Function at 0x401840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x39c
mov word [ebp - 0x34e], ax
xor eax, eax
mov word [ebp - 0x360], ax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x35e], 0x2e0025
mov dword [ebp - 0x35a], 0x730038
mov dword [ebp - 0x356], 0x69002e
mov dword [ebp - 0x352], 0x740064
mov dword [ebp - 0x36c], 0x730025
mov dword [ebp - 0x368], 0x69002e
mov dword [ebp - 0x364], 0x740064
test eax, eax
jne 0x401908
lea eax, [ebp - 0x36c]
lea edi, [ebp - 0x220]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x104
mov dword [esp], edi
call fcn.004014f0
mov dword [esp + 0xc], edi
mov eax, dword [esi + 4]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov dword [esp], eax
call sub.msi.dll_MsiDatabaseExportW
mov esi, eax
sub esp, 0x10
mov eax, 1
test esi, esi
jne 0x401910
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x35e]
jmp 0x4018b5
xor eax, eax
test byte [section..data], 2
je 0x4018fb
test ebx, ebx
je 0x401b40
mov eax, ebx
shr eax, 0x10
je 0x401b10
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call sub.kernel32.dll_IsBadStringPtrW
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x401a36
movzx edx, word [ebx]
test dx, dx
je 0x401b4a
lea esi, [esi]
mov ecx, eax
lea eax, [eax + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x401960
mov eax, 0x224c
mov dword [ebp - 0x37c], ebx
mov word [ebp - 0x34c], ax
lea eax, [ebp - 0x34a]
jmp 0x4019cc
cmp dx, 9
je 0x401af8
cmp dx, 0xa
jne 0x401a8e
mov edi, 0x6e5c
add eax, 2
mov word [eax - 2], di
lea ebx, [ebp - 0x22a]
lea edi, [ecx - 1]
cmp eax, ebx
ja 0x401a08
test ecx, ecx
jle 0x401a08
mov ecx, dword [ebp - 0x37c]
movzx edx, word [ecx]
mov ecx, edi
add dword [ebp - 0x37c], 2
cmp dx, 0xd
je 0x401a70
jbe 0x401990
cmp dx, 0x22
je 0x401ae0
cmp dx, 0x5c
jne 0x401a81
mov ebx, 0x5c5c
add eax, 2
mov word [eax - 2], bx
jmp 0x4019b0
mov byte [eax], 0x22
test edi, edi
jle 0x401b63
mov ecx, 0x2e2e
mov byte [eax + 3], 0x2e
lea edx, [eax + 4]
mov word [eax + 1], cx
lea eax, [ebp - 0x34c]
mov byte [edx], 0
mov dword [esp], eax
call fcn.00403a60
mov edx, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Failed_to_export_table__s__error__d._n
mov dword [esp + 8], str.export_table
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x725c
add eax, 2
mov word [eax - 2], bx
jmp 0x4019b0
lea edi, [edx - 0x20]
cmp di, 0x5e
jbe 0x401b30
mov edi, edx
mov byte [eax], 0x5c
add eax, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefopen_database]
mov edi, edx
shr di, 8
and edi, 0xf
mov byte [eax - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefopen_database]
mov edi, edx
and edx, 0xf
shr di, 4
movzx edx, byte [edx + str.0123456789abcdefopen_database]
and edi, 0xf
mov byte [eax - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefopen_database]
mov byte [eax - 1], dl
mov byte [eax - 2], bl
jmp 0x4019b0
mov edi, 0x225c
add eax, 2
mov word [eax - 2], di
jmp 0x4019b0
mov edx, 0x745c
add eax, 2
mov word [eax - 2], dx
jmp 0x4019b0
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.004011e0
mov edx, eax
jmp 0x401a36
mov byte [eax], dl
add eax, 1
jmp 0x4019b0
mov edx, str._null_
jmp 0x401a36
mov edx, 0x224c
mov byte [ebp - 0x34a], 0x22
lea eax, [ebp - 0x34a]
mov word [ebp - 0x34c], dx
lea edx, [eax + 1]
jmp 0x401a23