Function at 0x411f00
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x214
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401c40
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov eax, dword [ebp + 8]
push eax
call fcn.00415830
mov edx, eax
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x40]
push ecx
call fcn.004115d0
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
test eax, eax
jne 0x411fa6
jmp loc.0044902c
mov dword [ebp - 4], 7
push 0
push 0xffffffffffffffff
push 1
push 0x408114
push 0x40924c
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 8
push 0
push 0xffffffffffffffff
push 1
push 0x408114
push 0x409254
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 9
push 1
mov edx, dword [ebp - 0x30]
push edx
push 0x409260
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xa
push 1
mov eax, dword [ebp - 0x30]
push eax
push 0x40926c
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x24], 0
jg 0x41204f
cmp dword [ebp - 0x28], 0
jle 0x4120e6
mov dword [ebp - 4], 0xc
push 0
push 0xffffffffffffffff
push 1
push 0x409278
push 0x409260
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 0xd
push 0
push 0xffffffffffffffff
push 1
push 0x409280
push 0x40926c
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 4], 0xe
push 1
mov eax, dword [ebp - 0x30]
push eax
push 0x409260
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xf
push 1
mov ecx, dword [ebp - 0x30]
push ecx
push 0x40926c
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x28], eax
jmp 0x412038
mov dword [ebp - 4], 0x11
push 1
mov edx, dword [ebp - 0x30]
push edx
push 0x409288
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x24], 0
jne 0x412115
jmp fcn.00415621
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x24]
add eax, 1
jo 0x4156c6
push eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0x409280
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0x16
mov edx, dword [ebp - 0x24]
add edx, 1
jo 0x4156c6
push edx
mov eax, dword [ebp - 0x30]
push eax
push 0x4092a0
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x28], 0
jne 0x412177
jmp loc.00446d9a
jmp loc.00441cb7
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
int3