Function at 0x43f7d0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x401536
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x130
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401308
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov edx, 0x433e5c
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x433dd4
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov dword [ebp - 0xec], 0x80000001
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0xec]
push edx
call fcn.0043f2e0
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x436134
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x90], 8
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
mov dword [ebp - 4], 4
mov dword [ebp - 0xc8], 0x433e8c
mov dword [ebp - 0xd0], 8
lea edx, [ebp - 0xd0]
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x90]
push eax
push 0x433e70
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcSplit]
lea edx, [ebp - 0xa0]
push edx
push 0x2008
call dword [sym.imp.MSVBVM60.DLL___vbaAryVar]
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryCopy]
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x90]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0xc
mov dword [ebp - 4], 5
cmp dword [0x443738], 0
jne 0x43f96a
push 0x443738
push 0x436110
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x13c], 0x443738
jmp 0x43f974
mov dword [ebp - 0x13c], 0x443738
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx]
mov dword [ebp - 0xf0], edx
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xf0]
push eax
call dword [edx + 0x14]
fnclex
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jge 0x43f9cc
push 0x14
push 0x436100
mov ecx, dword [ebp - 0xf0]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x140], eax
jmp 0x43f9d6
mov dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0xf8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xf8]
push ecx
call dword [eax + 0x50]
fnclex
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jge 0x43fa29
push 0x50
push 0x436120
mov edx, dword [ebp - 0xf8]
push edx
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x144], eax
jmp 0x43fa33
mov dword [ebp - 0x144], 0
cmp dword [0x443738], 0
jne 0x43fa58
push 0x443738
push 0x436110
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov dword [ebp - 0x148], 0x443738
jmp 0x43fa62
mov dword [ebp - 0x148], 0x443738
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx]
mov dword [ebp - 0x100], edx
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x100]
push eax
call dword [edx + 0x14]
fnclex
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jge 0x43faba
push 0x14
push 0x436100
mov ecx, dword [ebp - 0x100]
push ecx
mov edx, dword [ebp - 0x104]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x14c], eax
jmp 0x43fac4
mov dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x108]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x108]
push ecx
call dword [eax + 0x58]
fnclex
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jge 0x43fb17
push 0x58
push 0x436120
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x150], eax
jmp 0x43fb21
mov dword [ebp - 0x150], 0
mov ecx, dword [ebp - 0x6c]
push ecx
push 0x436134
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x78]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x43613c
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x6c]
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x7c]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
add esp, 0xc
mov dword [ebp - 4], 6
mov dword [ebp - 0xd8], 0x4353f4
mov dword [ebp - 0xe0], 8
lea edx, [ebp - 0xe0]
lea ecx, [ebp - 0xa0]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
mov dword [ebp - 0xc8], 0x4353f4
mov dword [ebp - 0xd0], 8
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcSplit]
lea eax, [ebp - 0xb0]
push eax
push 0x2008
call dword [sym.imp.MSVBVM60.DLL___vbaAryVar]
mov dword [ebp - 0xec], eax
lea ecx, [ebp - 0xec]
push ecx
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryCopy]
lea ecx, [ebp - 0x6c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x90]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x30]
push eax
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov word [ebp - 0x114], ax
mov word [ebp - 0x110], 1
mov word [ebp - 0x54], 0
jmp 0x43fc9f
mov cx, word [ebp - 0x54]
add cx, word [ebp - 0x110]
mov word [ebp - 0x54], cx
mov dx, word [ebp - 0x54]
cmp dx, word [ebp - 0x114]
jg 0x440028
mov dword [ebp - 4], 8
mov word [ebp - 0xe4], 0
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
lea edx, [ebp - 0xe4]
push edx
movsx eax, word [ebp - 0x54]
mov ecx, dword [ebp - 0x68]
sub eax, dword [ecx + 0x14]
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0xc]
lea edx, [ecx + eax*4]
push edx
call fcn.0043f580
mov word [ebp - 0xe8], ax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
movsx ecx, word [ebp - 0xe8]
test ecx, ecx
jne 0x43fd0f
jmp 0x44001c
mov dword [ebp - 4], 0xb
mov edx, dword [ebp - 0x5c]
push edx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov word [ebp - 0x11c], ax
mov word [ebp - 0x118], 1
mov word [ebp - 0x24], 0
jmp 0x43fd49
mov ax, word [ebp - 0x24]
add ax, word [ebp - 0x118]
mov word [ebp - 0x24], ax
mov cx, word [ebp - 0x24]
cmp cx, word [ebp - 0x11c]
jg 0x44001c
mov dword [ebp - 4], 0xc
movsx edx, word [ebp - 0x54]
mov eax, dword [ebp - 0x30]
sub edx, dword [eax + 0x14]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
push 0x436134
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa0], 8
mov edx, dword [ebp - 0x5c]
push edx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
movsx ecx, word [ebp - 0x24]
mov edx, dword [ebp - 0x68]
sub ecx, dword [edx + 0x14]
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + 0xc]
lea eax, [edx + ecx*4]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], 0x4008
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0x90]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcTrimVar]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
mov dword [ebp - 0xd8], 0x43613c
mov dword [ebp - 0xe0], 8
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
lea ecx, [ebp - 0xe0]
push ecx
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0xa0]
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x14
mov dword [ebp - 4], 0xd
mov word [ebp - 0xe4], 0xffff
lea ecx, [ebp - 0xe4]
push ecx
lea edx, [ebp - 0x60]
push edx
call fcn.0043f580
movsx eax, ax
test eax, eax
je 0x43fe88
jmp 0x440010
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
test eax, eax
je 0x440010
mov dword [ebp - 4], 0x11
mov word [ebp - 0xe4], 0
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.0043f3f0
mov dword [ebp - 4], 0x12
mov word [ebp - 0x124], 0xa
mov word [ebp - 0x120], 1
mov word [ebp - 0x64], 1
jmp 0x43fef9
mov ax, word [ebp - 0x64]
add ax, word [ebp - 0x120]
mov word [ebp - 0x64], ax
mov cx, word [ebp - 0x64]
cmp cx, word [ebp - 0x124]
jg 0x43ffc9
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xd0], 8
mov word [ebp - 0xe8], 0xff
mov word [ebp - 0xe4], 0
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xe4]
push ecx
call fcn.0043f4c0
movsx edx, ax
push edx
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcVarBstrFromAnsi]
lea ecx, [ebp - 0x90]
push ecx
push 1
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcStringVar]
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarCat]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x90]
push edx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x10
mov dword [ebp - 4], 0x14
jmp 0x43feea
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x60]
push eax
push 1
push 0xffffffffffffffff
push 0x20
call dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
mov dword [ebp - 4], 0x16
push 1
push 1
call dword [sym.imp.MSVBVM60.DLL_rtcFileLength]
add eax, 1
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaPut4]
mov dword [ebp - 4], 0x17
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
mov dword [ebp - 4], 0x1a
jmp 0x43fd3a
mov dword [ebp - 4], 0x1c
jmp 0x43fc90
push 0x440103
jmp 0x4400a2
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea edx, [ebp - 0x30]
push edx
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea eax, [ebp - 0x5c]
push eax
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret