Function at 0x42f39d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
push 0x4bd614
lea ecx, [ebp - 4]
call fcn.00403927
push 0x4b2024
lea ecx, [ebp - 0x14]
call fcn.00403927
push str.Export_
lea ecx, [ebp - 0x18]
call fcn.00403927
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
lea ecx, [ebp - 0x18]
call fcn.004038fb
push 0x15
xor eax, eax
pop ecx
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
push 0x16
lea edi, [ebp - 0x74]
pop ecx
mov esi, 0x4b2010
push 1
rep stosd dword es:[edi], eax
pop eax
mov edi, 0x4b1f0c
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push edi
push esi
mov dword [ebp - 0x74], 0x58
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x40], 2
call fcn.0044ad72
add esp, 0x14
mov dword [ebp - 0x5c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x6c], eax
mov eax, 0x104
push 0x400
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], str.Export_TXT_CSV_HTML_XLS
call fcn.00403c58
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x68], 0x4b3e88
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
je 0x42f802
mov ebx, dword [ebp - 0x5c]
push 0
push ebx
push edi
push esi
call fcn.0044ad31
mov esi, dword [ebp - 0x58]
xor edi, edi
add esp, 0x10
cmp esi, edi
jne 0x42f48e
xor eax, eax
jmp 0x42f495
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.004039ec
cmp ebx, 5
jne 0x42f54b
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], edi
jl 0x42f4c4
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42f4d3
mov eax, dword [0x4b0550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a70f
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee8e
push 0x4b3e84
lea ecx, [ebp - 0x18]
call fcn.00403927
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0049cec5
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x18]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f52e
push 0x4b3e7c
lea ecx, [ebp - 0x18]
call fcn.00403927
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x18]
call fcn.004038fb
push edi
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
call fcn.0042f851
lea ecx, [ebp - 0x1c]
jmp 0x42f7fd
cmp ebx, 4
jne 0x42f5f7
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], edi
jl 0x42f570
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42f57f
mov eax, dword [0x4b0550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a70f
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee8e
push 0x4b1ff8
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049cec5
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f5da
push 0x4b1ff0
lea ecx, [ebp - 0x1c]
call fcn.00403927
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x1c]
call fcn.004038fb
push edi
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
call fcn.0042f851
lea ecx, [ebp - 0x18]
jmp 0x42f7fd
push ecx
cmp ebx, 3
mov ecx, esp
jne 0x42f67e
lea eax, [ebp - 4]
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee8e
push str.html
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049cec5
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f660
push 0x4b1ffc
lea ecx, [ebp - 0x1c]
call fcn.00403927
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 4]
push eax
call fcn.0040aa07
lea ecx, [ebp - 0x1c]
call fcn.004038fb
push 1
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
call fcn.0042f851
lea ecx, [ebp - 0x18]
jmp 0x42f7fd
push str.csv4xls
call fcn.00403927
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0042ebb7
cmp ebx, 1
jne 0x42f72b
push 0x4b0cdc
push str._r_n_r_n
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4b1324
push str._t_t_t_t
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4bd5d8
push 0x4b3db0
lea ecx, [ebp - 0xc]
call fcn.004040f7
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee8e
push 0x4b1f08
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049cec5
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f723
push 0x4b3e70
lea ecx, [ebp - 4]
call fcn.00430d58
lea ecx, [ebp - 0x18]
jmp 0x42f7bd
cmp ebx, 2
jne 0x42f7c2
push 0x4b0cdc
push str._r_n_r_n
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4b28ec
push 0x4b3db0
lea ecx, [ebp - 0xc]
call fcn.004040f7
push 0x4b0814
push str._t_t_t_t
lea ecx, [ebp - 0xc]
call fcn.004040f7
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee8e
push 0x4b200c
lea ecx, [ebp - 0x1c]
call fcn.00403927
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0049cec5
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004038fb
test bl, bl
je 0x42f7ba
push 0x4b3e64
lea ecx, [ebp - 4]
call fcn.00430d58
lea ecx, [ebp - 0x18]
call fcn.004038fb
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], edi
je 0x42f7fa
lea eax, [ebp - 0xc]
push 0x4b3e38
push eax
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.004038b5
call fcn.0042f829
add esp, 0xc
push 1
push edi
push edi
push dword [ebp - 4]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret 4