Function at 0x5b6db0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x406366
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x405028
push 0x11
lea eax, [ebp - 0x34]
xor edi, edi
push 0x4382b4
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
call dword [sym.imp.msvbvm60.dll___vbaAryConstruct2]
mov esi, dword [sym.imp.msvbvm60.dll___vbaUI1I2]
mov ecx, 0x38
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx], al
mov ecx, 0x35
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x33
mov byte [edx + 1], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 2], al
mov ecx, 0x39
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3c
mov byte [edx + 3], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 4], al
mov ecx, 0x49
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x38
mov byte [edx + 5], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 6], al
mov ecx, 0x44
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x47
mov byte [edx + 7], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 8], al
mov ecx, 0x47
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x45
mov byte [edx + 9], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0xa], al
mov ecx, 0x38
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x48
mov byte [edx + 0xb], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0xc], al
mov ecx, 0x3a
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x37
mov byte [edx + 0xd], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0xe], al
mov ecx, 0x33
call esi
mov edx, dword [ebp - 0x28]
mov byte [edx + 0xf], al
mov ecx, 0x3c
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x10], al
mov ecx, 0x47
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x33
mov byte [edx + 0x11], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x12], al
mov ecx, 0x3b
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x46
mov byte [edx + 0x13], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x14], al
mov ecx, 0x35
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3a
mov byte [edx + 0x15], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x16], al
mov ecx, 0x36
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x35
mov byte [edx + 0x17], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x18], al
mov ecx, 0x37
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x48
mov byte [edx + 0x19], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x1a], al
mov ecx, 0x49
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x35
mov byte [edx + 0x1b], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x1c], al
mov ecx, 0x47
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x35
mov byte [edx + 0x1d], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x1e], al
mov ecx, 0x48
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x45
mov byte [edx + 0x1f], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x20], al
mov ecx, 0x38
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x35
mov byte [edx + 0x21], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x22], al
mov ecx, 0x47
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3a
mov byte [edx + 0x23], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x24], al
mov ecx, 0x49
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x45
mov byte [edx + 0x25], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x26], al
mov ecx, 0x45
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x37
mov byte [edx + 0x27], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x28], al
mov ecx, 0x47
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x35
mov byte [edx + 0x29], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x2a], al
mov ecx, 0x3a
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x38
mov byte [edx + 0x2b], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x2c], al
mov ecx, 0x45
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3c
mov byte [edx + 0x2d], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x2e], al
mov ecx, 0x3c
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x36
mov byte [edx + 0x2f], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x30], al
mov ecx, 0x48
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3b
mov byte [edx + 0x31], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x32], al
mov ecx, 0x33
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x36
mov byte [edx + 0x33], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x34], al
mov ecx, 0x46
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x46
mov byte [edx + 0x35], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x36], al
mov ecx, 0x39
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x45
mov byte [edx + 0x37], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x38], al
mov ecx, 0x48
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x39
mov byte [edx + 0x39], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x3a], al
mov ecx, 0x44
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3c
mov byte [edx + 0x3b], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x3c], al
mov ecx, 0x45
call esi
mov edx, dword [ebp - 0x28]
mov ecx, 0x3c
mov byte [edx + 0x3d], al
call esi
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x3e], al
mov ecx, 0x34
call esi
mov edx, dword [ebp - 0x28]
xor ebx, ebx
mov byte [edx + 0x3f], al
mov eax, 0xff
cmp bx, ax
jg 0x5b71d8
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.005b6060
cmp ax, di
mov dword [ebp - 0x3c], eax
jne 0x5b71df
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push ecx
push edx
push edi
call fcn.005b6840
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x48]
mov dword [ebp - 0x44], eax
push ecx
lea eax, [ebp - 0x44]
push edx
push eax
mov dword [ebp - 0x48], 0xfffffffd
call fcn.004d5ae0
mov edx, eax
lea ecx, [ebp - 0x40]
call dword [sym.imp.msvbvm60.dll___vbaStrMove]
push eax
call dword [sym.imp.msvbvm60.dll___vbaStrCmp]
mov esi, eax
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
neg esi
cmp word [ebp - 0x3c], di
sete cl
neg ecx
and esi, ecx
lea ecx, [ebp - 0x40]
call dword [sym.imp.msvbvm60.dll___vbaFreeStr]
cmp si, di
jne 0x5b71df
mov eax, 1
add ax, bx
jo 0x5b7228
mov ebx, eax
jmp 0x5b7142
mov dword [ebp - 0x3c], 0xffffffa4
push 0x5b7213
jmp 0x5b71f0
mov esi, dword [sym.imp.msvbvm60.dll___vbaFreeStr]
lea ecx, [ebp - 0x14]
call esi
lea ecx, [ebp - 0x1c]
call esi
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x34]
push eax
push 0
mov dword [ebp - 0x44], edx
call dword [sym.imp.msvbvm60.dll___vbaAryDestruct]
ret
call dword [sym.imp.msvbvm60.dll___vbaErrorOverflow]
nop
nop