Function at 0x41b540
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401fb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401738
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x58]
push eax
xor edi, edi
push 0x100
push ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x48], 2
call dword [sym.imp.MSVBVM60.DLL_rtcStringVar]
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x24]
call ebx
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x48]
push eax
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
add esp, 0xc
lea edx, [ebp - 0x38]
push 0x40f0f4
push edx
call esi
push eax
mov eax, dword [ebp - 0x24]
push 0xff
lea ecx, [ebp - 0x34]
push eax
push ecx
call esi
mov edx, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [edx]
push eax
push ecx
call esi
mov edx, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
mov eax, dword [edx]
push eax
push ecx
call esi
mov edx, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
mov eax, dword [edx]
push eax
push ecx
call esi
push eax
call fcn.0040e4f8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call esi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
call esi
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push edx
push eax
call esi
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x34]
push ecx
lea eax, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x28]
push ecx
push edx
push 5
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov eax, dword [ebp - 0x6c]
add esp, 0x18
cmp eax, 1
jle 0x41b688
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharBstr]
mov edx, eax
lea ecx, [ebp - 0x24]
call ebx
mov ecx, dword [ebp - 0x24]
mov esi, dword [sym.imp.MSVBVM60.DLL_rtcBstrFromAnsi]
push 1
push ecx
push edi
call esi
mov edx, eax
lea ecx, [ebp - 0x28]
call ebx
push eax
push edi
call esi
mov edx, eax
lea ecx, [ebp - 0x2c]
call ebx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x30]
call ebx
push eax
push edi
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov ecx, eax
call dword [sym.imp.MSVBVM60.DLL___vbaI2I4]
mov esi, eax
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
push eax
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
cmp si, di
jle 0x41b704
mov eax, dword [ebp - 0x24]
sub si, 1
jo 0x41b776
movsx edx, si
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharBstr]
mov edx, eax
lea ecx, [ebp - 0x24]
call ebx
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 0x41b760
jmp 0x41b756
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop