Function at 0x4014c0
Capabilities:
Reference sql statements
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x43c
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x4015e0
lea eax, [ebp - 0x428]
mov dword [esp + 4], str.SELECT_Data_FROM__Streams_WHERE_Name___
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sub.msi.dll_MsiDatabaseOpenViewW
sub esp, 0xc
test eax, eax
je 0x401590
test byte [section..data], 2
jne 0x401698
mov eax, dword [ebp - 0x424]
xor esi, esi
test eax, eax
je 0x401573
mov dword [esp], eax
call sub.msi.dll_MsiCloseHandle
sub esp, 4
mov eax, dword [ebp - 0x428]
test eax, eax
jne 0x401628
cmp ebx, 0xffffffff
jne 0x4015ca
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 1
call sub.msi.dll_MsiCreateRecord
sub esp, 4
mov dword [ebp - 0x424], eax
test eax, eax
jne 0x401640
test byte [section..data], 2
jne 0x401720
mov eax, dword [ebp - 0x428]
test eax, eax
jne 0x401830
xor esi, esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
je 0x40155c
mov eax, esi
call fcn.00401290
mov dword [esp + 0xc], str.Failed_to_open_destination_file__s._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
sub esp, 4
jmp 0x401581
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msi.dll_MsiRecordSetStringW
sub esp, 0xc
test eax, eax
je 0x4016c8
test byte [section..data], 2
je 0x40155c
mov dword [esp + 0xc], str.Failed_to_add_stream_filename_to_MSI_record._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
mov dword [esp + 0xc], str.Failed_to_open__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
mov eax, dword [ebp - 0x424]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x428]
mov dword [esp], eax
call sub.msi.dll_MsiViewExecute
sub esp, 8
test eax, eax
je 0x401750
test byte [section..data], 2
je 0x40155c
mov dword [esp + 0xc], str.Failed_to_query_stream_from__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
mov dword [esp + 0xc], str.Failed_to_create_MSI_record._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call sub.msi.dll_MsiCloseHandle
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x428]
mov dword [esp], eax
call sub.msi.dll_MsiViewFetch
sub esp, 8
test eax, eax
jne 0x401848
mov dword [ebp - 0x420], 0x400
mov edx, 0x400
lea esi, [ebp - 0x420]
jmp 0x40180f
lea edi, [ebp - 0x418]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msi.dll_MsiRecordReadStream
sub esp, 0x10
test eax, eax
jne 0x4018b6
lea eax, [ebp - 0x41c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x420]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x401880
mov edx, dword [ebp - 0x420]
cmp edx, dword [ebp - 0x41c]
jne 0x401880
mov eax, dword [ebp - 0x424]
cmp edx, 0x400
je 0x4017a8
mov esi, 1
jmp 0x401564
mov dword [esp], eax
xor esi, esi
call sub.msi.dll_MsiViewClose
sub esp, 4
jmp 0x4015ca
test byte [section..data], 2
je 0x40155c
mov dword [esp + 0xc], str.Failed_to_query_row_from__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
test byte [section..data], 2
je 0x40155c
mov dword [esp + 0xc], str.Failed_to_write_stream_to_destination_file._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c
test byte [section..data], 2
je 0x40155c
mov dword [esp + 0xc], str.Failed_to_read_stream_from__Streams_table._n
mov dword [esp + 8], str.extract_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40155c