Function at 0x4042c0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4012d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401260
xor edi, edi
push 0x401ec4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edi
call dword [sym.imp.MSVBVM60.DLL___vbaAptOffset]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov esi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 3
lea eax, [ebp - 0x30]
push 0x402768
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
call fcn.00403bc0
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
mov word [esi + 0x406094], di
mov word [esi + 0x406096], ax
mov dword [esi + 0x406098], edi
mov word [esi + 0x40609c], di
push ecx
mov dword [esi + 0x4060a0], eax
push edi
mov word [esi + 0x4060a4], di
lea ebx, [esi + 0x40604c]
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromAnsi]
mov edx, eax
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
mov ecx, ebx
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov edx, dword [ebx]
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov dword [esi + 0x406050], eax
push 0x404050
mov dword [esi + 0x406058], eax
call fcn.00403ee0
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateEventW]
push edi
push edi
mov dword [esi + 0x40605c], eax
push 1
mov dword [esi + 0x406060], edi
push edi
mov dword [esi + 0x406064], edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x406088], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x406090], eax
call ebx
mov dword [esi + 0x40608c], eax
mov ecx, dword [esi + 0x406088]
cmp ecx, edi
je 0x404465
cmp dword [esi + 0x406090], edi
je 0x404465
cmp eax, edi
je 0x404465
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], edi
push eax
push 4
push edi
push 0x4041c0
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, edi
mov dword [esi + 0x406054], eax
je 0x404465
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x406054]
push 0xffffffffffffffff
push edi
mov dword [edx], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [esi + 0x40608c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x24]
push edx
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
cmp eax, 1
jne 0x404465
mov word [esi + 0x406094], 0xffff
push 4
mov word [esi + 0x406096], di
call fcn.00403ef0
cmp word [esi + 0x406094], di
jne 0x404498
mov eax, dword [esi + 0x406054]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x406088]
push ecx
call edi
mov edx, dword [esi + 0x406090]
push edx
call edi
mov eax, dword [esi + 0x40608c]
push eax
call edi
mov cx, word [esi + 0x406094]
push 0x4044e0
not cx
mov word [esi + 0x406096], cx
mov dx, word [esi + 0x406094]
mov dword [ebp - 0x3c], edx
jmp 0x4044c4
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x30]
push ecx
push 0
mov dword [ebp - 0x44], eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret