Function at 0x14010bf50
Capabilities:
Move file

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [r11 + 0x18], rbp
lea r8, str._s_corrupt
mov qword [r11 + 0x20], r12
mov r14, rcx
mov r12, rdx
lea rcx, [rsp + 0x50]
mov r9, rdx
mov edx, 0x105
call fcn.1400b4140
mov rax, qword [r14]
mov rdx, qword [rax]
cmp qword [rdx + 0x30], 0
je 0x14010c062
mov r8, qword [r14 + 8]
lea rcx, [rsp + 0x50]
mov edx, 2
mov r8, qword [r8]
call fcn.14010fb00
mov rbp, rax
test rax, rax
je 0x14010c062
lea rcx, str.persist_wal
mov dword [rsp + 0x40], 1
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rcx, qword [r14 + 8]
lea r9, [rsp + 0x40]
xor edx, edx
mov rdi, rax
mov rbx, qword [rcx]
mov rcx, rbp
lea r8d, [rdx + 0xa]
call fcn.14019be60
mov r9, rdi
mov r8, rbx
mov rdx, rbp
mov ecx, eax
call fcn.14010dd50
mov rcx, qword [r14 + 0x10]
mov byte [rcx], al
lea rcx, str.replace_database
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rcx, qword [r14 + 8]
xor edx, edx
mov rsi, rax
mov rdi, qword [rcx]
lea r8d, [rdx + 0x66]
mov rcx, qword [r14]
mov r9, qword [rcx]
mov rcx, rbp
mov r9, qword [r9 + 0x30]
call fcn.14019be60
mov rbx, qword [r14 + 0x10]
mov r9, rsi
mov r8, rdi
mov rdx, rbp
mov ecx, eax
call fcn.14010dd50
and byte [rbx], al
mov rcx, rbp
call fcn.1401b02f0
mov rax, qword [r14 + 0x10]
xor esi, esi
lea r15d, [rsi + 3]
cmp byte [rax], sil
jne 0x14010c1bb
mov rax, qword [r14]
mov rdx, qword [rax]
cmp qword [rdx + 0x30], rsi
je 0x14010c0ea
mov rax, qword [r14 + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x14010c092
mov rbp, qword [rcx]
jmp 0x14010c095
mov rbp, rsi
mov rax, qword [rdx + 0x10]
lea rcx, str.Tried_to_rename_corrupt_database_at_path_____but_we_failed:_____trying_explicit_rename
mov rdi, qword [rax + 0x10]
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
lea rcx, [0x14029df90]
mov rbx, rax
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov qword [rsp + 0x38], rbp
lea r9, str.D:BWA61422F5C_3951_0_securityWin2_201_srcrootOSXutilities_srcSecDb.c
mov qword [rsp + 0x30], rdi
lea r8, str.SecDbHandleCorrupt::_lambda_dd9b954dabf18622af4a44e55bb92f9a_::operator___
mov qword [rsp + 0x28], rbx
mov rdx, rax
mov ecx, r15d
mov dword [rsp + 0x20], 0x366
call fcn.140109c60
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
test rbx, rbx
je 0x14010c107
mov rcx, qword [rbx]
test rcx, rcx
je 0x14010c104
call qword [sym.imp.CoreFoundation.dll_CFRelease]
mov qword [rbx], rsi
mov rax, qword [r14]
mov rcx, qword [rax]
cmp qword [rcx + 0x30], rsi
je 0x14010c14a
lea rcx, str.close
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rcx, qword [r14 + 8]
mov rdi, rax
mov rbx, qword [rcx]
mov rcx, qword [r14]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
call fcn.1401b02f0
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.14010dcb0
test al, al
je 0x14010c1bb
mov rax, qword [r14]
mov rcx, qword [rax]
mov qword [rcx + 0x30], rsi
lea rcx, str.rename__s__s
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x50]
mov rdi, rax
mov rbx, qword [rcx]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rcx, [rsp + 0x50]
mov r9, r12
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov ecx, eax
mov rdx, rbx
call fcn.14010a050
test al, al
je 0x14010c1b3
mov r8, qword [r14 + 8]
xor edx, edx
mov rcx, qword [r14]
mov r8, qword [r8]
mov rcx, qword [rcx]
call fcn.14010e620
test al, al
je 0x14010c1b3
mov cl, 1
jmp 0x14010c1b5
xor cl, cl
mov rax, qword [r14 + 0x10]
mov byte [rax], cl
mov rax, qword [r14 + 0x10]
mov r12, qword [rsp + 0x1b8]
mov rbp, qword [rsp + 0x1b0]
cmp byte [rax], sil
je 0x14010c20b
mov rax, qword [r14]
lea rcx, str.Database_at_path____is_corrupt._Copied_it_to__s_for_further_investigation.
mov rdx, qword [rax]
mov rax, qword [rdx + 0x10]
mov rdi, qword [rax + 0x10]
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
lea rcx, [0x14029df90]
mov rbx, rax
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov ecx, 0x371
lea rsi, [rsp + 0x50]
jmp 0x14010c250
mov rax, qword [r14 + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x14010c21a
mov rsi, qword [rcx]
mov rax, qword [r14]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x10]
lea rcx, str.Tried_to_copy_corrupt_database_at_path_____but_we_failed:___
mov rdi, qword [rax + 0x10]
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
lea rcx, [0x14029df90]
mov r15d, 2
mov rbx, rax
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov ecx, 0x373
mov qword [rsp + 0x38], rsi
lea r9, str.D:BWA61422F5C_3951_0_securityWin2_201_srcrootOSXutilities_srcSecDb.c
mov qword [rsp + 0x30], rdi
lea r8, str.SecDbHandleCorrupt::_lambda_dd9b954dabf18622af4a44e55bb92f9a_::operator___
mov qword [rsp + 0x28], rbx
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov ecx, r15d
call fcn.140109c60
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x170
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [rdx]
add rcx, 8
jmp 0x14010bf50