
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x42d77f
add ecx, 0x20
jmp 0x42d77f
cmp ecx, 0xffff
jg 0x42d771
lea rbx, [0x004ea260]
or rax, 0xffffffffffffffff
xor r11d, r11d
mov r10d, 0xa2
mov r9, rbx
lea r8d, [r10 + r11]
sar r8d, 1
movsxd rsi, r8d
movzx esi, word [rbx + rsi*4]
cmp ecx, esi
js 0x42d719
lea r11d, [r8 + 1]
movsxd rax, r8d
jmp 0x42d71d
lea r10d, [r8 - 1]
cmp r11d, r10d
jle 0x42d6fe
movzx r8d, word [r9 + rax*4]
movzx r10d, byte [r9 + rax*4 + 3]
add r10d, r8d
cmp ecx, r10d
jge 0x42d75d
mov al, byte [r9 + rax*4 + 2]
xor r8d, ecx
mov r9d, eax
and r9d, 1
test r9d, r8d
jne 0x42d75d
lea r8, [0x004e9cc0]
shr al, 1
and eax, 0x7f
add cx, word [r8 + rax*2]
movzx ecx, cx
test edx, edx
je 0x42d77f
cmp edx, 2
sete dl
movzx edx, dl
pop rbx
pop rsi
jmp sym.remove_diacritic
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x42d77f
add ecx, 0x28
mov eax, ecx
pop rbx
pop rsi
ret

Function at 0x431e2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebp, dword [rcx + 0x80]
movsxd rdx, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x78]
mov rsi, rdx
imul rdx, rdx, 0x38
call sym.sqlite3Realloc
test rax, rax
mov r8, rax
jne 0x431e60
mov eax, 7
jmp 0x431efc
movsxd rdi, ebp
mov ecx, esi
imul rdi, rdi, 0x38
sub ecx, ebp
movsxd rcx, ecx
imul rcx, rcx, 0x38
lea rdx, [rax + rdi]
xor eax, eax
mov rdi, rdx
rep stosb byte [rdi], al
mov qword [rbx + 0x78], r8
mov rdi, rdx
cmp ebp, esi
jge 0x431efa
mov rax, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x20]
cmp qword [rax], 0
mov dword [rdi + 0x18], ecx
je 0x431ea1
mov rax, qword [rbx + 0x60]
test rax, rax
jg 0x431ea7
mov eax, dword [rbx + 0xb8]
mov qword [rdi], rax
mov eax, dword [rbx + 0x3c]
mov dword [rdi + 0x1c], eax
call sym.sqlite3BitvecCreate
mov dword [rdi + 0x20], 1
test rax, rax
mov qword [rdi + 0x10], rax
je 0x431e56
mov rax, qword [rbx + 0x128]
test rax, rax
je 0x431eec
mov edx, dword [rax + 0x58]
mov dword [rdi + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rdi + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rdi + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rdi + 0x30], eax
inc ebp
add rdi, 0x38
mov dword [rbx + 0x80], ebp
jmp 0x431e84
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4a6eb9
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov r12d, edx
mov rdi, r8
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov rbp, r9
mov qword [rsp + 0x48], rax
movsxd rax, edx
lea rsi, [rcx + rax*8]
cmp qword [rsi + 0x28], 0
jne 0x4a6f0b
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call sym.rtreeCheckPrepare
mov qword [rsi + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x4a6fc5
mov rsi, qword [rsi + 0x28]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call sym.sqlite3_bind_int64
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x65
jne 0x4a6f67
test r12d, r12d
mov r9, rbp
mov r8, rdi
lea rdx, str.__parent
mov rcx, rbx
lea rax, str.__rowid
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x4a6fb4
cmp eax, 0x64
jne 0x4a6fb4
xor edx, edx
mov rcx, rsi
call sym.sqlite3_column_int64
cmp rbp, rax
mov r9, rax
je 0x4a6fb4
test r12d, r12d
mov qword [rsp + 0x30], rbp
mov r8, rdi
mov rcx, rbx
lea rdx, str.__rowid
mov qword [rsp + 0x28], rdi
lea rax, str.__parent
cmove rdx, rax
mov qword [rsp + 0x20], rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
call sym.rtreeCheckAppendMsg
mov rcx, rsi
call sym.sqlite3_reset
cmp dword [rbx + 0x40], 0
jne 0x4a6fc5
mov dword [rbx + 0x40], eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4a801b
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [rcx]
mov r13, qword [rsp + 0xa0]
mov rbx, rcx
mov ebp, edx
call sym.statResetCsr
mov rcx, qword [rbx + 8]
mov esi, ebp
call sym.sqlite3_finalize
and esi, 1
mov qword [rbx + 8], 0
je 0x4a8081
mov rcx, qword [r13]
call sym.sqlite3_value_text
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call sym.sqlite3FindDbName
test eax, eax
jns 0x4a8084
mov dword [rbx + 0x14], 0
xor eax, eax
mov byte [rbx + 0x10], 1
jmp 0x4a8192
mov eax, dword [rdi + 0x20]
xor r12d, r12d
test bpl, 2
mov dword [rbx + 0x14], eax
je 0x4a80a7
lea r14d, [rsi + 1]
movsxd rsi, esi
mov rcx, qword [r13 + rsi*8]
mov esi, r14d
call sym.sqlite3_value_text
mov r12, rax
test bpl, 4
je 0x4a80ce
movsxd rsi, esi
mov rcx, qword [r13 + rsi*8]
call sym.sqlite3VdbeRealValue
xorps xmm1, xmm1
mov dl, 1
ucomisd xmm0, xmm1
setp al
cmovne eax, edx
mov byte [rbx + 0x11], al
jmp 0x4a80d2
mov byte [rbx + 0x11], 0
mov rcx, qword [rdi + 0x18]
call sym.sqlite3_str_new
mov rdx, qword [rdi + 0x18]
mov rsi, rax
movsxd rax, dword [rbx + 0x14]
mov rcx, rsi
shl rax, 5
add rax, qword [rdx + 0x20]
lea rdx, str.SELECT__FROM__SELECT_sqlite_schema_AS_name_1_AS_rootpage_table_AS_type_UNION_ALL_SELECT_name_rootpage_type_FROM___w_.sqlite_schema_WHERE_rootpage_0_
mov r8, qword [rax]
call sym.sqlite3_str_appendf
test r12, r12
je 0x4a8117
lea rdx, str.WHERE_name_Q
mov r8, r12
mov rcx, rsi
call sym.sqlite3_str_appendf
and bpl, 8
je 0x4a812c
lea rdx, str._ORDER_BY_name
mov rcx, rsi
call sym.sqlite3_str_appendf
mov rcx, rsi
call sym.sqlite3_str_finish
test rax, rax
mov rsi, rax
je 0x4a818d
mov rcx, qword [rdi + 0x18]
lea r9, [rbx + 8]
or r8d, 0xffffffff
mov rdx, rax
mov qword [rsp + 0x20], 0
call sym.sqlite3_prepare_v2
mov rcx, rsi
mov dword [rsp + 0x3c], eax
call sym.sqlite3_free
mov eax, dword [rsp + 0x3c]
test eax, eax
jne 0x4a8192
mov dword [rbx + 0x818], 0xffffffff
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.statNext
mov eax, 7
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4a81fa
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
test r8d, r8d
mov rsi, rdx
mov rbp, rcx
mov rdx, qword [rdx + 0x30]
mov r12, r9
je 0x4a8263
lea rcx, str.PRAGMA__Q.page_size
mov dword [rsp + 0x2c], 0
call sym.sqlite3_mprintf
test rax, rax
mov rdi, rax
je 0x4a8292
lea r8, [rsp + 0x2c]
mov rdx, rax
mov rcx, rbp
call sym.getIntFromStmt.part.673
test eax, eax
mov ebx, eax
jne 0x4a8297
movzx edx, byte [rsi + 0x27]
mov eax, dword [rsp + 0x2c]
imul edx, edx, 0x33
sub eax, 0x40
add edx, 4
cmp eax, edx
cmovg eax, edx
mov dword [rsi + 0x20], eax
jmp 0x4a82d6
mov r8, qword [rsi + 0x38]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.sqlite3_mprintf
test rax, rax
mov rdi, rax
je 0x4a8292
lea r8, [rsi + 0x20]
mov rdx, rax
mov rcx, rbp
call sym.getIntFromStmt.part.673
test eax, eax
mov ebx, eax
je 0x4a82b4
jmp 0x4a8297
mov ebx, 7
mov rcx, rbp
call sym.sqlite3_errmsg
lea rcx, [0x004e187e]
mov rdx, rax
call sym.sqlite3_mprintf
mov qword [r12], rax
jmp 0x4a82d6
cmp dword [rsi + 0x20], 0x1bf
jg 0x4a82d6
mov rdx, qword [rsi + 0x38]
lea rcx, str.undersize_RTree_blobs_in___q_node_
mov ebx, 0x10b
call sym.sqlite3_mprintf
mov qword [r12], rax
mov rcx, rdi
call sym.sqlite3_free
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4a9152
Capabilities:
Reference sql statements

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor edi, edi
movsxd rbp, edx
mov rbx, rcx
mov qword [rsp + 0xf0], r8
mov r14, r9
lea r13, [rcx + rbp*8]
mov r12, rbp
cmp qword [r13 + 0x28], 0
jne 0x4a9323
lea rdi, [rsp + 0x38]
cmp ebp, 0xa
mov ecx, 0x16
lea rsi, str.SELECT__s_FROM__s_T_WHERE_T._Q_____AND_T._Q_____ORDER_BY_T._Q_ASC
rep movsd dword [rdi], dword [rsi]
mov rsi, qword [rbx]
ja case.0x4a91b9.5
lea rdx, [0x004e6f90]
mov eax, ebp
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rdx, qword [rsi + 0x60]
mov r8, qword [rsi + 0x48]
mov rcx, qword [rsp + 0x88]
call sym.sqlite3_mprintf
mov r9d, 5
test rax, rax
mov r15, rax
jne 0x4a92c8
mov edi, 7
jmp 0x4a9323
mov r9, qword [rsi + 0x50]
mov r8, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsp + rbp*8 + 0x38]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
call sym.sqlite3_mprintf
jmp 0x4a92a9
mov r9, qword [rsi + 0x50]
mov rdx, qword [rsi + 0x60]
mov r8, qword [rsi + 0x48]
mov rcx, qword [rsp + 0x48]
call sym.sqlite3_mprintf
mov r9d, 1
test rax, rax
mov r15, rax
jne 0x4a92c8
jmp 0x4a91e2
mov eax, dword [rsi + 0x18]
lea r15d, [rax + 1]
lea ecx, [r15 + r15 + 1]
movsxd rcx, ecx
call sym.sqlite3_malloc64
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x4a91e2
lea rcx, [rax + rax]
cmp r15d, eax
jle 0x4a9270
mov byte [rdi + rax*2], 0x3f
mov byte [rdi + rax*2 + 1], 0x2c
inc rax
jmp 0x4a9259
mov byte [rdi + rcx - 1], 0
mov rcx, qword [rsp + rbp*8 + 0x38]
mov r9, rdi
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call sym.sqlite3_mprintf
mov rcx, rdi
mov r15, rax
call sym.sqlite3_free
jmp 0x4a92ac
mov rdx, qword [rsi + 8]
mov rcx, qword [rsp + rbp*8 + 0x38]
mov r8, qword [rsi + 0x10]
call sym.sqlite3_mprintf
mov r15, rax
test r15, r15
je 0x4a91e2
xor r9d, r9d
cmp r12d, 2
setg r9b
lea r9d, [r9*4 + 1]
mov rax, qword [rbx]
or r8d, 0xffffffff
mov rdx, r15
inc dword [rax + 0x78]
lea rax, [rbx + rbp*8 + 0x28]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov rcx, qword [rsi]
call sym.sqlite3_prepare_v3
mov rcx, r15
mov edi, eax
mov rax, qword [rbx]
dec dword [rax + 0x78]
call sym.sqlite3_free
test edi, edi
je 0x4a9323
test r14, r14
je 0x4a9323
mov rcx, qword [rsi]
call sym.sqlite3_errmsg
lea rcx, [0x004e187e]
mov rdx, rax
call sym.sqlite3_mprintf
mov qword [r14], rax
mov rcx, qword [r13 + 0x28]
mov rax, qword [rsp + 0xf0]
mov qword [rax], rcx
call sym.sqlite3_reset
mov eax, edi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4af16f
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov r12d, r8d
mov rsi, rdx
mov rdi, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rbx, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov dword [rsp + 0x30], ebp
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
call sym.sqlite3NestedParse
test r12d, r12d
jne 0x4af1db
mov r9, rdi
mov r8, rsi
mov rcx, rbx
mov dword [rsp + 0x90], ebp
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.sqlite3NestedParse
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4b6009
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xa], 0
mov rbx, rcx
je 0x4b6024
mov byte [rcx + 0xa], 0
mov rcx, qword [rcx + 0x38]
call sym.sqlite3_reset
mov rcx, rbx
call sym.rtreeSearchPointPop
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.rtreeStepToLeaf
Function at 0x4bb08d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor r13d, r13d
mov rax, qword [rcx]
mov r14, qword [rsp + 0x90]
mov ebp, edx
mov r12d, dword [rax + 0x38]
mov rbx, rcx
call sym.fts5VocabResetCursor
mov eax, ebp
and eax, 1
je 0x4bb0c1
mov r13, qword [r14]
xor esi, esi
test bpl, 2
je 0x4bb0d2
movsxd rdx, eax
inc eax
mov rsi, qword [r14 + rdx*8]
xor edi, edi
and bpl, 4
je 0x4bb0e0
cdqe
mov rdi, qword [r14 + rax*8]
test r13, r13
je 0x4bb100
mov rcx, r13
call sym.sqlite3_value_text
mov rcx, r13
mov rbp, rax
call sym.sqlite3_value_bytes
xor r9d, r9d
mov r13d, eax
jmp 0x4bb176
test rsi, rsi
je 0x4bb11d
mov rcx, rsi
call sym.sqlite3_value_text
mov rcx, rsi
mov rbp, rax
call sym.sqlite3_value_bytes
mov r13d, eax
jmp 0x4bb122
xor r13d, r13d
xor ebp, ebp
test rdi, rdi
je 0x4bb170
mov rcx, rdi
call sym.sqlite3_value_text
test rax, rax
mov rsi, rax
jne 0x4bb13e
lea rsi, [0x004e0719]
mov rcx, rdi
call sym.sqlite3_value_bytes
mov dword [rbx + 0x30], eax
lea ecx, [rax + 1]
call sym.sqlite3_malloc
mov rdx, rax
mov qword [rbx + 0x38], rax
mov eax, 7
test rdx, rdx
je 0x4bb1af
mov eax, dword [rbx + 0x30]
mov rdi, rdx
lea ecx, [rax + 1]
movsxd rcx, ecx
rep movsb byte [rdi], byte [rsi]
mov r9d, 8
mov rax, qword [rbx + 0x10]
mov r8d, r13d
mov rdx, rbp
mov rsi, qword [rax + 0x20]
lea rax, [rbx + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
mov rcx, rsi
call sym.sqlite3Fts5IndexQuery
test eax, eax
jne 0x4bb1af
mov rdx, qword [rsi + 0x88]
inc dword [rdx]
mov qword [rbx + 0x28], rdx
test eax, eax
jne 0x4bb1c1
cmp r12d, 2
jne 0x4bb1c1
mov rcx, rbx
call sym.fts5VocabInstanceNewTerm
test eax, eax
jne 0x4bb1f5
cmp dword [rbx + 0x18], 0
jne 0x4bb1f5
cmp r12d, 2
jne 0x4bb1df
mov rdx, qword [rbx + 0x10]
mov rdx, qword [rdx + 0x18]
cmp dword [rdx + 0x5c], 1
je 0x4bb1f5
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.fts5VocabNextMethod
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4bdf2b
Capabilities:
Reference sql statements

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [rcx + 0x3c], 0
mov r8, qword [rcx + 0x18]
mov r9, qword [rcx + 0x20]
mov rbx, rcx
mov rdi, rdx
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x38], 0
je 0x4bdf75
lea rcx, str.recursive_definition_for__s._s
mov rdx, r9
call sym.sqlite3_mprintf
mov qword [rbx + 0x10], rax
mov eax, 1
jmp 0x4be0e8
lea rbp, [rsp + 0x34]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea rdx, str.SELECT_t._Q_FROM__Q._Q_AS_t_WHERE_t._Q_MATCH_id
mov rcx, rbp
call sym.sqlite3Fts5Mprintf
test rax, rax
mov rsi, rax
je 0x4bdfbd
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x38]
or r8d, 0xffffffff
mov rdx, rax
mov qword [rsp + 0x20], 0
call sym.sqlite3_prepare_v2
mov dword [rsp + 0x34], eax
mov rcx, rsi
call sym.sqlite3_free
cmp dword [rsp + 0x34], 1
jne 0x4bdfd4
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x38]
mov dword [rbx + 0x3c], 1
test rcx, rcx
jne 0x4bdfe9
xor esi, esi
jmp 0x4be01b
call sym.sqlite3_step
cmp eax, 0x64
jne 0x4bdfe5
mov rcx, qword [rsp + 0x38]
xor edx, edx
call sym.sqlite3_column_int64
mov rdx, qword [rbx + 0x30]
mov rdx, qword [rdx + 0x48]
test rdx, rdx
je 0x4bdfe5
cmp rax, qword [rdx + 0x18]
je 0x4be018
mov rdx, qword [rdx + 8]
jmp 0x4be007
mov rsi, qword [rdx]
cmp dword [rsp + 0x34], 0
mov dword [rbx + 0x3c], 0
jne 0x4be0da
test rsi, rsi
jne 0x4be073
mov rcx, qword [rsp + 0x38]
call sym.sqlite3_finalize
mov qword [rsp + 0x38], 0
test eax, eax
mov dword [rsp + 0x34], eax
jne 0x4be0da
mov rdx, qword [rbx + 0x20]
lea rcx, str.no_such_fts5_table:__s._s
mov r8, qword [rbx + 0x18]
call sym.sqlite3_mprintf
mov dword [rsp + 0x34], 1
mov qword [rbx + 0x10], rax
jmp 0x4be0da
mov rcx, rsi
call sym.fts5TripCursors
mov rcx, qword [rsi + 0x28]
call sym.sqlite3Fts5StorageSync
test eax, eax
mov dword [rsp + 0x34], eax
jne 0x4be0da
mov rax, qword [rsi + 0x18]
mov rcx, rbp
movsxd rdx, dword [rax + 0x18]
add rdx, 8
shl rdx, 4
call sym.sqlite3Fts5MallocZero
test rax, rax
je 0x4be0da
mov rcx, qword [rsi + 0x18]
mov qword [rax + 0x10], rsi
mov rdx, qword [rsp + 0x38]
movsxd rcx, dword [rcx + 0x18]
mov qword [rax + 8], rdx
lea rdx, [rax + 0x80]
mov qword [rax + 0x48], rdx
lea rdx, [rdx + rcx*8]
mov qword [rax + 0x50], rdx
mov qword [rdi], rax
mov eax, dword [rsp + 0x34]
jmp 0x4be0e8
mov rcx, qword [rsp + 0x38]
call sym.sqlite3_finalize
xor eax, eax
jmp 0x4be0d1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4c95a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00509c04]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4c9728
mov rax, qword [0x00509c08]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4c95ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4c9675
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x4c95d0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4c975d
mov rax, qword [0x00509c08]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00509c08]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4c9740
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4c966e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x4c96d0
add dword [0x00509c04], 1
cmp edi, 8
jae 0x4c96a3
test dil, 4
jne 0x4c9714
test edi, edi
je 0x4c9698
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4c972f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x4c9698
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x4c96bc
jmp 0x4c9698
add rsi, qword [0x00509c08]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4c966e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x4c9698
xor esi, esi
jmp 0x4c95f7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x4c9698
mov rax, qword [0x00509c08]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x4c9eb0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00509ee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00509ec0]
test rbx, rbx
je 0x4c9f04
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4c9efb
test rsi, rsi
je 0x4c9efb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4c9ee0
lea rcx, [0x00509ee0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]