Function at 0x4449c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x402396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x188
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401c58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcLeftTrimBstr]
mov edx, eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
test eax, eax
jne 0x444b7e
mov dword [ebp - 4], 5
cmp dword [0x44f838], 0
jne 0x444a8d
push 0x44f838
push 0x40c5f8
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x178], 0x44f838
jmp 0x444a97
mov dword [ebp - 0x178], 0x44f838
mov edx, dword [ebp - 0x178]
mov eax, dword [edx]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [eax + 0x14]
fnclex
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jge 0x444aef
push 0x14
push 0x40c5e8
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x17c], eax
jmp 0x444af9
mov dword [ebp - 0x17c], 0
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x128], ecx
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x128]
push edx
call dword [ecx + 0x60]
fnclex
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jge 0x444b4c
push 0x60
push 0x40c608
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x180], eax
jmp 0x444b56
mov dword [ebp - 0x180], 0
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp - 0x168]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcLeftTrimBstr]
mov edx, eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
test eax, eax
jne 0x44506a
mov dword [ebp - 4], 9
cmp dword [0x44f838], 0
jne 0x444bdf
push 0x44f838
push 0x40c5f8
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x184], 0x44f838
jmp 0x444be9
mov dword [ebp - 0x184], 0x44f838
mov edx, dword [ebp - 0x184]
mov eax, dword [edx]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [eax + 0x14]
fnclex
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jge 0x444c41
push 0x14
push 0x40c5e8
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x188], eax
jmp 0x444c4b
mov dword [ebp - 0x188], 0
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x128], ecx
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x128]
push edx
call dword [ecx + 0x50]
fnclex
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jge 0x444c9e
push 0x50
push 0x40c608
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x18c], eax
jmp 0x444ca8
mov dword [ebp - 0x18c], 0
push 1
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcRightCharBstr]
mov edx, eax
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
cmp dword [0x44f838], 0
jne 0x444ce4
push 0x44f838
push 0x40c5f8
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x190], 0x44f838
jmp 0x444cee
mov dword [ebp - 0x190], 0x44f838
mov eax, dword [ebp - 0x190]
mov ecx, dword [eax]
mov dword [ebp - 0x130], ecx
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x130]
push edx
call dword [ecx + 0x14]
fnclex
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jge 0x444d46
push 0x14
push 0x40c5e8
mov eax, dword [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x194], eax
jmp 0x444d50
mov dword [ebp - 0x194], 0
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x138], edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x138]
push eax
call dword [edx + 0x50]
fnclex
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jge 0x444da3
push 0x50
push 0x40c608
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x198], eax
jmp 0x444dad
mov dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x16c]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x98], 8
mov dword [ebp - 0x100], 0x40ca20
mov dword [ebp - 0x108], 8
lea edx, [ebp - 0x108]
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
mov dword [ebp - 0xf0], 0x40f168
mov dword [ebp - 0xf8], 8
lea edx, [ebp - 0xf8]
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x4c], 0
mov edx, dword [ebp - 0x170]
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x40f168
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
neg eax
sbb eax, eax
neg eax
neg eax
mov word [ebp - 0xe0], ax
mov dword [ebp - 0xe8], 0xb
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0xe8]
push edx
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcImmediateIf]
cmp dword [0x44f838], 0
jne 0x444e9e
push 0x44f838
push 0x40c5f8
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x19c], 0x44f838
jmp 0x444ea8
mov dword [ebp - 0x19c], 0x44f838
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx]
mov dword [ebp - 0x140], edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x140]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x140]
push eax
call dword [edx + 0x14]
fnclex
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jge 0x444f00
push 0x14
push 0x40c5e8
mov ecx, dword [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x1a0], eax
jmp 0x444f0a
mov dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x148], eax
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x148]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x148]
push ecx
call dword [eax + 0x58]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jge 0x444f5d
push 0x58
push 0x40c608
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x1a4], eax
jmp 0x444f67
mov dword [ebp - 0x1a4], 0
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x48], 0
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xb8], 8
mov dword [ebp - 0x110], 0x4122e4
mov dword [ebp - 0x118], 8
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x40]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x50]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
add esp, 0x10
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0xe8]
push eax
push 9
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x28
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x1a8], edx
cmp dword [ebp - 0x1a8], 0
je 0x4450ca
cmp dword [ebp - 0x1a8], 1
je 0x4450ab
cmp dword [ebp - 0x1a8], 2
je 0x445109
jmp 0x445170
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x28]
push eax
push 0x412284
push 0x80000002
call fcn.00443f00
jmp 0x4451b5
mov dword [ebp - 4], 0xf
mov ecx, dword [ebp - 0x28]
push ecx
push 0x412284
push 0x4122f4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x80000002
call fcn.00443f00
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
jmp 0x4451b5
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x11c], 1
lea edx, [ebp - 0x24]
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xe8], 0x4008
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0xe8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x412284
push 0x4122f4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x80000002
call fcn.00445290
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
jmp 0x4451b5
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x11c], 1
lea eax, [ebp - 0x24]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe8], 0x4008
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0xe8]
push edx
mov eax, dword [ebp - 0x28]
push eax
push 0x412284
push 0x80000002
call fcn.00445290
push 0x445259
jmp 0x445246
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret