Function at 0x46adec
Capabilities:
Reference sql statements
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, r8
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rbx
xor r15d, r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov word [rsp + 0x70], r15w
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x72]
call fcn.00449860
lea r14d, [r15 + 8]
cmp qword [rsi + 0x20], r14
jb 0x46ae7b
lea rbp, [rsi + 8]
mov rax, qword [rbp]
jmp 0x46ae82
lea rbp, [rsi + 8]
mov rax, rbp
mov qword [rsp + 0x20], rax
lea r9, str.SELECT__Data__FROM___Streams__WHERE__Name____s
or r8, 0xffffffffffffffff
mov edx, 0x105
lea rcx, [rsp + 0x70]
call fcn.00445024
call fcn.004551b8
mov rdi, qword [rax + 0x70]
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46aeb8
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov dword [rsp + 0x48], r15d
cmp qword [r12 + 0x20], r14
jb 0x46aecb
mov rcx, qword [r12 + 8]
jmp 0x46aed0
lea rcx, [r12 + 8]
lea r8, [rsp + 0x48]
xor edx, edx
call sub.msi.dll_MsiOpenProductW
cmp eax, r15d
je 0x46af6b
cmp rdi, r15
je 0x46aefa
lea rdx, str.ERROR:_Failed_to_open_MSI_Database_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46af09
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46af18
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46af27
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46af36
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46af57
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46af79
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov dword [rsp + 0x40], r15d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rsp + 0x48]
call sub.msi.dll_MsiEnumClientsA
cmp eax, r15d
je 0x46b020
cmp rdi, r15
je 0x46afaf
lea rdx, str.ERROR:_Failed_to_open_MSI_Database_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46afbe
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46afcd
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46afdc
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46afeb
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46b00c
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
xor edx, edx
mov ecx, dword [rsp + 0x40]
call sub.msi.dll_MsiViewModify
cmp eax, r15d
je 0x46b0ba
cmp rdi, r15
je 0x46b049
lea rdx, str.ERROR:_Failed_to_Execute_View_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b058
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b067
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b076
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46b085
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46b0a6
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b0c8
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov dword [rsp + 0x44], r15d
lea rdx, [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
call sub.msi.dll_MsiDatabaseIsTablePersistentA
cmp eax, r15d
je 0x46b16a
cmp rdi, r15
je 0x46b0f9
lea rdx, str.ERROR:_Failed_to_Fetch_View_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b108
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b117
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b126
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46b135
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46b156
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea r12d, [r8 + 1]
mov edx, r12d
mov ecx, dword [rsp + 0x44]
call sub.msi.dll_MsiRecordSetStringA
cmp eax, r15d
je 0x46b211
cmp rdi, r15
je 0x46b1a0
lea rdx, str.ERROR:_Failed_to_Read_Record_Stream_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b1af
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b1be
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b1cd
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46b1dc
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46b1fd
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
mov ecx, dword [rsp + 0x4c]
call fcn.004444b0
mov r13, rax
cmp rax, r15
jne 0x46b2ac
cmp rdi, r15
je 0x46b23b
lea rdx, str.ERROR:_Failed_to_allocate_memory_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b24a
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b259
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b268
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46b277
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46b298
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
lea r9, [rsp + 0x4c]
mov r8, rax
mov edx, r12d
mov ecx, dword [rsp + 0x44]
call sub.msi.dll_MsiRecordSetStringA
cmp eax, r15d
je 0x46b34f
cmp rdi, r15
je 0x46b2de
lea rdx, str.ERROR:_Failed_to_Read_Full_Record_Stream_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b2ed
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b2fc
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b30b
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], r14
jb 0x46b31a
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], r14
jb 0x46b33b
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [rbx + 8], r15w
xor al, al
jmp 0x46b4bc
cmp qword [rbx + 0x20], r14
jb 0x46b35f
lea r12, [rbx + 8]
mov rcx, qword [r12]
jmp 0x46b366
lea r12, [rbx + 8]
mov rcx, r12
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x46b439
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x4c]
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.00444544
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b3d5
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b3e4
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b3f3
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], 8
jb 0x46b403
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], 8
jb 0x46b425
mov rcx, qword [r12]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [r12], r15w
mov al, 1
jmp 0x46b4bc
cmp rdi, r15
je 0x46b44e
lea rdx, str.ERROR:_Failed_to_Open_Destination_file_for_Stream_in_ExtractStream__
mov rcx, rdi
call fcn.0045fe58
nop
mov ecx, dword [rsp + 0x44]
cmp ecx, r15d
je 0x46b45d
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
je 0x46b46c
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
mov ecx, dword [rsp + 0x48]
cmp ecx, r15d
je 0x46b47b
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
nop
cmp qword [rsi + 0x20], 8
jb 0x46b48b
mov rcx, qword [rbp]
call fcn.00443d3c
mov edi, 7
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x18], r15
mov word [rbp], r15w
cmp qword [rbx + 0x20], 8
jb 0x46b4ad
mov rcx, qword [r12]
call fcn.00443d3c
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], r15
mov word [r12], r15w
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret