Function at 0x41cef0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401506
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4013f8
xor eax, eax
push 0x11
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x2c]
push 0x414c1c
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x34]
push 0x41403c
push edx
call ebx
push eax
push 0x80000002
call fcn.00413bbc
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call edi
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
xor ecx, ecx
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 1], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 2], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 7
mov byte [edx + 3], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 4], al
mov ecx, 1
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 0x8a
mov byte [edx + 5], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 6], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 7], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 8], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 9], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0xa], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0xb], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0xc], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0xd], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0xe], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0xf], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x10], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 0x20
mov byte [edx + 0x11], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x12], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x13], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x14], al
mov ecx, 0xc
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 0xa
mov byte [edx + 0x15], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x16], al
mov ecx, 0x21
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 1
mov byte [edx + 0x17], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x18], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x19], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x1a], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x1b], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x1c], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 1
mov byte [edx + 0x1d], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x1e], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x1f], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x20], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x21], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x22], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x23], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x24], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x25], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x26], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x27], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x28], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x29], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x2a], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 3
mov byte [edx + 0x2b], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x2c], al
mov ecx, 0x12
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 0x22
mov byte [edx + 0x2d], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x2e], al
mov ecx, 0x52
call esi
mov edx, dword [ebp - 0x20]
mov ecx, 0x13
mov byte [edx + 0x2f], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x30], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x31], al
call esi
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x32], al
xor ecx, ecx
call esi
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov byte [edx + 0x33], al
call esi
mov ecx, dword [ebp - 0x20]
push 0x35
mov byte [ecx + 0x34], al
mov edx, dword [ebp - 0x20]
push edx
push 3
push 0
lea eax, [ebp - 0x34]
push 0x4140b8
push eax
call ebx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.00413830
call edi
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov edx, dword [ebp - 0x14]
push edx
call fcn.00413c00
call edi
push 0x41d200
jmp 0x41d1ed
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x2c]
push ecx
push 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret