Function at 0x407800
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4015c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x3c
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x4012e0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x24]
push eax
push 0x100
call dword [sym.imp.MSVBVM60.DLL___vbaFixstrConstruct]
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00407b80
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x404748
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x404440
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x30]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x28]
push eax
push 0x4042c0
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
test eax, eax
jne 0x4078da
jmp 0x407a1c
mov dword [ebp - 4], 7
mov edx, 0x4047c8
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x404768
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov dword [ebp - 0x48], 0x80000001
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.00407a70
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x30]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 8
mov ecx, dword [0x40d05c]
push ecx
push 0xa
push 0xffffffffffffffff
push 0x120
call dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
mov dword [ebp - 4], 9
call fcn.00407b80
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x404748
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0xb
push 0xffffffffffffffff
push 0x220
call dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x30]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 0xa
mov ecx, dword [0x40d05c]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcFileLen]
cmp dword [ebp - 0x2c], eax
jge 0x4079fe
mov dword [ebp - 4], 0xb
push 0xa
mov edx, dword [ebp - 0x24]
push edx
push 0x100
call dword [sym.imp.MSVBVM60.DLL___vbaGetFxStr3]
mov dword [ebp - 4], 0xc
push 0xb
mov eax, dword [ebp - 0x24]
push eax
push 0x100
call dword [sym.imp.MSVBVM60.DLL___vbaPutFxStr3]
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
add eax, dword [ebp - 0x2c]
jo 0x407a5b
mov dword [ebp - 0x2c], eax
jmp 0x40799a
mov dword [ebp - 4], 0xf
push 0xb
call dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
mov dword [ebp - 4], 0x10
push 0xa
call dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
push 0x407a4a
jmp 0x407a37
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
int3