Function at 0x40451a
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
and byte [ebp - 0x148], 0
push ebx
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
and byte [ebp - 0x248], 0
push 0x3f
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x247]
and byte [ebp - 0x48], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
and byte [ebp - 1], 0
cmp dword [ebp + 8], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x4047ff
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4047ff
cmp dword [ebp + 0x10], 0
je 0x4047ff
push ebx
call sub.MSVCRT.dll_strlen
cmp eax, 2
pop ecx
mov edi, 0x4081c4
mov esi, 0xfe
jbe 0x404628
cmp byte [ebx + 1], 0x3a
je 0x40463a
lea eax, [ebp - 0x148]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x40463a
lea eax, [ebp - 0x148]
or ebx, 0xffffffff
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jbe 0x4047ff
push 1
lea edx, [ebp - 0x148]
pop ecx
dec edx
cmp byte [edx + ecx], 0x5c
jne 0x4045ed
mov ebx, ecx
inc ecx
lea eax, [ecx - 1]
cmp eax, dword [ebp - 8]
jb 0x4045e5
cmp ebx, 0xffffffff
je 0x4047ff
push dword [ebp + 0xc]
and byte [ebp + ebx - 0x148], 0
lea eax, [ebp - 0x148]
push eax
push 0x40855c
lea eax, [ebp - 0x148]
push esi
push eax
call fcn.0040200e
add esp, 0x14
jmp 0x40463a
push ebx
push edi
lea eax, [ebp - 0x148]
push esi
push eax
call fcn.0040200e
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x4047ff
lea eax, [ebp - 0x148]
push eax
call fcn.00405d3f
test al, al
pop ecx
je 0x4047ff
push dword [ebp + 8]
lea eax, [ebp - 0x248]
push edi
push esi
push eax
call fcn.0040200e
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
or ecx, 0xffffffff
test eax, eax
mov dword [ebp - 8], eax
jbe 0x4047ff
push 1
lea eax, [ebp - 0x248]
pop edx
dec eax
cmp byte [eax + edx], 0x5c
jne 0x4046a4
mov ecx, edx
inc edx
lea ebx, [edx - 1]
cmp ebx, dword [ebp - 8]
jb 0x40469c
cmp ecx, 0xffffffff
je 0x4047ff
mov ebx, dword [ebp + 8]
and byte [ebp + ecx - 0x248], 0
add ecx, ebx
lea eax, [ebp - 0x48]
push ecx
push edi
push 0x3e
push eax
call fcn.0040200e
lea eax, [ebp - 0x48]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
xor ecx, ecx
test eax, eax
jbe 0x40470c
cmp byte [ebp + ecx - 0x48], 0x2e
je 0x4046f0
inc ecx
cmp ecx, eax
jb 0x4046e2
jmp 0x40470c
and byte [ebp + ecx - 0x48], 0
lea eax, [ebp - 0x48]
push eax
push str._s.dll
lea eax, [ebp - 0x48]
push 0x3e
push eax
call fcn.0040200e
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x248]
push eax
push 0x40855c
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.0040200e
lea eax, [ebp - 0x248]
push eax
call fcn.00405d3f
add esp, 0x18
test al, al
je 0x4047ff
mov edi, dword [ebp + 0x10]
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push edi
push str.Stopping__s......
call esi
push edi
call fcn.004024b6
add esp, 0xc
mov byte [ebp + 0xb], al
call fcn.00402770
cmp byte [ebp + 0xb], 0
je 0x4047d6
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x248]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x248]
push 0
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4047de
lea eax, [ebp - 0x248]
push eax
push ebx
call fcn.00402791
push edi
push str.Starting__s......
call esi
push edi
call fcn.004025f4
add esp, 0x14
mov bl, al
call fcn.00402770
test bl, bl
je 0x4047ec
push str.Replace_Module_Successfully_n
call esi
pop ecx
mov byte [ebp - 1], 1
jmp 0x4047ff
push edi
push str.Fail_To_Stop_Service__s_n
jmp 0x4047f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fail_To_Copy_New_Module__d_n
jmp 0x4047f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fail_To_Start_Service__d_n
call fcn.00401518
pop ecx
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret