joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140140b20
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140320350]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140140b40
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140140b48
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140140b40
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x140140b90
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140140b87
test rcx, rcx
je 0x140140b40
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140140b78
xor eax, eax
ret

Function at 0x140140ba0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140320350]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140140bbf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140140bc8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140140be0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140320350]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140140c00
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140140c08
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140140c00
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x140140c00
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140140c54
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140140c60
add rdx, 0x28
cmp r9, rdx
jne 0x140140c40
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140140c70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140320350]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140140c92
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140140ca0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140140c92
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140140c92
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x140140c92
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x140140cf5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140140d08
add rdx, 0x28
cmp rdx, r10
jne 0x140140ce0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140140d17
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140140d27
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140140cfe
test ecx, ecx
jg 0x140140d10
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14014ffa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9d, dword [rcx + 0x60]
mov ebx, dword [rcx + 0x5c]
test r9d, r9d
mov r8, rcx
jle 0x140150068
mov r10, qword [0x1403202d0]
movzx r11d, bl
mov edx, dword [rcx + 0x288]
xor ecx, ecx
nop word [rax + rax]
mov eax, edx
add ecx, 1
shl edx, 8
shr eax, 0x18
xor eax, r11d
xor edx, dword [r10 + rax*4]
cmp ecx, r9d
jne 0x14014ffd0
mov eax, ebx
mov dword [r8 + 0x288], edx
mov byte [r8 + rax + 0x80], 1
movsxd rax, dword [r8 + 0x6c]
add rax, qword [r8 + 0x40]
cmp ecx, 2
je 0x140150060
cmp ecx, 3
je 0x140150020
cmp ecx, 1
jne 0x140150072
mov byte [rax], bl
mov eax, dword [r8 + 0x6c]
add eax, 1
mov dword [r8 + 0x6c], eax
pop rbx
ret
mov byte [rax], bl
mov eax, dword [r8 + 0x6c]
mov rdx, qword [r8 + 0x40]
add eax, 1
mov dword [r8 + 0x6c], eax
cdqe
mov byte [rdx + rax], bl
mov eax, dword [r8 + 0x6c]
mov rdx, qword [r8 + 0x40]
add eax, 1
mov dword [r8 + 0x6c], eax
cdqe
mov byte [rdx + rax], bl
mov eax, dword [r8 + 0x6c]
add eax, 1
mov dword [r8 + 0x6c], eax
pop rbx
ret
mov byte [rax], bl
jmp 0x140150036
mov eax, ebx
mov byte [rcx + rax + 0x80], 1
sub r9d, 4
movsxd r9, r9d
mov byte [r8 + r9 + 0x80], 1
movsxd rax, dword [r8 + 0x6c]
mov rdx, qword [r8 + 0x40]
mov byte [rdx + rax], bl
mov eax, dword [r8 + 0x6c]
mov rdx, qword [r8 + 0x40]
add eax, 1
mov dword [r8 + 0x6c], eax
cdqe
mov byte [rdx + rax], bl
mov eax, dword [r8 + 0x6c]
mov rdx, qword [r8 + 0x40]
add eax, 1
mov dword [r8 + 0x6c], eax
cdqe
mov byte [rdx + rax], bl
mov eax, dword [r8 + 0x6c]
mov rdx, qword [r8 + 0x40]
add eax, 1
mov dword [r8 + 0x6c], eax
cdqe
mov byte [rdx + rax], bl
mov eax, dword [r8 + 0x6c]
mov edx, dword [r8 + 0x60]
mov rcx, qword [r8 + 0x40]
add eax, 1
mov dword [r8 + 0x6c], eax
sub edx, 4
cdqe
mov byte [rcx + rax], dl
mov eax, dword [r8 + 0x6c]
add eax, 1
mov dword [r8 + 0x6c], eax
pop rbx
ret
Function at 0x1401543a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140323ee0]
mov r13, qword [rcx + 0xa0]
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test r13, r13
mov rsi, rcx
jne 0x1401544bb
jmp 0x140154510
sub eax, 1
mov byte [rsi + 0x1f], al
movzx eax, al
mov r14d, dword [rsi + rax*4 + 0xe4]
movsxd rax, dword [rdi + 0x90]
lea edx, [rbx + 2]
cmp eax, dword [rdi + 0x94]
lea r9d, [rax + 7]
jge 0x1401544f0
lea ecx, [rax + 1]
mov dword [rdi + 0x90], ecx
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
lea rax, [rax + rcx*8]
mov dword [rax + 4], edx
mov dword [rax + 8], r9d
mov dword [rax + 0xc], ebx
mov qword [rax + 0x10], 0
mov dword [rax], 0x37
mov rax, qword [r15 + 0x18]
xor edx, edx
mov rcx, rsi
mov r9, qword [rax + 0x68]
mov dword [rsp + 0x20], 0x71
call sym.sqlite3OpenTable
mov rdx, rbp
mov rcx, rdi
call sym.sqlite3VdbeAddOpList.constprop.1
test rax, rax
je 0x140154510
lea edx, [rbx + 1]
movd xmm0, r14d
sub ebx, 1
mov dword [rax + 0x3c], r14d
movd xmm1, edx
mov dword [rax + 4], edx
test r14d, r14d
mov dword [rax + 0x20], edx
mov edx, 8
punpckldq xmm0, xmm1
mov dword [rax + 0x34], ebx
movq qword [rax + 0x50], xmm0
mov word [rax + 0x4a], dx
je 0x1401544b2
movzx eax, byte [rsi + 0x1f]
cmp al, 7
ja 0x1401544b2
lea edx, [rax + 1]
mov byte [rsi + 0x1f], dl
mov dword [rsi + rax*4 + 0xe4], r14d
mov r13, qword [r13]
test r13, r13
je 0x140154510
movsxd r15, dword [r13 + 0x10]
movzx eax, byte [rsi + 0x1f]
mov ebx, dword [r13 + 0x14]
mov r8, r15
shl r15, 5
add r15, qword [r12 + 0x20]
test al, al
jne 0x1401543e0
mov eax, dword [rsi + 0x38]
lea r14d, [rax + 1]
mov dword [rsi + 0x38], r14d
jmp 0x1401543f1
mov r8d, edx
mov dword [rsp + 0x20], ebx
mov edx, 0x37
mov rcx, rdi
call sym.growOp3
mov r8d, dword [r13 + 0x10]
jmp 0x14015443b
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016aa40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movzx eax, byte [rdx]
cmp al, 0xb0
mov rdi, rdx
mov rsi, rcx
mov edx, eax
jne 0x14016aa68
movzx edx, byte [rdi + 2]
cmp dl, 0xb1
je 0x14016abf8
cmp dl, 0x8a
je 0x14016aaa0
movaps xmm6, xmmword [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3ExprCodeTemp
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdx + 0x20]
mov ebp, dword [rcx]
cmp ebp, 1
je 0x14016aa76
cmp al, 0x8a
mov dword [r8], 0
je 0x14016ac08
mov eax, dword [rsi + 0x38]
lea r13d, [rax + 1]
add eax, ebp
test ebp, ebp
mov dword [rsi + 0x38], eax
jle 0x14016abda
lea rax, [sym.sqlite3SelectWalkFail]
xor ebx, ebx
lea rcx, [sym.exprNodeIsConstant]
movq xmm0, rax
lea r14, [rsp + 0x30]
movq xmm6, rcx
punpcklqdq xmm6, xmm0
jmp 0x14016ab87
mov eax, 2
test rdx, rdx
movups xmmword [rsp + 0x38], xmm6
mov word [rsp + 0x54], ax
mov dword [rsp + 0x58], 0
je 0x14016abc8
mov rcx, r14
mov qword [rsp + 0x28], rdx
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x14016abc8
mov r15, qword [rsi]
mov rcx, r15
call sym.exprDup.constprop.0
cmp byte [r15 + 0x67], 0
mov rdx, rax
jne 0x14016ab6f
cmp qword [rsi + 0x10], 0
je 0x14016ab6f
mov r8d, r12d
mov rcx, rsi
mov qword [rsp + 0x28], rax
call sym.sqlite3ExprCode.part.0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14016ab7c
mov rcx, r15
call sym.sqlite3ExprDeleteNN
add ebx, 1
cmp ebx, ebp
je 0x14016abda
mov rdx, qword [rdi + 0x20]
lea r12d, [r13 + rbx]
movsxd rax, ebx
shl rax, 5
cmp byte [rsi + 0x23], 0
mov rdx, qword [rdx + rax + 8]
jne 0x14016ab00
test rdx, rdx
mov r15, qword [rsi]
jne 0x14016ab41
cmp byte [r15 + 0x67], 0
jne 0x14016ab7c
cmp qword [rsi + 0x10], 0
je 0x14016ab7c
mov r8d, r12d
mov rcx, rsi
call sym.sqlite3ExprCode.part.0
jmp 0x14016ab7c
mov r8d, r12d
mov rcx, rsi
add ebx, 1
call sym.sqlite3ExprCodeRunJustOnce
cmp ebx, ebp
jne 0x14016ab83
movaps xmm6, xmmword [rsp + 0x60]
mov eax, r13d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rdi + 0x20]
mov ebp, dword [rdx]
jmp 0x14016aaaa
movaps xmm6, xmmword [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3CodeSubselect

Function at 0x140173810
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x140173840
mov edx, edx
xor eax, eax
lea r9, [rcx + rdx]
nop dword [rax]
movsx r8d, byte [rcx]
lea edx, [rax*8]
add rcx, 1
xor eax, r8d
xor eax, edx
cmp rcx, r9
jne 0x140173820
and eax, 0x7fffffff
ret
xor eax, eax
ret
Function at 0x14018d4d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov rbx, rcx
jle 0x14018d510
mov edx, edx
xor eax, eax
lea r8, [rbx + rdx]
nop dword [rax]
movsx ecx, byte [rbx]
lea edx, [rax*8]
add rbx, 1
xor eax, ecx
xor eax, edx
cmp rbx, r8
jne 0x14018d4e8
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rcx, rax
mov edx, eax
xor eax, eax
test ecx, ecx
jg 0x14018d4dc
add rsp, 0x20
pop rbx
ret
Function at 0x1401ce840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x80]
movsxd rdx, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
mov rbp, rdx
imul rdx, rdx, 0x38
call sym.sqlite3Realloc
test rax, rax
mov rdi, rax
je 0x1401ce997
movsxd rbx, r14d
mov r8d, ebp
xor edx, edx
imul rbx, rbx, 0x38
sub r8d, r14d
xor r13d, r13d
lea r12, [0x1402b90a0]
movsxd r8, r8d
imul r8, r8, 0x38
add rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_memset
cmp r14d, ebp
mov qword [rsi + 0x78], rdi
jge 0x1401ce96f
nop dword [rax]
mov rax, qword [rsi + 0x50]
mov r15d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r15d
je 0x1401ce978
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x1401ce978
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov dword [rbx + 0x1c], eax
mov eax, dword [r12]
test eax, eax
je 0x1401ce9d0
mov rcx, qword [0x1402b8d40]
test rcx, rcx
je 0x1401ce902
call qword [0x1402b9120]
mov ecx, 0x200
call sym.sqlite3Malloc.part.0
mov rdx, rax
test rdx, rdx
je 0x1401ce988
mov rax, r13
mov ecx, 0x40
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rdx], r15d
mov qword [rbx + 0x10], rdx
mov rax, qword [rsi + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x1401ce9b0
mov edx, dword [rax + 0x58]
add r14d, 1
add rbx, 0x38
mov dword [rbx - 0x14], edx
mov edx, dword [rax + 0x60]
mov dword [rbx - 0x10], edx
mov edx, dword [rax + 0x64]
mov dword [rbx - 0xc], edx
mov eax, dword [rax + 0x88]
mov dword [rbx - 8], eax
cmp ebp, r14d
mov dword [rsi + 0x80], r14d
jne 0x1401ce8b8
xor eax, eax
jmp 0x1401ce99c
mov eax, dword [rsi + 0xb8]
jmp 0x1401ce8db
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r14d, 1
add rbx, 0x38
cmp r14d, ebp
mov dword [rsi + 0x80], r14d
jne 0x1401ce8b8
xor eax, eax
jmp 0x1401ce99c
mov ecx, 0x200
call qword [0x1402b90c0]
mov rdx, rax
jmp 0x1401ce90f
Function at 0x1401d72d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [rcx]
test edx, edx
mov rdi, qword [rax + 0x18]
mov rsi, rcx
mov ebx, edx
mov rbp, r8
jg 0x1401d72f8
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x1401d72eb
movzx eax, word [rcx + 0x14]
mov edx, eax
not edx
test dx, 0x202
je 0x1401d73d8
test al, 1
jne 0x1401d72eb
mov edx, 1
call sym.valueToText
mov rdx, rax
test rdx, rdx
je 0x1401d72eb
mov eax, dword [rdi + 0x88]
sub ebx, 1
mov ecx, 0x200
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], ebx
lea r8, [rbp + 8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x48], r8
mov word [rsp + 0x6c], cx
lea r8, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 0
call sym.sqlite3_str_appendf
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x68]
test rdx, rdx
je 0x1401d73af
mov eax, r8d
mov byte [rdx + rax], 0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x1401d73aa
test byte [rsp + 0x6d], 4
je 0x1401d73f0
mov rdx, qword [rsp + 0x58]
lea rax, [sym.sqlite3OomClear]
mov r9d, 1
mov rcx, rsi
mov qword [rsp + 0x20], rax
call sym.setResultStrOrError
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp byte [rcx + 0x16], 1
jne 0x1401d7313
mov rdx, qword [rcx + 8]
jmp 0x1401d7324
mov rcx, rbx
mov dword [rsp + 0x3c], r8d
call sym.strAccumFinishRealloc
mov r8d, dword [rsp + 0x3c]
mov rdx, rax
jmp 0x1401d73af

Function at 0x1401de430
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12d, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov edi, r8d
mov rsi, rdx
mov rbp, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rbx, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov dword [rsp + 0x30], r12d
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
call sym.sqlite3NestedParse
test edi, edi
je 0x1401de488
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rbp
mov r8, rsi
mov rcx, rbx
mov dword [rsp + 0x90], r12d
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.sqlite3NestedParse
Function at 0x1401e47b0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
lea rsi, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movq xmm1, rax
movq xmm0, rsi
punpcklqdq xmm0, xmm1
movsxd rax, edx
mov rbx, rcx
mov edi, edx
movaps xmmword [rsp + 0x40], xmm0
lea r13, [rax + 4]
mov rbp, r8
mov r12, r9
mov rsi, qword [rcx + r13*8 + 8]
test rsi, rsi
je 0x1401e48a0
mov r9d, dword [rbx + 0x40]
test r9d, r9d
je 0x1401e4818
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edx, edx
mov rcx, rsi
call sym.vdbeUnbind
test eax, eax
jne 0x1401e4855
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x1401e4890
mov r8d, 4
mov qword [rcx], rbp
mov word [rcx + 0x14], r8w
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401e4855
call qword [0x1402b9130]
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x65
je 0x1401e48c0
cmp eax, 0x64
je 0x1401e48f8
mov rcx, rsi
call sym.sqlite3_reset
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x1401e4806
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rbp
call sym.vdbeReleaseAndSetInt64
jmp 0x1401e4843
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call sym.rtreeCheckPrepare
mov rsi, rax
mov qword [rbx + r13*8 + 8], rax
jmp 0x1401e47fd
test edi, edi
mov r9, r12
mov r8, rbp
lea rdx, str.__rowid
mov rcx, rbx
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1401e486b
mov rcx, rsi
call sym.sqlite3_column_int64.constprop.0
cmp r12, rax
mov r9, rax
je 0x1401e486b
test edi, edi
mov qword [rsp + 0x30], r12
mov r8, rbp
mov rcx, rbx
lea rdx, str.__rowid
mov qword [rsp + 0x28], rbp
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1401e486b
Function at 0x14020b2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
cmp byte [rcx + 0x23], 0
mov rbx, rcx
mov ebp, r8d
je 0x14020b3c8
mov eax, 2
test rdx, rdx
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rsi, [sym.exprNodeIsConstant]
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rsi
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
je 0x14020b3a0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x14020b3a0
mov rdi, qword [rbx]
mov rcx, rdi
call sym.exprDup.constprop.0
cmp byte [rdi + 0x67], 0
mov rsi, rax
jne 0x14020b385
cmp qword [rbx + 0x10], 0
je 0x14020b385
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call sym.sqlite3ExprCode.part.0
test rsi, rsi
je 0x14020b3b8
mov rdx, rsi
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprDeleteNN
mov r8d, ebp
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprCodeRunJustOnce
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rdx, rdx
mov rdi, qword [rcx]
jne 0x14020b35f
cmp byte [rdi + 0x67], 0
jne 0x14020b3b8
cmp qword [rcx + 0x10], 0
je 0x14020b3b8
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprCode.part.0
Function at 0x14020f280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
test rdx, rdx
mov rbx, rcx
mov rsi, r8
je 0x14020f2b6
nop word [rax + rax]
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x14020f313
test eax, 0x80000
je 0x14020f300
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x14020f298
movzx eax, byte [rbx + 0x1f]
test al, al
je 0x14020f3c0
sub eax, 1
mov byte [rbx + 0x1f], al
movzx eax, al
mov edi, dword [rbx + rax*4 + 0xe4]
mov r8d, edi
mov rcx, rbx
call sym.sqlite3ExprCodeTarget
cmp eax, edi
je 0x14020f3b0
test edi, edi
jne 0x14020f390
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x14020f2b6
mov eax, dword [rdx + 4]
test eax, 0x82000
jne 0x14020f2a2
cmp byte [rbx + 0x23], 0
je 0x14020f2b6
cmp byte [rdx], 0xb0
je 0x14020f2b6
lea rcx, [rsp + 0x30]
mov eax, 2
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rdi, [sym.exprNodeIsConstant]
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rdi
mov dword [rsp + 0x58], 0
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x14020f2b6
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
jmp sym.sqlite3ExprCodeRunJustOnce
movzx edx, byte [rbx + 0x1f]
cmp dl, 7
ja 0x14020f2ed
lea ecx, [rdx + 1]
mov byte [rbx + 0x1f], cl
mov dword [rbx + rdx*4 + 0xe4], edi
jmp 0x14020f2ed
mov dword [rsi], edi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x38]
lea edi, [rax + 1]
mov dword [rbx + 0x38], edi
jmp 0x14020f2d2
Function at 0x140226ea0
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x68]
mov r13, qword [rcx]
test rsi, rsi
mov rdi, rcx
mov r12, rdx
mov r14d, dword [r13 + 0x18]
mov rbx, r8
je 0x140226f50
mov rcx, rsi
call sym.sqlite3_reset
xor edx, edx
mov rcx, rsi
call sym.vdbeUnbind
test eax, eax
jne 0x140226f12
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x1402270c0
mov eax, 4
mov qword [rcx], r12
mov word [rcx + 0x14], ax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140226f12
call qword [0x1402b9130]
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x64
je 0x140226fd0
mov rcx, rsi
call sym.sqlite3_reset
mov ebp, eax
test eax, eax
mov eax, 0x10b
cmove ebp, eax
mov eax, ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [r13 + 8]
lea rcx, str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
mov ebp, 7
mov r8, qword [r13 + 0x10]
call sym.sqlite3_mprintf
test rax, rax
mov rsi, rax
je 0x140226fb0
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, 0x85
mov rdx, rsi
mov rcx, qword [r13]
add dword [rax + 0x78], 1
lea rax, [rdi + 0x68]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.sqlite3LockAndPrepare.constprop.0
mov rcx, rsi
mov ebp, eax
mov rax, qword [rdi]
sub dword [rax + 0x78], 1
call sym.sqlite3_free
mov rsi, qword [rdi + 0x68]
mov rcx, rsi
call sym.sqlite3_reset
test rsi, rsi
je 0x140226f37
jmp 0x140226ed3
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140226fe2
call qword [0x1402b9120]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1402270d0
cmp word [rsi + 0xc0], 0
je 0x1402270d0
call sym.sqlite3_value_blob
mov rcx, rsi
mov r13, rax
call sym.columnMallocFailure
xor edx, edx
mov rcx, rsi
call sym.columnMem
mov rcx, rax
call sym.sqlite3ValueBytes.constprop.0
mov rcx, rsi
mov r12d, eax
call sym.columnMallocFailure
test r14d, r14d
jle 0x140227125
test r12d, r12d
jle 0x140226f23
lea eax, [r14 - 1]
xor ebp, ebp
lea r14, [rbx + rax*4]
lea rdi, [rsp + 0x38]
jmp 0x14022709e
movzx r8d, byte [rcx + 1]
test r8b, r8b
jns 0x1402270f0
movzx eax, byte [rcx + 2]
shl edx, 0xe
or edx, eax
test al, 0x80
je 0x140227108
mov rdx, rdi
call sym.sqlite3Fts5GetVarint
mov edx, dword [rsp + 0x38]
movzx eax, al
and edx, 0x7fffffff
mov dword [rbx], edx
add ebp, eax
cmp r14, rbx
je 0x140227130
add rbx, 4
cmp ebp, r12d
jge 0x140226f23
movsxd rcx, ebp
add rcx, r13
movzx edx, byte [rcx]
test dl, dl
mov eax, edx
js 0x140227050
mov dword [rbx], edx
mov eax, 1
jmp 0x140227086
mov rdx, r12
call sym.vdbeReleaseAndSetInt64
jmp 0x140226f00
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call sym.sqlite3ErrorFinish
lea rcx, [0x1403255c0]
jmp 0x140227000
and eax, 0x7f
shl eax, 7
or eax, r8d
mov dword [rbx], eax
mov eax, 2
jmp 0x140227086
and r8d, 0x7f
and edx, 0x1fc07f
mov eax, 3
shl r8d, 7
or edx, r8d
mov dword [rbx], edx
jmp 0x140227086
xor ebp, ebp
nop word [rax + rax]
cmp r12d, ebp
jne 0x140226f23
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.sqlite3_reset