I. Lee Hetherington

## LLIL function

| Field Name | Field Type | Description |
|-------------|-------------|-------------|
| function_type | string | The inferred type of the analyzed function, determined by the FunctionTypeAnalysis module (e.g., standard, library, thunk). |
| sha256_llil | string | SHA-256 hash computed from the Low-Level Intermediate Language (LLIL) instructions of the function. |
| ssdeep_llil | string | Fuzzy hash (ssdeep) of the LLIL instruction sequence, used for similarity detection. |
| tlsh_llil | string | TLSH (Trend Locality Sensitive Hash) value of the LLIL instructions, used for approximate matching and similarity comparison. |
| instructions_types_llil | list[string] | List of unique LLIL instruction types (e.g., arithmetic, control flow, memory operations). |
| control_flow_count_llil | integer | Number of control flow instructions in the LLIL representation (e.g., branches, jumps, calls). |
| memory_access_pattern_llil | dict | Patterns of memory access operations detected in the LLIL code (e.g., loads, stores, stack operations). |
| register_usage | dict | Summary of register usage, indicating which registers are read and written in the function. |
| total_reg_reads | integer | Total number of register read operations in the LLIL code. |
| total_reg_written | integer | Total number of register write operations in the LLIL code. |
| data_references_count | integer | Number of data references in the LLIL code (e.g., constants, global variables). |
| max_block_size | integer | Size of the largest basic block in the LLIL representation, measured in number of instructions. |
| num_calls | integer | Total number of function call instructions present in the LLIL code. |
| stack_size | integer | Estimated stack size used by the function, inferred from LLIL analysis. |


## CFG level

| Field Name          | Field Type    | Description                                                                                                                               |
|---------------------|---------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| block_id            | integer       | Unique identifier for the basic block within the function (block_instructions + str(block.start) + str(block.end) + str(function.start)). |
| function_address    | integer       | Starting memory address of the parent function containing this block.                                                                     |
| block_start_address | integer       | Starting address of the basic block in memory.                                                                                            |
| block_end_address   | integer       | Ending address of the basic block in memory.                                                                                              |
| block_size          | integer       | Size of the basic block in bytes (computed as end - start).                                                                               |
| instructions_count  | integer       | Number of instructions contained in the basic block.                                                                                      |
| block_instructions  | string        | MD5 hash of the block's instruction sequence, used for integrity or similarity checks.                                                    |
| predecessor_blocks  | list[u64]     | List of addresses or IDs of predecessor blocks in the control flow graph (CFG).                                                           |
| successor_blocks    | list[u64]     | List of addresses or IDs of successor blocks in the CFG.                                                                                  |
| depth               | integer       | Depth level of the block in the control flow graph, starting from the entry block.                                                        |
| position            | integer       | Sequential position or index of the block within the function’s block map.                                                                |
| branch_type         | string        | Type of branch ending the block (e.g., conditional, unconditional, call, return).                                                         |
| block_type          | string        | Classification of the block (e.g., entry, exit, loop header, regular).                                                                    |
| flags               | dict          | Metadata or attributes extracted from the block (e.g., specific behavior or conditions).                                                  |
| dominators          | list[integer] | List of block addresses or IDs that dominate this block in the control flow graph.                                                        |
| post_dominators     | list[integer] | List of block addresses or IDs that post-dominate this block in the control flow graph.                                                   |
 | measures            | list[tuples]  | List of measures to be defined                                                                                                            |

## Disassembly

| Field Name | Field Type | Description |
|-------------|-------------|-------------|
| disassembled_function_hash | string | SHA-256 hash of the disassembled function string, used as a unique identifier. |
| disassembled_function | string | The disassembled function including instruction addresses. |
| disassembled_function_no_addresses | string | The disassembled function without instruction addresses, containing only the instruction mnemonics and operands. |
| disassembled_function_name | string | The name of the analyzed function. |
| disassembled_function_address | integer | The starting memory address of the disassembled function. |
| instructions_count | integer | Total number of instructions within the disassembled function. |
| function_type | string | The inferred type of the function as determined by the FunctionTypeAnalysis module (e.g., standard, library, thunk). |
| instructions_types | list[string] | List of unique instruction types (e.g., arithmetic, logic, control flow, memory). |
| control_flow_count | integer | Number of control flow instructions (e.g., jumps, calls, returns). |
| memory_access_pattern | dict | Patterns of memory access operations detected in the function (e.g., loads, stores, stack operations). |
| register_usage | dict | Summary of register usage, showing which registers are read from or written to. |
| data_references_count | integer | Count of data references made by the function (e.g., global variables or constants). |
| max_block_size | integer | The size of the largest basic block (in number of instructions). |
| num_calls | integer | Total number of function call instructions. |
| stack_size | integer | Estimated stack size used by the function. |

## Decompilation

| Field Name | Field Type | Description |
|-------------|-------------|-------------|
| decompiled_function_hash | string | SHA-256 hash of the decompiled function code, used as a unique identifier. |
| decompiled_function | string | The decompiled function source code in high-level representation. |
| decompiled_function_name | string | The name of the decompiled function. |
| decompiled_function_prototype | string | The function prototype, including return type, name, and parameters. |
| decompiled_function_address | integer | The starting memory address of the decompiled function. |
| function_type | string | The inferred function type from the FunctionTypeAnalysis module (e.g., standard, library, thunk). |
| functions_caller | list[string] | List of functions that call this function (incoming call references). |
| functions_call | list[string] | List of functions called by this function (outgoing call references). |
| flattened_score | float | Score representing the degree of control-flow flattening detected in the function. |
| mba_score | float | Score representing the presence or intensity of mixed boolean arithmetic (MBA) obfuscation patterns. |