Function at 0x41e970
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x401a26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x4019f8
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xc0], ebx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
call esi
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call esi
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x20006
push ebx
push ebx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x38]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
call edi
push eax
lea ecx, [ebp - 0x3c]
push ecx
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
call esi
push eax
push ebx
push 0x40963c
lea edx, [ebp - 0x34]
push edx
call esi
push eax
push 0x80000001
call fcn.004066a0
mov dword [ebp - 0xc0], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor eax, eax
cmp dword [ebp - 0xc0], ebx
setne al
neg eax
mov bx, ax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x34]
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
test bx, bx
je 0x41ebcd
mov ecx, 0x80020004
mov dword [ebp - 0x84], ecx
mov eax, 0xa
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x6c], eax
mov ebx, dword [sym.imp.MSVBVM60.DLL_rtcErrObj]
call ebx
push eax
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xc0]
push eax
push esi
call dword [edx + 0x1c]
fnclex
test eax, eax
jge 0x41ead2
push 0x1c
push 0x409288
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
call ebx
push eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
mov edx, dword [esi]
lea eax, [ebp - 0x40]
push eax
push esi
call dword [edx + 0x2c]
fnclex
test eax, eax
jge 0x41eb00
push 0x2c
push 0x409288
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
push 0x40969c
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x34]
call edi
push eax
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
call esi
mov edx, eax
lea ecx, [ebp - 0x38]
call edi
push eax
push 0x4096b0
call esi
mov edx, eax
lea ecx, [ebp - 0x3c]
call edi
push eax
push 0x4096d0
call esi
mov edx, eax
lea ecx, [ebp - 0x44]
call edi
push eax
mov edx, dword [ebp - 0x40]
push edx
call esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x5c], 8
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcMsgBox]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x34]
push edx
push 5
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x38
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x41f009
jmp 0x41eff3
cmp word [ebp + 0x10], 0
je 0x41ee29
mov eax, dword [ebp - 0x2c]
push eax
push 0x4095a0
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x30]
call edi
mov eax, dword [0x42088c]
test eax, eax
jne 0x41ec07
push 0x42088c
push 0x406628
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov ebx, dword [0x42088c]
mov ecx, dword [ebx]
lea edx, [ebp - 0x48]
push edx
push ebx
call dword [ecx + 0x14]
fnclex
test eax, eax
jge 0x41ec2c
push 0x14
push 0x406618
push ebx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x48]
mov ebx, eax
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0x58]
fnclex
test eax, eax
jge 0x41ec50
push 0x58
push 0x406638
push ebx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
lea edx, [ebp - 0x3c]
push edx
call esi
push eax
push 1
push 0
mov eax, dword [ebp - 0x34]
push eax
lea ecx, [ebp - 0x38]
push ecx
call esi
push eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.004066e8
mov dword [ebp - 0xc0], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
mov esi, dword [ebp - 0xc0]
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
test esi, esi
je 0x41ee5a
mov ecx, 0x80020004
mov dword [ebp - 0x84], ecx
mov eax, 0xa
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x6c], eax
mov ebx, dword [sym.imp.MSVBVM60.DLL_rtcErrObj]
call ebx
push eax
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
mov eax, dword [esi]
lea ecx, [ebp - 0xc0]
push ecx
push esi
call dword [eax + 0x1c]
fnclex
test eax, eax
jge 0x41ed1f
push 0x1c
push 0x409288
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
call ebx
push eax
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x40]
push ecx
push esi
call dword [eax + 0x2c]
fnclex
test eax, eax
jge 0x41ed4d
push 0x2c
push 0x409288
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
push 0x40969c
mov edx, dword [ebp - 0xc0]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x34]
call edi
push eax
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
call esi
mov edx, eax
lea ecx, [ebp - 0x38]
call edi
push eax
push 0x4096dc
call esi
mov edx, eax
lea ecx, [ebp - 0x3c]
call edi
push eax
push 0x4096d0
call esi
mov edx, eax
lea ecx, [ebp - 0x44]
call edi
push eax
mov eax, dword [ebp - 0x40]
push eax
call esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcMsgBox]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x34]
push eax
push 5
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x48]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x5c]
push eax
push 4
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0x38
mov eax, dword [ebp - 0x20]
push eax
call fcn.00406774
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x41f009
jmp 0x41eff3
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x34]
push edx
call esi
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.00406730
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov eax, dword [ebp - 0x20]
push eax
call fcn.00406774
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x41f009
jmp 0x41eff3
lea ecx, [ebp - 0x24]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
call esi
lea ecx, [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x30]
call esi
ret