Function at 0x43f649
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x402e18
xor ebx, ebx
push 8
pop esi
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x90], 0x40a884
mov dword [ebp - 0x98], esi
call sub.MSVBVM60.DLL___vbaVarDup
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x6008
call sub.MSVBVM60.DLL_rtcJoin
mov edx, eax
lea ecx, [ebp - 0x2c]
call sub.MSVBVM60.DLL___vbaStrMove
mov eax, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x4c], eax
push 0x80
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], esi
call sub.MSVBVM60.DLL_rtcStrConvVar2
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
call sub.MSVBVM60.DLL___vbaVar2Vec
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVBVM60.DLL___vbaAryMove
lea ecx, [ebp - 0x2c]
call sub.MSVBVM60.DLL___vbaFreeStr
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 3
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x10
push dword [ebp - 0x20]
push 1
call sub.MSVBVM60.DLL___vbaUbound
push ebx
push 0x80000000
push 4
push ebx
inc eax
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push 0x40000000
push dword [eax]
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
jne 0x43f85d
call sub.KERNEL32.DLL_GetLastError
push eax
mov dword [ebp - 0x18], eax
call fcn.00408930
mov edx, eax
lea ecx, [ebp - 0x2c]
call sub.MSVBVM60.DLL___vbaStrMove
call sub.MSVBVM60.DLL___vbaSetSystemError
call sub.MSVBVM60.DLL_rtcErrObj
push eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaObjSet
push 0xa
pop esi
push dword [ebp - 0x2c]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x30]
mov edi, 0x80020004
push eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x64], esi
call sub.MSVBVM60.DLL___vbaStrToUnicode
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], 8
call sub.MSVBVM60.DLL___vbaVarDup
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0x74]
push edx
lea edx, [ebp - 0x64]
push edx
lea edx, [ebp - 0x54]
push edx
lea edx, [ebp - 0x44]
push edx
mov edx, dword [ebp - 0x18]
add edx, 0x80040000
push edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
fnclex
cmp eax, ebx
jge 0x43f827
push 0x44
push 0x40a8d8
push dword [ebp - 0xc0]
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeObj
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 4
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x14
jmp 0x43f865
push 0xa
mov edi, 0x80020004
pop esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x28]
push eax
call sub.MSVBVM60.DLL___vbaAryLock
push ebx
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xc]
push dword [ebp - 0x14]
sub ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x24]
call sub.KERNEL32.DLL_WriteFile
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x28]
push eax
call sub.MSVBVM60.DLL___vbaAryUnlock
cmp dword [ebp - 0xbc], ebx
jne 0x43f982
call sub.KERNEL32.DLL_GetLastError
push eax
mov dword [ebp - 0x18], eax
call fcn.00408930
mov edx, eax
lea ecx, [ebp - 0x2c]
call sub.MSVBVM60.DLL___vbaStrMove
call sub.MSVBVM60.DLL___vbaSetSystemError
call sub.MSVBVM60.DLL_rtcErrObj
push eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaObjSet
push dword [ebp - 0x2c]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x64], esi
call sub.MSVBVM60.DLL___vbaStrToUnicode
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], 8
call sub.MSVBVM60.DLL___vbaVarDup
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x44], esi
mov esi, dword [ebp - 0xc0]
add ecx, 0x80040000
push ecx
mov dword [ebp - 0x3c], edi
mov eax, dword [esi]
push esi
call dword [eax + 0x44]
fnclex
cmp eax, ebx
jge 0x43f94e
push 0x44
push 0x40a8d8
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeObj
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 4
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x14
mov esi, dword [ebp - 0x24]
push ebx
push ebx
push dword [ebp - 0x18]
push esi
call sub.KERNEL32.DLL_SetFilePointer
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push esi
call sub.KERNEL32.DLL_FlushFileBuffers
push esi
call sub.KERNEL32.DLL_CloseHandle
push 0x43f9fe
jmp 0x43f9f2
lea eax, [ebp - 0x20]
push eax
push 0
call sub.MSVBVM60.DLL___vbaAryDestruct
ret