Function at 0x560500
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4051a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x404318
mov eax, dword [0x5753c8]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x5c], ecx
jne 0x56055f
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaNew2]
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
jmp 0x560565
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3a0]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
lea edx, [ebp - 0x38]
push eax
push edx
call ebx
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x5605a2
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x34], 0
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov edx, dword [ebp - 0x5c]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
push edx
push 0x41eafc
call esi
test eax, eax
jne 0x560660
mov eax, dword [0x5754e0]
test eax, eax
jne 0x5605ec
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x56060c
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x398]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x560647
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41eb28
push 0x80000002
push ebx
call dword [edx + 0x24]
jmp 0x560a8e
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41e69c
call esi
test eax, eax
jne 0x5606f8
mov eax, dword [0x5754e0]
test eax, eax
jne 0x560688
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x5606a8
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x398]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x5606e3
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41ca0c
push 0x80000002
jmp 0x560a8a
mov edx, dword [ebp - 0x5c]
push edx
push 0x41eb98
call esi
test eax, eax
jne 0x560794
mov eax, dword [0x5754e0]
test eax, eax
jne 0x560720
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x560740
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x398]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x56077b
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41ca0c
push 0x80000001
push ebx
call dword [edx + 0x24]
jmp 0x560a8e
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41ebb4
call esi
test eax, eax
jne 0x560827
mov eax, dword [0x5754e0]
test eax, eax
jne 0x5607bc
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x5607dc
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x398]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x560817
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41ebe4
jmp 0x560a85
mov edx, dword [ebp - 0x5c]
push edx
push 0x41e478
call esi
test eax, eax
jne 0x5608c3
mov eax, dword [0x5754e0]
test eax, eax
jne 0x56084f
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x56086f
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x398]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x5608aa
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41ea00
push 0x80000002
push ebx
call dword [edx + 0x24]
jmp 0x560a8e
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41ea68
call esi
test eax, eax
jne 0x56095b
mov eax, dword [0x5754e0]
test eax, eax
jne 0x5608eb
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x56090b
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x398]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x560946
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41ea90
push 0x80000002
jmp 0x560a8a
mov edx, dword [ebp - 0x5c]
push edx
push 0x41ec68
call esi
test eax, eax
jne 0x5609f7
mov eax, dword [0x5754e0]
test eax, eax
jne 0x560983
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x5609a3
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x398]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x5609de
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41ea00
push 0x80000001
push ebx
call dword [edx + 0x24]
jmp 0x560a8e
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41ec8c
call esi
test eax, eax
jne 0x560aa5
mov eax, dword [0x5754e0]
test eax, eax
jne 0x560a1f
push 0x5754e0
push 0x4063c8
call edi
mov eax, dword [0x5753c8]
mov ebx, dword [0x5754e0]
test eax, eax
jne 0x560a3f
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x398]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x560a7a
push 0xf8
push 0x4177cc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41ecb0
push 0x80000001
push ebx
call dword [eax + 0x24]
test eax, eax
fnclex
jge 0x560b2e
push 0x24
push 0x41bc18
push ebx
jmp 0x560b27
mov eax, dword [0x5753c8]
test eax, eax
jne 0x560abf
push 0x5753c8
push 0x40d828
call edi
mov eax, dword [0x5753c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x390]
push eax
lea eax, [ebp - 0x38]
push eax
call ebx
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xa0]
test eax, eax
fnclex
jge 0x560af6
push 0xa0
push 0x416870
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x560b0b
lea eax, [ebp - 0x2c]
push eax
push 0x41780c
call edi
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov ecx, dword [eax]
push 0xffffffffffffffff
push edx
push eax
mov esi, eax
call dword [ecx + 0x5c]
test eax, eax
fnclex
jge 0x560b2e
push 0x5c
push 0x41781c
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
push 0x4177fc
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaCastObj]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
lea ecx, [ebp - 0x48]
push ecx
call fcn.0055c700
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x560baf
jmp 0x560b9c
lea ecx, [ebp - 0x5c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
ret