Function at 0x4021a0
Capabilities:
Terminate process

Disassembly:
push ebp
xor eax, eax
mov ecx, 0xa
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x260]
push ebx
sub esp, 0x29c
cmp dword [ebp + 8], 1
mov ebx, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
lea edi, [ebp - 0x220]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], edi
jle 0x402720
mov esi, 1
lea esi, [esi]
mov edx, dword [ebx + esi*4]
lea eax, [esi*4]
mov dword [ebp - 0x27c], eax
movzx ecx, word [edx]
test cx, cx
je 0x402280
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402238
sub eax, edx
cmp eax, 4
jne 0x402280
and ecx, 0xfffffffd
cmp cx, 0x2d
jne 0x402280
movzx eax, word [edx + 2]
sub eax, 0x3f
cmp ax, 0x39
ja case.0x402265.1
movzx eax, ax
jmp dword [eax*4 + 0x405710]
lea eax, [esi + 1]
cmp dword [ebp + 8], eax
jg 0x402628
lea esi, [esi]
nop
cmp dword [ebp + 8], esi
jle 0x4022a0
mov eax, dword [ebp + 8]
lea esi, [ebx + esi*4]
lea ebx, [ebx + eax*4]
nop
mov edx, dword [esi]
mov eax, edi
add esi, 4
call fcn.004010f0
cmp ebx, esi
jne 0x402290
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x402720
mov esi, dword [ebp - 0x25c]
test esi, esi
je 0x4025b0
mov ebx, dword [ebp - 0x248]
test ebx, ebx
jne 0x402380
mov edx, dword [ebp - 0x244]
or edx, dword [ebp - 0x240]
jne 0x402470
mov ecx, dword [ebp - 0x254]
mov edx, 1
test ecx, ecx
jne 0x402391
mov ecx, dword [ebp - 0x24c]
or ecx, dword [ebp - 0x250]
jne 0x402391
test byte [section..data], 2
jne 0x403356
mov dword [esp], str.Usage:_msidb__OPTION_..._OPTION_...__TABLE_..._TABLE__nOptions:_n____________________Show_this_usage_message_and_exit._n___a_file.cab_______Add_stream_cabinet_file_to__Streams_table._n___c________________Create_database_file__instead_of_opening_existing_file_._n___d_package.msi____Path_to_the_database_file._n___e________________Export_tables_from_database._n___f_folder_________Folder_in_which_to_open_save_the_tables._n___i________________Import_tables_into_database._n___k_file.cab_______Kill__remove__stream_cabinet_file_from__Streams_table._n___s________________Export_with_short_filenames__eight_character_max_._n___x_file.cab_______Extract_stream_cabinet_file_from__Streams_table._n
call fcn.00401180
lea esi, [esi]
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x402710
mov dword [esp], eax
mov ebx, 1
call sub.msi.dll_MsiCloseHandle
sub esp, 4
test eax, eax
je 0x402436
test byte [section..data], 4
je 0x402436
mov dword [esp + 0xc], str.Failed_to_close_database_handle._n
mov dword [esp + 8], str.close_database
mov dword [esp + 4], 0x404000
mov dword [esp], 2
call fcn.00401060
jmp 0x402436
cmp dword [ebp - 0x220], edi
je 0x402600
mov edx, 3
lea esi, [ebp - 0x258]
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.msi.dll_MsiOpenDatabaseW
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x4027a0
mov ecx, dword [ebp - 0x254]
test ecx, ecx
jne 0x40288f
mov edx, dword [ebp - 0x240]
test edx, edx
jne 0x402a70
mov ebx, dword [ebp - 0x250]
test ebx, ebx
jne 0x402b70
mov ecx, dword [ebp - 0x244]
test ecx, ecx
jne 0x402bab
mov edx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x258]
test edx, edx
jne 0x402d08
test eax, eax
je 0x402793
mov dword [esp], eax
call sub.msi.dll_MsiDatabaseCommit
sub esp, 4
test eax, eax
jne 0x402766
mov eax, dword [ebp - 0x258]
xor ebx, ebx
mov dword [esp], eax
call sub.msi.dll_MsiCloseHandle
sub esp, 4
test eax, eax
jne 0x402346
lea eax, [ebp - 0x238]
call section..text
lea eax, [ebp - 0x230]
call section..text
lea eax, [ebp - 0x228]
call section..text
mov eax, edi
call section..text
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x220], edi
je 0x402651
mov edx, 1
jmp 0x402391
lea eax, [esi + 1]
cmp dword [ebp + 8], eax
jle 0x402280
mov dword [ebp - 0x250], 1
mov eax, dword [ebp - 0x27c]
mov edx, dword [ebx + eax + 4]
lea eax, [ebp - 0x230]
call fcn.004010f0
mov eax, 2
jmp 0x4024d0
mov dword [ebp - 0x23c], 1
mov eax, 1
lea esi, [esi]
nop
add esi, eax
cmp dword [ebp + 8], esi
jg 0x402218
jmp 0x4022a0
lea eax, [esi + 1]
cmp dword [ebp + 8], eax
jle 0x402280
mov dword [ebp - 0x24c], 1
mov eax, dword [ebp - 0x27c]
mov edx, dword [ebx + eax + 4]
lea eax, [ebp - 0x228]
call fcn.004010f0
mov eax, 2
jmp 0x4024d0
mov dword [ebp - 0x244], 1
mov eax, 1
jmp 0x4024d0
lea eax, [esi + 1]
cmp dword [ebp + 8], eax
jle 0x402280
mov eax, dword [ebp - 0x27c]
mov eax, dword [ebx + eax + 4]
mov dword [ebp - 0x25c], eax
mov eax, 2
jmp 0x4024d0
mov dword [ebp - 0x240], 1
mov eax, 1
jmp 0x4024d0
lea eax, [esi + 1]
cmp dword [ebp + 8], eax
jle 0x402280
mov eax, dword [ebp - 0x27c]
mov eax, dword [ebx + eax + 4]
mov dword [ebp - 0x260], eax
mov eax, 2
jmp 0x4024d0
mov dword [ebp - 0x248], 1
mov eax, 1
jmp 0x4024d0
mov dword [esp], str.Usage:_msidb__OPTION_..._OPTION_...__TABLE_..._TABLE__nOptions:_n____________________Show_this_usage_message_and_exit._n___a_file.cab_______Add_stream_cabinet_file_to__Streams_table._n___c________________Create_database_file__instead_of_opening_existing_file_._n___d_package.msi____Path_to_the_database_file._n___e________________Export_tables_from_database._n___f_folder_________Folder_in_which_to_open_save_the_tables._n___i________________Import_tables_into_database._n___k_file.cab_______Kill__remove__stream_cabinet_file_from__Streams_table._n___s________________Export_with_short_filenames__eight_character_max_._n___x_file.cab_______Extract_stream_cabinet_file_from__Streams_table._n
call fcn.00401180
mov dword [esp], 0
call sub.ucrtbase.dll_exit
lea esi, [esi]
mov edx, dword [ebp - 0x254]
or edx, dword [ebp - 0x24c]
or edx, dword [ebp - 0x250]
jne 0x4022bc
test byte [section..data], 2
je 0x40230e
mov dword [esp + 0xc], str.No_table_folder_specified___f_option_._n
mov dword [esp + 8], str.valid_state
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40230e
mov edx, dword [ebp - 0x254]
test edx, edx
jne 0x40238c
mov edx, dword [ebp - 0x24c]
or edx, dword [ebp - 0x250]
je 0x402671
jmp 0x40238c
mov dword [ebp - 0x254], 1
mov eax, dword [ebp - 0x27c]
mov edx, dword [ebx + eax + 4]
lea eax, [ebp - 0x238]
call fcn.004010f0
mov eax, 2
jmp 0x4024d0
mov ecx, dword [ebp - 0x254]
test ecx, ecx
jne 0x40247c
mov edx, dword [ebp - 0x24c]
or edx, dword [ebp - 0x250]
jne 0x40247c
test byte [section..data], 2
je 0x402320
mov dword [esp + 0xc], str.No_tables_specified._n
mov dword [esp + 8], str.valid_state
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402320
mov byte [esi], 0x22
test eax, eax
jle 0x40332d
mov ecx, 0x2e2e
mov byte [esi + 3], 0x2e
lea eax, [esi + 4]
mov word [esi + 1], cx
mov byte [eax], 0
lea eax, [ebp - 0x218]
mov dword [esp], eax
call fcn.00403a60
mov edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Failed_to_open_database__s._n
mov dword [esp + 8], str.wmain
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
mov eax, dword [ebp - 0x258]
test eax, eax
jne 0x40232e
lea esi, [esi]
nop
mov ebx, 1
jmp 0x402436
test byte [section..data], 1
je 0x402320
mov dword [esp + 0xc], str.GUI_operation_is_not_currently_supported._n
mov ebx, 1
mov dword [esp + 8], str.valid_state
mov dword [esp + 4], 0x404000
mov dword [esp], 0
call fcn.00401060
mov eax, dword [ebp - 0x258]
test eax, eax
jne 0x402423
jmp 0x402710
test byte [section..data], 2
je 0x402793
mov dword [esp + 0xc], str.Failed_to_commit_changes_to_database._n
mov dword [esp + 8], str.close_database
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
xor ebx, ebx
jmp 0x402436
test byte [section..data], 2
je 0x402320
mov esi, dword [ebp - 0x260]
test esi, esi
je 0x40329e
mov eax, esi
shr eax, 0x10
je 0x403216
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sub.kernel32.dll_IsBadStringPtrW
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x402fa2
cmp word [esi], 0
je 0x403335
mov edx, eax
lea eax, [eax + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x4027f0
mov eax, 0x224c
mov dword [ebp - 0x27c], ebx
lea ecx, [ebp - 0x216]
mov word [ebp - 0x218], ax
jmp 0x40285b
cmp ax, 9
je 0x403145
cmp ax, 0xa
jne 0x403163
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
nop
lea ebx, [ebp - 0xf6]
lea eax, [edx - 1]
cmp ecx, ebx
ja 0x402f6e
test edx, edx
jle 0x402f6e
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x4031c5
jbe 0x402817
cmp ax, 0x22
je 0x4031b4
cmp ax, 0x5c
jne 0x403156
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x402840
mov ebx, dword [ebp - 0x238]
lea eax, [ebp - 0x238]
cmp ebx, eax
je 0x4023c2
lea eax, [ebp - 0x218]
mov dword [ebp - 0x27c], eax
nop
mov eax, dword [ebx + 8]
mov dword [esp + 4], str.INSERT_INTO__Streams__Name__Data__VALUES_______
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x258]
mov dword [esp], eax
call sub.msi.dll_MsiDatabaseOpenViewW
sub esp, 0xc
test eax, eax
je 0x402918
test byte [section..data], 2
jne 0x4029d8
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x402320
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
sub esp, 4
jmp 0x402320
mov dword [esp], 2
call sub.msi.dll_MsiCreateRecord
sub esp, 4
test eax, eax
jne 0x402960
test byte [section..data], 2
je 0x4028f7
mov dword [esp + 0xc], str.Failed_to_create_MSI_record._n
mov dword [esp + 8], str.add_stream
mov dword [esp + 4], section..data
mov dword [esp], 1
call fcn.00401060
jmp 0x4028f7
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x280]
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov edx, dword [ebp - 0x284]
test eax, eax
je 0x402d90
add eax, 2
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [ebp - 0x284], edx
call sub.msi.dll_MsiRecordSetStringW
mov edx, dword [ebp - 0x284]
sub esp, 0xc
test eax, eax
je 0x402a01
test byte [section..data], 2
jne 0x4030a7
mov dword [esp], edx
call sub.msi.dll_MsiCloseHandle
sub esp, 4
jmp 0x4028f7
mov dword [esp + 0xc], str.Failed_to_open__Streams_table._n
mov dword [esp + 8], str.add_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x4028f7
mov eax, dword [ebp - 0x280]
mov dword [esp], edx
mov dword [esp + 4], 2
mov dword [esp + 8], eax
mov dword [ebp - 0x280], edx
call sub.msi.dll_MsiRecordSetStreamW
mov edx, dword [ebp - 0x280]
sub esp, 0xc
test eax, eax
je 0x402df0
test byte [section..data], 2
je 0x4029c2
mov dword [ebp - 0x27c], edx
mov dword [esp + 0xc], str.Failed_to_add_stream_to_MSI_record._n
mov dword [esp + 8], str.add_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
mov edx, dword [ebp - 0x27c]
jmp 0x4029c2
mov dword [ebp - 0x264], 0x2a
mov ebx, dword [ebp - 0x220]
cmp ebx, edi
je 0x4023d0
lea eax, [ebp - 0x264]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.kernel32.dll_lstrcmpW
sub esp, 8
test eax, eax
jne 0x402b48
lea eax, [ebp - 0x270]
mov dword [esp + 4], str.SELECT_Name_FROM__Tables
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x270], 0
mov dword [esp], eax
call sub.msi.dll_MsiDatabaseOpenViewW
sub esp, 0xc
test eax, eax
je 0x402bc3
test byte [section..data], 2
jne 0x402e47
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x402320
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
sub esp, 4
test eax, eax
je 0x402320
test byte [section..data], 2
je 0x402320
mov dword [esp + 0xc], str.Failed_to_close__Streams_table._n
mov dword [esp + 8], str.export_all_tables
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402320
mov edx, dword [ebx + 8]
lea eax, [ebp - 0x260]
call fcn.00401840
test eax, eax
je 0x402320
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x402a88
jmp 0x4023d0
mov ebx, dword [ebp - 0x230]
lea eax, [ebp - 0x230]
cmp ebx, eax
jne 0x402b98
jmp 0x4023de
mov ebx, dword [ebx]
lea eax, [ebp - 0x230]
cmp ebx, eax
je 0x4023de
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.00401b70
test eax, eax
jne 0x402b88
jmp 0x402320
lea eax, [ebp - 0x260]
call fcn.00401540
test eax, eax
jne 0x4023ec
jmp 0x402320
mov eax, dword [ebp - 0x270]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msi.dll_MsiViewExecute
sub esp, 8
test eax, eax
je 0x402c99
test byte [section..data], 2
je 0x402aea
mov dword [esp + 0xc], str.Failed_to_query_list_from__Tables_table._n
mov dword [esp + 8], str.export_all_tables
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402aea
test eax, eax
jne 0x403268
lea eax, [ebp - 0x268]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x218]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x268], 0x100
mov dword [esp], eax
call sub.msi.dll_MsiRecordGetStringW
sub esp, 0x10
test eax, eax
jne 0x4032a8
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x260]
call fcn.00401840
test eax, eax
je 0x402aea
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
call sub.msi.dll_MsiCloseHandle
sub esp, 4
test eax, eax
jne 0x4032de
mov dword [ebp - 0x26c], 0
lea eax, [ebp - 0x26c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call sub.msi.dll_MsiViewFetch
sub esp, 8
cmp eax, 0x103
jne 0x402c20
mov edx, str._SummaryInformation
lea eax, [ebp - 0x260]
call fcn.00401840
test eax, eax
je 0x402aea
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x402b5e
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
push edx
test eax, eax
je 0x402b5e
jmp 0x402b0b
mov esi, dword [ebp - 0x228]
lea ecx, [ebp - 0x228]
cmp esi, ecx
je 0x402400
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x27c], ecx
mov ecx, dword [ebp - 0x27c]
mov ebx, dword [esi + 8]
mov dword [esp], eax
mov dword [esp + 4], str.DELETE_FROM__Streams_WHERE_Name___
mov dword [esp + 8], ecx
mov dword [ebp - 0x218], 0
call sub.msi.dll_MsiDatabaseOpenViewW
sub esp, 0xc
test eax, eax
je 0x402e70
test byte [section..data], 2
je 0x4028f7
mov dword [esp + 0xc], str.Failed_to_open__Streams_table._n
mov dword [esp + 8], str.kill_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x4028f7
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], edx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov edx, dword [ebp - 0x284]
mov ecx, eax
lea eax, [eax + 2]
test ecx, ecx
cmove eax, dword [ebp - 0x280]
jmp 0x40298e
mov dword [esp], str.Usage:_msidb__OPTION_..._OPTION_...__TABLE_..._TABLE__nOptions:_n____________________Show_this_usage_message_and_exit._n___a_file.cab_______Add_stream_cabinet_file_to__Streams_table._n___c________________Create_database_file__instead_of_opening_existing_file_._n___d_package.msi____Path_to_the_database_file._n___e________________Export_tables_from_database._n___f_folder_________Folder_in_which_to_open_save_the_tables._n___i________________Import_tables_into_database._n___k_file.cab_______Kill__remove__stream_cabinet_file_from__Streams_table._n___s________________Export_with_short_filenames__eight_character_max_._n___x_file.cab_______Extract_stream_cabinet_file_from__Streams_table._n
call fcn.00401180
mov dword [esp], 1
call sub.ucrtbase.dll_exit
lea esi, [esi]
nop
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [ebp - 0x280], edx
mov dword [esp], eax
call sub.msi.dll_MsiViewExecute
mov edx, dword [ebp - 0x280]
sub esp, 8
test eax, eax
jne 0x4031f6
mov dword [esp], edx
call sub.msi.dll_MsiCloseHandle
mov eax, dword [ebp - 0x218]
sub esp, 4
test eax, eax
jne 0x40337f
mov ebx, dword [ebx]
lea eax, [ebp - 0x238]
cmp ebx, eax
jne 0x4028b0
jmp 0x4023c2
mov dword [esp + 0xc], str.Failed_to_open__Tables_table._n
mov dword [esp + 8], str.export_all_tables
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402aea
mov dword [esp], 1
call sub.msi.dll_MsiCreateRecord
sub esp, 4
test eax, eax
jne 0x402ea8
test byte [section..data], 2
je 0x4028f7
mov dword [esp + 0xc], str.Failed_to_create_MSI_record._n
mov dword [esp + 8], str.kill_stream
jmp 0x402944
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x280], eax
call sub.msi.dll_MsiRecordSetStringW
mov edx, dword [ebp - 0x280]
sub esp, 0xc
test eax, eax
je 0x402f11
test byte [section..data], 2
je 0x4029c2
mov dword [ebp - 0x27c], edx
mov dword [esp + 0xc], str.Failed_to_add_stream_filename_to_MSI_record._n
mov dword [esp + 8], str.kill_stream
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
mov edx, dword [ebp - 0x27c]
jmp 0x4029c2
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [ebp - 0x280], edx
mov dword [esp], eax
call sub.msi.dll_MsiViewExecute
mov edx, dword [ebp - 0x280]
sub esp, 8
test eax, eax
jne 0x4031d6
mov dword [esp], edx
call sub.msi.dll_MsiCloseHandle
mov eax, dword [ebp - 0x218]
sub esp, 4
test eax, eax
jne 0x40338d
mov esi, dword [esi]
lea ecx, [ebp - 0x228]
mov eax, dword [ebp - 0x258]
cmp esi, ecx
jne 0x402d28
jmp 0x402400
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x27c]
test eax, eax
jle 0x40334e
mov esi, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], si
mov byte [eax], 0
lea eax, [ebp - 0x218]
mov dword [esp], eax
call fcn.00403a60
mov edx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Failed_to_open_database__s__error__d_n
mov dword [esp + 8], 0x4059f0
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
test byte [section..data], 2
je 0x402320
mov ebx, dword [ebp - 0x260]
test ebx, ebx
je 0x40325e
mov eax, ebx
shr eax, 0x10
je 0x403230
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call sub.kernel32.dll_IsBadStringPtrW
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x4026d5
cmp word [ebx], 0
je 0x403314
nop
mov edx, eax
lea eax, [eax + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x403020
mov eax, 0x224c
lea esi, [ebp - 0x216]
mov word [ebp - 0x218], ax
jmp 0x40307b
cmp ax, 9
je 0x4030ba
cmp ax, 0xa
jne 0x4030e3
mov eax, 0x6e5c
add esi, 2
mov word [esi - 2], ax
lea esi, [esi]
lea eax, [edx - 1]
test edx, edx
jle 0x4026a7
lea ecx, [ebp - 0xf6]
cmp esi, ecx
ja 0x4026a7
mov edx, eax
movzx eax, word [ebx]
add ebx, 2
cmp ax, 0xd
je 0x4030c8
jbe 0x403041
cmp ax, 0x22
je 0x403134
cmp ax, 0x5c
jne 0x4030d6
mov eax, 0x5c5c
add esi, 2
mov word [esi - 2], ax
jmp 0x403060
mov dword [ebp - 0x27c], edx
mov dword [esp + 0xc], str.Failed_to_add_stream_filename_to_MSI_record._n
jmp 0x402a49
mov eax, 0x745c
add esi, 2
mov word [esi - 2], ax
jmp 0x403060
mov eax, 0x725c
add esi, 2
mov word [esi - 2], ax
jmp 0x403060
lea ecx, [eax - 0x20]
cmp cx, 0x5e
jbe 0x403254
mov ecx, eax
mov byte [esi], 0x5c
add esi, 5
shr cx, 0xc
movzx ecx, cx
movzx ecx, byte [ecx + str.0123456789abcdefopen_database]
mov byte [esi - 4], cl
mov ecx, eax
shr cx, 8
and ecx, 0xf
movzx ecx, byte [ecx + str.0123456789abcdefopen_database]
mov byte [esi - 3], cl
mov ecx, eax
and eax, 0xf
shr cx, 4
movzx eax, byte [eax + str.0123456789abcdefopen_database]
and ecx, 0xf
movzx ecx, byte [ecx + str.0123456789abcdefopen_database]
mov byte [esi - 1], al
mov byte [esi - 2], cl
jmp 0x403060
mov eax, 0x225c
add esi, 2
mov word [esi - 2], ax
jmp 0x403060
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x402840
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x40324a
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefopen_database]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefopen_database]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefopen_database]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefopen_database]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x402840
mov eax, 0x225c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x402840
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x402840
test byte [section..data], 2
je 0x4029c2
mov dword [ebp - 0x27c], edx
mov dword [esp + 0xc], str.Failed_to_delete_stream_from__Streams_table._n
jmp 0x402eea
test byte [section..data], 2
je 0x4029c2
mov dword [ebp - 0x27c], edx
mov dword [esp + 0xc], str.Failed_to_add_stream_to__Streams_table._n
jmp 0x402a49
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.004011e0
mov edx, eax
jmp 0x402fa2
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.004011e0
mov edx, eax
jmp 0x4026d5
mov byte [ecx], al
add ecx, 1
jmp 0x402840
mov byte [esi], al
add esi, 1
jmp 0x403060
mov edx, str._null_
jmp 0x4026d5
test byte [section..data], 2
je 0x402aea
mov dword [esp + 0xc], str.Failed_to_query_row_from__Tables_table._n
mov dword [esp + 8], str.export_all_tables
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402aea
mov edx, str._null_
jmp 0x402fa2
test byte [section..data], 2
je 0x402aea
mov dword [esp + 0xc], str.Failed_to_retrieve_name_string._n
mov dword [esp + 8], str.export_all_tables
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402aea
test byte [section..data], 2
je 0x402aea
mov dword [esp + 0xc], str.Failed_to_close_record_handle._n
mov dword [esp + 8], str.export_all_tables
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x402aea
mov eax, 0x224c
mov byte [ebp - 0x216], 0x22
lea esi, [ebp - 0x216]
mov word [ebp - 0x218], ax
lea eax, [esi + 1]
jmp 0x4026c2
mov esi, 0x224c
mov byte [ebp - 0x216], 0x22
lea ecx, [ebp - 0x216]
mov word [ebp - 0x218], si
lea eax, [ecx + 1]
jmp 0x402f8f
mov dword [esp + 0xc], str.No_mode_flag_specified___a___c___e___i___k___x_._n
mov dword [esp + 8], str.valid_state
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.00401060
jmp 0x40230e
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
push eax
jmp 0x402e32
mov dword [esp], eax
call sub.msi.dll_MsiViewClose
push eax
jmp 0x402f53