Function at 0x410160
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4015f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xec
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401238
mov eax, dword [ebp + 0x10]
push 3
lea ecx, [ebp - 0xa8]
xor esi, esi
push eax
push ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xf0], esi
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x50]
call edi
lea ecx, [ebp - 0xa8]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x402d20
lea ecx, [ebp - 0x6c]
call ebx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x6c]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa8], 8
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea edx, [ebp - 0x38]
lea eax, [ebp - 0xa8]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcUpperCaseVar]
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x8c]
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xd8], 0xb
call dword [sym.imp.MSVBVM60.DLL___vbaVargVarMove]
lea ecx, [ebp - 0x8c]
push 7
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcDir]
mov edx, eax
lea ecx, [ebp - 0x94]
call edi
push eax
push 0x4029cc
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
mov edi, eax
neg edi
sbb edi, edi
lea ecx, [ebp - 0x94]
neg edi
neg edi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
cmp di, si
je 0x41030c
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0xd8], 0xb
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xd0], 0x80000001
mov dword [ebp - 0xd8], 3
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
mov edx, 0x402da0
lea ecx, [ebp - 0x28]
call ebx
mov edx, 0x402e00
lea ecx, [ebp - 0x54]
call ebx
mov edx, dword [ebp - 0x28]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push 0x414024
push 1
push esi
lea eax, [ebp - 0x94]
push edx
push eax
call edi
lea ecx, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaI4Var]
push eax
call fcn.00402860
mov dword [ebp - 0xec], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x94]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
lea eax, [ebp - 0x28]
push edx
push eax
call ebx
mov eax, dword [ebp - 0xec]
xor ecx, ecx
cmp eax, esi
setne cl
neg ecx
mov dword [ebp - 0xf8], ecx
lea ecx, [ebp - 0x94]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
cmp word [ebp - 0xf8], si
jne 0x410556
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0x4c]
push edx
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0xec]
push eax
push ecx
push esi
lea eax, [ebp - 0x94]
push edx
push eax
mov dword [ebp - 0xf0], 4
mov dword [ebp - 0xec], 1
call edi
mov ecx, dword [0x414024]
push eax
push ecx
call fcn.004028ac
mov dword [ebp - 0xf4], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x54]
push edx
push eax
call ebx
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
cmp eax, esi
sete cl
neg ecx
mov dword [ebp - 0xf8], ecx
lea ecx, [ebp - 0x94]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
cmp word [ebp - 0xf8], si
jne 0x410556
push 0x80
mov dword [ebp - 0x90], 0x80
call dword [sym.imp.MSVBVM60.DLL_rtcSpaceBstr]
mov edx, eax
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x90]
push edx
lea ecx, [ebp - 0x98]
push eax
push ecx
mov dword [ebp - 0xec], 1
call edi
lea edx, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x54]
push edx
push esi
lea ecx, [ebp - 0x94]
push eax
push ecx
call edi
mov edx, dword [0x414024]
push eax
push edx
call fcn.004028ac
mov dword [ebp - 0xf0], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x54]
push eax
push ecx
call ebx
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 0x58]
push edx
push eax
call ebx
mov edi, dword [ebp - 0xf0]
xor ecx, ecx
cmp edi, esi
lea edx, [ebp - 0x98]
sete cl
lea eax, [ebp - 0x94]
push edx
neg ecx
push eax
push 2
mov edi, ecx
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
cmp di, si
je 0x410556
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x58]
sub ecx, 1
jo 0x4106ae
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharBstr]
mov edx, eax
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov eax, dword [ebp - 0x58]
push eax
push 0x4029cc
call dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
test eax, eax
je 0x410556
or edi, 0xffffffff
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xd8], 0xb
call dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
jmp 0x410559
or edi, 0xffffffff
mov ecx, dword [0x414024]
push ecx
call fcn.00402938
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaVarCmpEq]
mov eax, 0x800b
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe8], eax
lea edx, [ebp - 0x68]
lea eax, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0xa8]
push eax
push ecx
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xe0], edi
call esi
push eax
lea edx, [ebp - 0x48]
lea eax, [ebp - 0xe8]
push edx
lea ecx, [ebp - 0xb8]
push eax
push ecx
call esi
lea edx, [ebp - 0xc8]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarAnd]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaBoolVarNull]
test ax, ax
je 0x4105f0
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xd8], 0xb
call dword [sym.imp.MSVBVM60.DLL___vbaVargVarMove]
push 0x41067f
jmp 0x41063d
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x24]
call esi
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x28]
call edi
lea ecx, [ebp - 0x38]
call esi
lea ecx, [ebp - 0x48]
call esi
lea ecx, [ebp - 0x50]
call edi
lea ecx, [ebp - 0x54]
call edi
lea ecx, [ebp - 0x58]
call edi
lea ecx, [ebp - 0x68]
call esi
lea ecx, [ebp - 0x6c]
call edi
lea ecx, [ebp - 0x8c]
call esi
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop