Function at 0x469fa0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2b27
mov eax, dword fs:[0]
push eax
sub esp, 0x8d4
mov eax, dword [0x510a84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x14]
test ecx, ecx
jne 0x46a119
mov ecx, dword [ebp - 0x14]
add ecx, 8
call dword [0x4dc3a0]
push eax
call fcn.004a7d80
add esp, 4
movzx eax, al
test eax, eax
je 0x46a075
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.004a61c0
add esp, 8
lea eax, [ebp - 0x430]
push eax
push 0
push 0x4e5cb8
lea ecx, [ebp - 0x224]
push ecx
call fcn.004a61e0
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call dword [0x4dc314]
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call dword [0x4dc3a0]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call dword [0x4dc3a0]
push eax
call fcn.004a9a80
add esp, 8
movzx eax, al
test eax, eax
jne 0x46a075
jmp 0x46a5dd
mov ecx, dword [ebp - 0x14]
add ecx, 8
call dword [0x4dc3a0]
push eax
call fcn.004a6520
add esp, 4
mov ecx, dword [ebp - 0x14]
add ecx, 8
call dword [0x4dc3a0]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call dword [0x4dc3a0]
push eax
call fcn.004a9a80
add esp, 8
movzx eax, al
test eax, eax
jne 0x46a0b8
jmp 0x46a5dd
lea ecx, [ebp - 0x440]
call fcn.004ae9e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call dword [0x4dc3a0]
push eax
call fcn.004a7a10
add esp, 8
lea eax, [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call dword [0x4dc3a0]
push eax
call fcn.004a7aa0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.004ae9f0
jmp 0x46a5ce
lea ecx, [ebp - 0x654]
call fcn.004a4800
mov dword [ebp - 4], 1
lea eax, [ebp - 0x654]
push eax
call fcn.004a78c0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x46a1c7
call fcn.004a3b40
test eax, eax
je 0x46a1b0
call fcn.004a3b40
mov ecx, eax
call fcn.004019a0
movzx eax, al
test eax, eax
je 0x46a1b0
mov eax, dword [0x50e330]
add eax, 0x37
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8d8], esp
push str.e:extensionmanager_2.0_win20080731.r.274_trelo_sourceextensionsmacrextensioninstallstep.cpp
call dword [0x4dc4a0]
mov dword [ebp - 0x8dc], eax
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp - 0x8e0], ecx
mov byte [ebp - 4], 2
push str.Cannot_get_the_curretn_user_application_data_path
push str.ERROR
call fcn.004a3b40
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.004a4600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.004a4820
jmp 0x46a5dd
lea eax, [ebp - 0x64c]
push eax
push 0
push 0x4e5c7c
lea ecx, [ebp - 0x650]
call dword [0x4dc3a0]
push eax
call fcn.004a61e0
add esp, 0x10
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x65c]
call fcn.004119f0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x65c]
test eax, eax
je 0x46a218
lea ecx, [ebp - 0x658]
mov dword [ebp - 0x8dc], ecx
jmp 0x46a222
mov dword [ebp - 0x8dc], 0
mov edx, dword [ebp - 0x8dc]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call dword [0x4dc3b8]
lea ecx, [ebp - 0x658]
call dword [0x4dc3a0]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call dword [0x4dc3a0]
push eax
call fcn.004a9a80
add esp, 8
lea ecx, [ebp - 0x66c]
call fcn.004ae9e0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x66c]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call dword [0x4dc3a0]
push eax
call fcn.004a7a10
add esp, 8
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x658]
call dword [0x4dc3a0]
push eax
call fcn.004a7aa0
add esp, 8
lea eax, [ebp - 0x878]
push eax
call fcn.004a5e70
add esp, 4
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x880]
call fcn.004119f0
mov byte [ebp - 4], 5
push str.replace.exe
lea ecx, [ebp - 0x880]
call fcn.004a4aa0
push 0x104
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x87c]
call dword [0x4dc3a0]
push eax
call dword [0x4dc1b8]
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x884]
call dword [0x4dc310]
mov byte [ebp - 4], 6
push 0x4df8fc
lea ecx, [ebp - 0x884]
call dword [0x4dc2f0]
push 0x4dd1bc
lea ecx, [ebp - 0x884]
call dword [0x4dc2f0]
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
lea ecx, [ebp - 0x884]
call dword [0x4dc2f4]
push 0x4e5c5c
lea ecx, [ebp - 0x884]
call dword [0x4dc2f0]
lea eax, [ebp - 0x65c]
test eax, eax
je 0x46a367
lea ecx, [ebp - 0x658]
mov dword [ebp - 0x8dc], ecx
jmp 0x46a371
mov dword [ebp - 0x8dc], 0
mov edx, dword [ebp - 0x8dc]
push edx
lea ecx, [ebp - 0x884]
call dword [0x4dc2f4]
push 0x4dd1bc
lea ecx, [ebp - 0x884]
call dword [0x4dc2f0]
lea eax, [ebp - 0x888]
push eax
push 0x20006
push 0
push str.softwaremicrosoftwindowscurrentversion_runonce
push 0x80000001
call dword [0x4dc04c]
mov dword [ebp - 0x88c], eax
lea eax, [ebp - 0x888]
push eax
push str.softwaremicrosoftwindowscurrentversion_runonce
lea ecx, [ebp - 0x88c]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00469f60
cmp dword [ebp - 0x88c], 0
je 0x46a4a0
call fcn.004a3b40
test eax, eax
je 0x46a44c
call fcn.004a3b40
mov ecx, eax
call fcn.004019a0
movzx eax, al
test eax, eax
je 0x46a44c
mov eax, dword [0x50e330]
add eax, 0x63
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8d4], esp
push str.e:extensionmanager_2.0_win20080731.r.274_trelo_sourceextensionsmacrextensioninstallstep.cpp
call dword [0x4dc4a0]
mov dword [ebp - 0x8dc], eax
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp - 0x8e0], ecx
mov byte [ebp - 4], 7
push str.Open_registry_softwaremicrosoftwindowscurrentversion_runonce_failed
push str.ERROR
call fcn.004a3b40
mov byte [ebp - 4], 6
mov ecx, eax
call fcn.004a4600
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x884]
call dword [0x4dc30c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x880]
call fcn.004a4820
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.004ae9f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x65c]
call fcn.004a4820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.004a4820
jmp 0x46a5dd
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x65c]
call fcn.004a49b0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x884]
call dword [0x4dc39c]
lea eax, [eax + eax + 1]
push eax
lea ecx, [ebp - 0x884]
call dword [0x4dc3a0]
push eax
push 1
push 0
lea ecx, [ebp - 0x890]
call dword [0x4dc3a0]
push eax
mov ecx, dword [ebp - 0x888]
push ecx
call dword [0x4dc018]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x888]
push eax
call dword [0x4dc044]
cmp dword [ebp - 0x88c], 0
je 0x46a56f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x890]
call dword [0x4dc30c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x884]
call dword [0x4dc30c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x880]
call fcn.004a4820
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.004ae9f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x65c]
call fcn.004a4820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.004a4820
jmp 0x46a5dd
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x890]
call dword [0x4dc30c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x884]
call dword [0x4dc30c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x880]
call fcn.004a4820
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x66c]
call fcn.004ae9f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x65c]
call fcn.004a4820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.004a4820
mov dword [ebp - 0x18], 0
xor eax, eax
jne 0x469fd8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9dd8
mov esp, ebp
pop ebp
ret