Function at 0x42bf60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x401f86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x4018c8
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x94], eax
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
call esi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x60]
call esi
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov eax, dword [ebp - 0x20]
push eax
push 1
push 0xffffffffffffffff
push 0x20
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
call esi
mov ecx, dword [ebp - 0x20]
push ecx
push 0x41b854
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov edi, 2
push edi
push 0xffffffffffffffff
push 0x220
call esi
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov ebx, dword [ebp + 0xc]
xor dx, dx
mov dl, bl
sub dx, 1
jo 0x42c2ce
mov word [ebp - 0x8c], dx
mov dword [ebp - 0x94], edi
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0x70]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
call esi
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
and ebx, 0xff
add eax, ebx
jo 0x42c2ce
mov dword [ebp - 0x8c], eax
mov ebx, 3
mov dword [ebp - 0x94], ebx
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0x54]
call esi
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x94], edi
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaVarAdd]
mov edx, eax
lea ecx, [ebp - 0x44]
call esi
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcFileLen]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], ebx
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x84]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarSub]
mov edx, eax
lea ecx, [ebp - 0x34]
call esi
push 0
lea edx, [ebp - 0x70]
push edx
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaI4Var]
call esi
push eax
push 1
push 0x11
lea eax, [ebp - 0x58]
push eax
push 1
push 0x80
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaRedim]
call ebx
add esp, 0x1c
push 0
lea ecx, [ebp - 0x34]
push ecx
call esi
push eax
push 1
push 0x11
lea edx, [ebp - 0x5c]
push edx
push 1
push 0x80
call ebx
add esp, 0x1c
push 1
push 1
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFileSeek]
call ebx
push 1
lea eax, [ebp - 0x58]
push eax
push 0x41b7ec
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaGetOwner3]
call edi
push 1
lea ecx, [ebp - 0x44]
push ecx
call esi
push eax
call ebx
push 1
lea edx, [ebp - 0x5c]
push edx
push 0x41b7ec
call edi
push 2
lea eax, [ebp - 0x58]
push eax
push 0x41b7ec
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaPutOwner3]
call esi
push 2
lea ecx, [ebp - 0x60]
push ecx
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaPut3]
push 2
lea edx, [ebp - 0x5c]
push edx
push 0x41b7ec
call esi
push 2
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
call esi
push 1
call esi
mov eax, dword [ebp + 0x14]
cmp word [eax], 0xffff
jne 0x42c1da
mov ecx, dword [ebp - 0x20]
push ecx
push 0x41b864
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
call esi
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcFileCopy]
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
jmp 0x42c1e0
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov eax, dword [ebp - 0x20]
push eax
push eax
push 0x41b854
call esi
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcFileCopy]
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov eax, dword [ebp - 0x20]
push eax
push 0x41b854
call esi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], 8
lea ecx, [ebp - 0x84]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcKillFiles]
lea ecx, [ebp - 0x84]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 0x24], 0xffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x42c2b7
jmp 0x42c276
lea ecx, [ebp - 0x20]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
call edi
lea ecx, [ebp - 0x34]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
call esi
lea ecx, [ebp - 0x44]
call esi
lea ecx, [ebp - 0x54]
call esi
lea edx, [ebp - 0x58]
push edx
push 0
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
call ebx
lea eax, [ebp - 0x5c]
push eax
push 0
call ebx
lea ecx, [ebp - 0x60]
call edi
lea ecx, [ebp - 0x70]
call esi
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop