Function at 0x438930
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4022d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x402268
xor esi, esi
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x5c], 0x40a4f8
mov dword [ebp - 0x64], 8
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
mov ecx, dword [0x43c064]
push esi
lea eax, [ebp - 0x44]
push 0xffffffffffffffff
push eax
lea edx, [ebp - 0x54]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcSplit]
lea eax, [ebp - 0x54]
push eax
push 0x2008
call dword [sym.imp.MSVBVM60.DLL___vbaAryVar]
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], eax
push ecx
push 0x43c0cc
call dword [sym.imp.MSVBVM60.DLL___vbaAryCopy]
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x44]
push edx
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov ecx, dword [0x43c0cc]
add esp, 0xc
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov dword [ebp - 0x94], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x94]
jg 0x438b36
xor edi, edi
mov eax, 0x176
cmp di, ax
jg 0x438b26
mov edx, dword [0x43c0cc]
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x44], 2
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov ecx, dword [ebp - 0x30]
cmp ecx, esi
je 0x438a55
cmp word [ecx], 1
jne 0x438a55
mov edx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
mov esi, ebx
sub esi, edx
cmp esi, eax
jb 0x438a4c
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [ebp - 0x30]
lea eax, [esi*4]
jmp 0x438a5e
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp - 0x44]
add ecx, eax
mov ax, di
add ax, 3
mov dword [ebp - 0x5c], ecx
jo 0x438ba4
movsx ecx, ax
push edx
lea edx, [ebp - 0x64]
push ecx
lea eax, [ebp - 0x54]
push edx
push eax
mov dword [ebp - 0x64], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcMidCharVar]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
cmp ebx, 0x4e21
jb 0x438aa8
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
movsx esi, di
cmp esi, 0x177
jb 0x438ab9
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x34]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarVal]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcR8ValFromBstr]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI2]
lea ecx, [esi + esi*4]
mov edx, ebx
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 5
add edx, ecx
mov ecx, dword [0x43c124]
add esi, edx
mov word [ecx + esi*2], ax
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x44]
push edx
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov eax, 1
add esp, 0xc
add ax, di
jo 0x438ba4
mov edi, eax
xor esi, esi
jmp 0x4389fb
mov eax, 1
add eax, ebx
jo 0x438ba4
mov ebx, eax
jmp 0x4389ed
wait
push 0x438b75
jmp 0x438b74
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop