Function at 0x42f347
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
push 0x4bc550
lea ecx, [ebp - 4]
call fcn.00403927
push 0x4b1024
lea ecx, [ebp - 0x14]
call fcn.00403927
push str.Export_
lea ecx, [ebp - 0x18]
call fcn.00403927
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
lea ecx, [ebp - 0x18]
call fcn.004038fb
push 0x15
xor eax, eax
pop ecx
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
push 0x16
lea edi, [ebp - 0x74]
pop ecx
mov esi, 0x4b1010
push 1
rep stosd dword es:[edi], eax
pop eax
mov edi, 0x4b0f0c
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push edi
push esi
mov dword [ebp - 0x74], 0x58
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x40], 2
call fcn.0044a9d1
add esp, 0x14
mov dword [ebp - 0x5c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x6c], eax
mov eax, 0x104
push 0x400
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], str.Export_TXT_CSV_HTML_XLS
call fcn.00403c58
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x68], 0x4b2e88
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
je 0x42f7ac
mov ebx, dword [ebp - 0x5c]
push 0
push ebx
push edi
push esi
call fcn.0044a990
mov esi, dword [ebp - 0x58]
xor edi, edi
add esp, 0x10
cmp esi, edi
jne 0x42f438
xor eax, eax
jmp 0x42f43f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
cmp ebx, 5
jne 0x42f4f5
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], edi
jl 0x42f46e
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42f47d
mov eax, dword [0x4af550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a750
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee38
push 0x4b2e84
lea ecx, [ebp - 0x18]
call fcn.00403927
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0049c975
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x18]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f4d8
push 0x4b2e7c
lea ecx, [ebp - 0x18]
call fcn.00403927
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x18]
call fcn.004038fb
push edi
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
call fcn.0042f7fb
lea ecx, [ebp - 0x1c]
jmp 0x42f7a7
cmp ebx, 4
jne 0x42f5a1
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], edi
jl 0x42f51a
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42f529
mov eax, dword [0x4af550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a750
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee38
push 0x4b0ff8
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049c975
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f584
push 0x4b0ff0
lea ecx, [ebp - 0x1c]
call fcn.00403927
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x1c]
call fcn.004038fb
push edi
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
call fcn.0042f7fb
lea ecx, [ebp - 0x18]
jmp 0x42f7a7
push ecx
cmp ebx, 3
mov ecx, esp
jne 0x42f628
lea eax, [ebp - 4]
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee38
push str.html
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049c975
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f60a
push 0x4b0ffc
lea ecx, [ebp - 0x1c]
call fcn.00403927
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 4]
push eax
call fcn.0040aa48
lea ecx, [ebp - 0x1c]
call fcn.004038fb
push 1
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
call fcn.0042f7fb
lea ecx, [ebp - 0x18]
jmp 0x42f7a7
push str.csv4xls
call fcn.00403927
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0042eb61
cmp ebx, 1
jne 0x42f6d5
push 0x4afcdc
push str._r_n_r_n
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4b0324
push str._t_t_t_t
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4bc518
push 0x4b2db0
lea ecx, [ebp - 0xc]
call fcn.004040f7
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee38
push 0x4b0f08
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049c975
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f6cd
push 0x4b2e70
lea ecx, [ebp - 4]
call fcn.00430cff
lea ecx, [ebp - 0x18]
jmp 0x42f767
cmp ebx, 2
jne 0x42f76c
push 0x4afcdc
push str._r_n_r_n
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4b18ec
push 0x4b2db0
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4af814
push str._t_t_t_t
lea ecx, [ebp - 0xc]
call fcn.004040f7
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee38
push 0x4b100c
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049c975
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f764
push 0x4b2e64
lea ecx, [ebp - 4]
call fcn.00430cff
lea ecx, [ebp - 0x18]
call fcn.004038fb
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], edi
je 0x42f7a4
lea eax, [ebp - 0xc]
push 0x4b2e38
push eax
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.0042f7d3
add esp, 0xc
push 1
push edi
push edi
push dword [ebp - 4]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret 4