Function at 0x41406b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403ab6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4014c0
xor edi, edi
push 3
push 0x40a3ec
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xe0], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x118], edi
call sub.MSVBVM60.DLL___vbaAryConstruct2
push 8
push 0x40a408
lea eax, [ebp - 0x58]
push eax
call sub.MSVBVM60.DLL___vbaAryConstruct2
mov dword [ebp - 0x6c], edi
call fcn.00420e1a
test ax, ax
jne 0x41459a
mov ecx, dword [ebp - 0x4c]
mov edx, 0x40a11c
call sub.MSVBVM60.DLL___vbaStrCopy
mov eax, dword [ebp - 0x4c]
mov edx, 0x40a150
lea ecx, [eax + 4]
call sub.MSVBVM60.DLL___vbaStrCopy
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x70]
push eax
call sub.MSVBVM60.DLL___vbaStrToAnsi
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
push dword [ebp - 0x70]
mov dword [ebp - 0x114], eax
push dword [ebp - 0x4c]
call sub.MSVBVM60.DLL___vbaStrToUnicode
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x114]
mov dword [ecx], eax
lea ecx, [ebp - 0x70]
call sub.MSVBVM60.DLL___vbaFreeStr
mov eax, dword [ebp - 0x4c]
push dword [eax + 4]
lea eax, [ebp - 0x70]
push eax
call sub.MSVBVM60.DLL___vbaStrToAnsi
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
push dword [ebp - 0x70]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x4c]
add eax, 4
push eax
call sub.MSVBVM60.DLL___vbaStrToUnicode
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x24]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x70]
call sub.MSVBVM60.DLL___vbaFreeStr
mov eax, dword [ebp - 0x24]
cmp dword [eax], edi
jne 0x4141c0
cmp dword [eax + 4], edi
je 0x41459a
push 0x40a188
push 0x40a1d8
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
mov eax, dword [ebp - 0x24]
cmp dword [eax], edi
je 0x414236
push dword [ebp - 0x18]
push 0x40a1e8
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x70]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
mov eax, dword [ebp - 0x4c]
push dword [eax]
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x74]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
mov esi, 0x40a1f4
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
jmp 0x41423b
mov esi, 0x40a1f4
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], edi
je 0x414293
push dword [ebp - 0x18]
push 0x40a1e8
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x70]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
mov eax, dword [ebp - 0x4c]
push dword [eax + 4]
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x74]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
push dword [ebp - 0x18]
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x70]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40a200
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x74]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40a268
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x78]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x7c]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x80]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40a2d4
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x84]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40a334
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 6
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0x1c
push 0xa
pop esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xa0]
push eax
mov edi, 0x80020004
push 0x31
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xe0], 0x4008
call sub.MSVBVM60.DLL_rtcMsgBox
mov ebx, eax
dec ebx
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
neg ebx
sbb ebx, ebx
lea eax, [ebp - 0xa0]
push eax
inc ebx
push 3
neg ebx
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x10
test bx, bx
je 0x41459a
push 0xffffffffffffffff
push 0
call fcn.004217fa
mov edx, eax
lea ecx, [ebp - 0x90]
call sub.MSVBVM60.DLL___vbaStrMove
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0x98], edi
mov dword [ebp - 0xa0], esi
call sub.MSVBVM60.DLL_rtcCurrentDir
mov eax, dword [ebp - 0x90]
and dword [ebp - 0x90], 0
mov dword [ebp - 0x12c], eax
push esi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x88]
push eax
call sub.MSVBVM60.DLL___vbaStrVarVal
push eax
lea eax, [ebp - 0x8c]
push eax
call sub.MSVBVM60.DLL___vbaStrToAnsi
mov edx, dword [ebp - 0x12c]
push eax
mov ebx, 0x40a39c
push ebx
lea ecx, [ebp - 0x70]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x74]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push ebx
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x80]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
lea eax, [ebp - 0x84]
push eax
call sub.MSVBVM60.DLL___vbaStrToAnsi
push eax
push 0x40a380
lea eax, [ebp - 0x7c]
push eax
call sub.MSVBVM60.DLL___vbaStrToAnsi
push eax
push 0x40a370
lea eax, [ebp - 0x78]
push eax
call sub.MSVBVM60.DLL___vbaStrToAnsi
push eax
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov ebx, eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 9
call sub.MSVBVM60.DLL___vbaFreeStrList
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xa0]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x34
cmp ebx, 0x20
jg 0x414596
lea edx, [ebp - 0xe0]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xd8], 0x40a3a4
mov dword [ebp - 0xe0], 8
call sub.MSVBVM60.DLL___vbaVarDup
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0x10
lea eax, [ebp - 0xa0]
push eax
call sub.MSVBVM60.DLL_rtcMsgBox
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xa0]
push eax
push 4
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x14
or dword [ebp - 0x6c], 0xffffffff
push 0x414636
jmp 0x4145ff
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaFreeStr
lea eax, [ebp - 0x30]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x114]
push eax
push 0
call sub.MSVBVM60.DLL___vbaAryDestruct
lea eax, [ebp - 0x58]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
push 0
call sub.MSVBVM60.DLL___vbaAryDestruct
ret