Function at 0x401390
Capabilities:
Reference sql statements
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x42c
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x4014b8
lea eax, [ebp - 0x41c]
mov dword [esp + 4], str.SELECT_Data_FROM__Streams_WHERE_Name___
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sub.msi.dll_MsiDatabaseOpenViewW
sub esp, 0xc
test eax, eax
je 0x401470
xor edi, edi
test byte [section..data], 2
jne 0x401558
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x401443
mov dword [esp], eax
call sub.msi.dll_MsiCloseHandle
sub esp, 4
mov eax, dword [ebp - 0x41c]
test eax, eax
jne 0x4014a8
cmp ebx, 0xffffffff
je 0x40145e
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 1
call sub.msi.dll_MsiCreateRecord
mov dword [ebp - 0x418], eax
sub esp, 4
test eax, eax
jne 0x401500
test byte [section..data], 2
jne 0x4015e0
mov eax, dword [ebp - 0x41c]
xor edi, edi
test eax, eax
je 0x401452
lea esi, [esi]
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
sub esp, 4
jmp 0x40144d
xor edi, edi
test byte [section..data], 2
je 0x40142e
mov eax, esi
call fcn.00401060
mov dword [esp + 0xc], str.Failed_to_open_destination_file__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msi.dll_MsiRecordSetStringW
sub esp, 0xc
test eax, eax
je 0x401588
xor edi, edi
test byte [section..data], 2
je 0x40142e
mov dword [esp + 0xc], str.Failed_to_add_stream_filename_to_MSI_record._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
mov dword [esp + 0xc], str.Failed_to_open__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
mov eax, dword [ebp - 0x418]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sub.msi.dll_MsiViewExecute
sub esp, 8
test eax, eax
je 0x401610
xor edi, edi
test byte [section..data], 2
je 0x40142e
mov dword [esp + 0xc], str.Failed_to_query_stream_from__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
mov dword [esp + 0xc], str.Failed_to_create_MSI_record._n
xor edi, edi
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
mov eax, dword [ebp - 0x418]
mov dword [esp], eax
call sub.msi.dll_MsiCloseHandle
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sub.msi.dll_MsiViewFetch
sub esp, 8
test eax, eax
jne 0x4016e0
mov dword [ebp - 0x414], 0x400
lea edi, [ebp - 0x414]
lea esi, [ebp - 0x40c]
lea esi, [esi]
mov eax, dword [ebp - 0x418]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msi.dll_MsiRecordReadStream
sub esp, 0x10
test eax, eax
jne 0x401758
lea eax, [ebp - 0x410]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x414]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x401720
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x410]
jne 0x401720
cmp eax, 0x400
je 0x401668
mov edi, 1
jmp 0x40142e
xor edi, edi
test byte [section..data], 2
je 0x40142e
mov dword [esp + 0xc], str.Failed_to_query_row_from__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
xor edi, edi
test byte [section..data], 2
je 0x40142e
mov dword [esp + 0xc], str.Failed_to_write_stream_to_destination_file._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e
xor edi, edi
test byte [section..data], 2
je 0x40142e
mov dword [esp + 0xc], str.Failed_to_read_stream_from__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401340
jmp 0x40142e