Function at 0x4110f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401836
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401610
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x64], ecx
xor esi, esi
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x5c], ecx
mov edx, 0x404428
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x98], esi
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x18]
push edx
push 0x20007
push esi
lea ecx, [ebp - 0x74]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0x80000001
call fcn.00403934
mov ebx, eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x44]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
xor ecx, ecx
cmp ebx, esi
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
setne cl
neg ecx
mov di, cx
lea ecx, [ebp - 0x74]
call ebx
cmp di, si
je 0x4111eb
mov edx, 0x403240
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 0x411498
jmp 0x411478
push 0xff
call dword [sym.imp.MSVBVM60.DLL_rtcSpaceBstr]
mov edx, eax
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x58]
push eax
lea edx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x54]
push ecx
lea edx, [ebp - 0x40]
push esi
push edx
lea ecx, [ebp - 0x74]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
mov edx, dword [ebp - 0x18]
push eax
push edx
call fcn.004039c8
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x54]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
lea ecx, [ebp - 0x74]
call ebx
mov edx, dword [ebp - 0x38]
add edx, 1
jo 0x4114ac
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcSpaceBstr]
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x74]
call ebx
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov ecx, dword [ebp - 0x50]
push esi
add ecx, 1
lea edx, [ebp - 0x5c]
jo 0x4114ac
push ecx
push 1
push 0x11
push edx
push 1
push 0x80
mov dword [ebp - 0x68], eax
call dword [sym.imp.MSVBVM60.DLL___vbaRedim]
mov eax, dword [ebp - 0x50]
add esp, 0x1c
add eax, 1
mov dword [ebp - 0x28], esi
jo 0x4114ac
mov dword [ebp - 0x2c], eax
cmp edi, 0x103
je 0x411429
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x70]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov ecx, dword [ebp - 0x70]
cmp ecx, esi
je 0x411319
cmp word [ecx], 1
jne 0x411319
mov edi, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
neg edi
cmp edi, eax
jb 0x411315
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [ebp - 0x70]
mov eax, edi
jmp 0x411322
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp - 0x2c]
push edx
add ecx, eax
lea edx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x64]
push edx
lea eax, [ebp - 0x68]
push esi
push eax
lea edx, [ebp - 0x74]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
mov ecx, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x28]
push eax
push ecx
call fcn.004038ec
mov edi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x64]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea ecx, [ebp - 0x74]
call ebx
mov edx, dword [ebp - 0x64]
push 1
push edx
push 0x4044b0
push esi
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
test eax, eax
jne 0x4113ac
cmp edi, 0x103
je 0x411429
mov eax, dword [ebp - 0x28]
add eax, 1
jo 0x4114ac
mov dword [ebp - 0x28], eax
jmp 0x4112d9
push esi
lea edx, [ebp - 0x98]
push 0x40
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0x5c]
push edx
push eax
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x98], 0x6011
call dword [sym.imp.MSVBVM60.DLL_rtcStrConvVar2]
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x74]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
call fcn.00412160
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x78]
call esi
lea eax, [ebp - 0x78]
push eax
call fcn.0040fb40
mov edx, eax
lea ecx, [ebp - 0x1c]
call esi
lea ecx, [ebp - 0x78]
lea edx, [ebp - 0x74]
push ecx
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x88]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov eax, dword [ebp - 0x18]
push eax
call fcn.00403814
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x411498
jmp 0x411478
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x44]
call esi
lea ecx, [ebp - 0x54]
call esi
lea ecx, [ebp - 0x64]
push ecx
push 0x403298
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop