Function at 0x4e2630
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4054a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x404198
mov eax, dword [0x5013c8]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x5c], ecx
jne 0x4e268f
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaNew2]
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
jmp 0x4e2695
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x394]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
lea edx, [ebp - 0x38]
push eax
push edx
call ebx
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x4e26d2
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x34], 0
call dword [fcn.004012fc]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov edx, dword [ebp - 0x5c]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCmp]
push edx
push 0x41fe28
call esi
test eax, eax
jne 0x4e2790
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e271c
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e273c
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38c]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x4e2777
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41fe54
push 0x80000002
push ebx
call dword [edx + 0x24]
jmp 0x4e2bbe
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41f9d8
call esi
test eax, eax
jne 0x4e2828
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e27b8
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e27d8
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x38c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x4e2813
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41de34
push 0x80000002
jmp 0x4e2bba
mov edx, dword [ebp - 0x5c]
push edx
push 0x41fec4
call esi
test eax, eax
jne 0x4e28c4
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e2850
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e2870
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38c]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x4e28ab
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41de34
push 0x80000001
push ebx
call dword [edx + 0x24]
jmp 0x4e2bbe
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41fee0
call esi
test eax, eax
jne 0x4e2957
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e28ec
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e290c
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x38c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x4e2947
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41ff10
jmp 0x4e2bb5
mov edx, dword [ebp - 0x5c]
push edx
push 0x41f7b4
call esi
test eax, eax
jne 0x4e29f3
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e297f
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e299f
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38c]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x4e29da
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41fd2c
push 0x80000002
push ebx
call dword [edx + 0x24]
jmp 0x4e2bbe
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41fd94
call esi
test eax, eax
jne 0x4e2a8b
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e2a1b
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e2a3b
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x38c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x4e2a76
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41fdbc
push 0x80000002
jmp 0x4e2bba
mov edx, dword [ebp - 0x5c]
push edx
push 0x41ff94
call esi
test eax, eax
jne 0x4e2b27
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e2ab3
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e2ad3
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38c]
lea edx, [ebp - 0x38]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea ecx, [ebp - 0x34]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0xf8]
test eax, eax
fnclex
jge 0x4e2b0e
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebx]
push eax
push 0x41fd2c
push 0x80000001
push ebx
call dword [edx + 0x24]
jmp 0x4e2bbe
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x41ffb8
call esi
test eax, eax
jne 0x4e2bd5
mov eax, dword [0x5014e0]
test eax, eax
jne 0x4e2b4f
push 0x5014e0
push 0x407aa4
call edi
mov eax, dword [0x5013c8]
mov ebx, dword [0x5014e0]
test eax, eax
jne 0x4e2b6f
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x38c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xf8]
test eax, eax
fnclex
jge 0x4e2baa
push 0xf8
push 0x418cbc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebx]
push ecx
push 0x41ffdc
push 0x80000001
push ebx
call dword [eax + 0x24]
test eax, eax
fnclex
jge 0x4e2c5e
push 0x24
push 0x41cfe0
push ebx
jmp 0x4e2c57
mov eax, dword [0x5013c8]
test eax, eax
jne 0x4e2bef
push 0x5013c8
push 0x40e760
call edi
mov eax, dword [0x5013c8]
mov edx, dword [eax]
push eax
call dword [edx + 0x384]
push eax
lea eax, [ebp - 0x38]
push eax
call ebx
mov esi, eax
lea edx, [ebp - 0x34]
push edx
push esi
mov ecx, dword [esi]
call dword [ecx + 0xa0]
test eax, eax
fnclex
jge 0x4e2c26
push 0xa0
push 0x417984
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4e2c3b
lea eax, [ebp - 0x2c]
push eax
push 0x418cfc
call edi
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov ecx, dword [eax]
push 0xffffffffffffffff
push edx
push eax
mov esi, eax
call dword [ecx + 0x5c]
test eax, eax
fnclex
jge 0x4e2c5e
push 0x5c
push 0x418ae4
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
push 0x418cec
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaCastObj]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
lea ecx, [ebp - 0x48]
push ecx
call fcn.004de830
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x4e2cdf
jmp 0x4e2ccc
lea ecx, [ebp - 0x5c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
ret