Function at 0x4c63e0
Capabilities:
Copy file
Create process on windows
Persist via application shimming

Disassembly:
jmp 0x4c63e0
push 0xffffffffffffffff
push 0x785ce6
mov eax, dword fs:[0]
push eax
sub esp, 0x3ac
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x3a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x3c0]
mov dword fs:[0], eax
push 0x3c
mov edi, ecx
xor ebx, ebx
push str.CServiceModule::Replace___Trying_to_replace_running_process_n
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push ebx
lea eax, [esp + 0x110]
push eax
mov ecx, 0x868edc
mov dword [esp + 0x3d0], ebx
call fcn.0054c860
cmp dword [esp + 0x124], 0x10
mov dword [esp + 0x3c8], 0xffffffff
jb 0x4c648a
mov ecx, dword [esp + 0x110]
push ecx
call fcn.00564155
add esp, 4
push 0xf003f
push ebx
push ebx
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
je 0x4c64c5
push 1
add edi, 0x30
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp eax, ebx
je 0x4c64be
push eax
mov ebp, 1
call edi
push esi
call edi
cmp ebp, ebx
jne 0x4c652b
push 0x42
push str.CServiceModule::Replace___Not_installed_as_service__cant_replace_
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push 1
lea edx, [esp + 0x110]
push edx
mov ecx, 0x868edc
mov dword [esp + 0x3d0], 1
call fcn.0054c860
cmp dword [esp + 0x124], 0x10
jb 0x4c71f8
mov eax, dword [esp + 0x110]
push eax
jmp 0x4c71f0
push 0x2e
mov edi, 0xf
push str.CServiceModule::Replace___Service_is_installed
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push ebx
lea ecx, [esp + 0x110]
push ecx
mov ecx, 0x868edc
mov dword [esp + 0x3d0], 2
call fcn.0054c860
mov esi, 0x10
cmp dword [esp + 0x124], esi
jb 0x4c6594
mov edx, dword [esp + 0x110]
push edx
call fcn.00564155
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x15c], 7
mov dword [esp + 0x158], ebx
mov word [esp + 0x148], ax
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x7b6c3c
mov dword [esp + 0x3d4], 3
call fcn.00401816
add esp, 0xc
test al, al
jne 0x4c6655
push 0x38
push str.CServiceModule::Replace___Failed_getting_service_status_
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push 1
lea eax, [esp + 0x110]
push eax
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 4
call fcn.0054c860
cmp dword [esp + 0x124], esi
jb 0x4c663a
mov ecx, dword [esp + 0x110]
push ecx
call fcn.00564155
add esp, 4
cmp dword [esp + 0x15c], 8
jb 0x4c71f8
mov edx, dword [esp + 0x148]
push edx
jmp 0x4c71f0
push 0x7b6c8c
call fcn.00407ed2
add esp, 4
test al, al
jne 0x4c66c2
push str.CServiceModule::Replace___Failed_to_shutdown_service_
lea ecx, [esp + 0x24]
call fcn.004062df
push 1
lea eax, [esp + 0x24]
push eax
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 5
call fcn.0054c860
mov byte [esp + 0x3c8], 3
cmp dword [esp + 0x38], esi
jb 0x4c66a8
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00564155
add esp, 4
push 0x7b6cd8
call fcn.004017e4
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4c6704
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
lea ecx, [ecx]
push 0x7b6cf4
call fcn.00402248
add esp, 4
test al, al
je 0x4c66ec
push 0x64
call edi
sub esi, 1
jne 0x4c66d0
jmp 0x4c66f0
cmp esi, ebx
jne 0x4c6704
push 0x7b6d10
call fcn.004017e4
add esp, 4
push 0x3e8
call edi
cmp dword [esp + 0x1c], 4
je 0x4c6768
push 4
push 0x7b6d2c
call fcn.004070d6
add esp, 8
test al, al
jne 0x4c6768
push str.CServiceModule::Replace___Failed_setting_service_status_
lea ecx, [esp + 0x180]
call fcn.004062df
push 1
lea edx, [esp + 0x180]
mov byte [esp + 0x3cc], 6
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x17c]
call fcn.00402ed7
lea ecx, [esp + 0x144]
call fcn.00403a26
jmp 0x4c71f8
push 0x208
lea eax, [esp + 0x1b8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x18], 0xa
jmp 0x4c6790
dec dword [esp + 0x18]
push 0x7b6d7c
call fcn.004017e4
add esp, 4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x15c], 8
mov eax, dword [esp + 0x148]
jae 0x4c67c4
lea eax, [esp + 0x148]
push ebx
push eax
lea ecx, [esp + 0x1bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
mov byte [esp + 0x17], al
cmp al, bl
jne 0x4c6af0
xor edx, edx
lea eax, [esp + 0x1b4]
mov dword [esp + 0x124], 7
mov dword [esp + 0x120], ebx
mov word [esp + 0x110], dx
lea ecx, [eax + 2]
jmp 0x4c6810
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4c6810
sub eax, ecx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
push eax
lea ecx, [esp + 0x114]
call fcn.00405ef2
mov byte [esp + 0x3c8], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004083af
mov esi, eax
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x80]
push eax
mov byte [esp + 0x3d8], 8
call fcn.00407662
mov edi, eax
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x6c]
push edx
mov byte [esp + 0x3e0], 9
call fcn.00407662
add esp, 0x18
mov ebp, eax
push 0x34
push str.CServiceModule::Replace___Failed_copying_file_from:
lea ecx, [esp + 0x130]
mov byte [esp + 0x3d0], 0xa
mov dword [esp + 0x148], 0xf
mov dword [esp + 0x144], ebx
mov byte [esp + 0x134], bl
call fcn.00405920
push ebp
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0x3d4], 0xb
call fcn.00402fd1
push 0x7b6da8
push eax
lea edx, [esp + 0x50]
push edx
mov byte [esp + 0x3e0], 0xc
call fcn.00405939
push edi
push eax
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0x3ec], 0xd
call fcn.00402fd1
push 0x7b6d98
push eax
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x3f8], 0xe
call fcn.00405939
push esi
push eax
lea edx, [esp + 0x1d0]
push edx
mov byte [esp + 0x404], 0xf
call fcn.00402fd1
add esp, 0x3c
mov byte [esp + 0x3c8], 0x10
push 1
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x1b0], 0x10
jb 0x4c6972
mov eax, dword [esp + 0x19c]
push eax
call fcn.00564155
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x1b0], esi
mov dword [esp + 0x1ac], ebx
mov byte [esp + 0x19c], bl
cmp dword [esp + 0x178], edi
jb 0x4c69aa
mov ecx, dword [esp + 0x164]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x178], esi
mov dword [esp + 0x174], ebx
mov byte [esp + 0x164], bl
cmp dword [esp + 0xc4], edi
jb 0x4c69d8
mov edx, dword [esp + 0xb0]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x54], edi
jb 0x4c6a00
mov eax, dword [esp + 0x40]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0xa8], edi
jb 0x4c6a25
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0x140], edi
jb 0x4c6a53
mov edx, dword [esp + 0x12c]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x140], esi
mov dword [esp + 0x13c], ebx
mov byte [esp + 0x12c], bl
cmp dword [esp + 0x70], edi
jb 0x4c6a7b
mov eax, dword [esp + 0x5c]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x8c], edi
jb 0x4c6a9d
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0x38], edi
jb 0x4c6ac2
mov edx, dword [esp + 0x24]
push edx
call fcn.00564155
add esp, 4
cmp dword [esp + 0x124], 8
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x3c8], 3
jb 0x4c6af0
mov eax, dword [esp + 0x110]
push eax
call fcn.00564155
add esp, 4
cmp dword [esp + 0x18], ebx
je 0x4c6b02
cmp byte [esp + 0x17], bl
je 0x4c6790
jmp 0x4c6b0c
cmp byte [esp + 0x17], bl
je 0x4c70ed
lea ecx, [esp + 0x17c]
push ecx
call fcn.00405e25
mov edi, 7
xor edx, edx
mov dword [esp + 0x128], edi
mov dword [esp + 0x124], ebx
mov word [esp + 0x114], dx
xor eax, eax
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebx
mov word [esp + 0x1a0], ax
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x1a0]
push edx
lea eax, [esp + 0x150]
push eax
push 0x5c
mov byte [esp + 0x3dc], 0x13
call fcn.00408233
add esp, 0x14
test al, al
je 0x4c6e57
test byte [0x8691c4], 1
jne 0x4c6cf6
or dword [0x8691c4], 1
push 0x7b6f14
mov ecx, 0x869010
mov byte [esp + 0x3cc], 0x14
call fcn.00403706
push 0x7b6ef8
mov ecx, 0x86902c
mov byte [esp + 0x3cc], 0x15
call fcn.00403706
push 0x7b6ee0
mov ecx, 0x869048
mov byte [esp + 0x3cc], 0x16
call fcn.00403706
push 0x7b6ec4
mov ecx, 0x869064
mov byte [esp + 0x3cc], 0x17
call fcn.00403706
push 0x7b6eb0
mov ecx, 0x869080
mov byte [esp + 0x3cc], 0x18
call fcn.00403706
push 0x7b6e98
mov ecx, 0x86909c
mov byte [esp + 0x3cc], 0x19
call fcn.00403706
push 0x7b6e80
mov ecx, 0x8690b8
mov byte [esp + 0x3cc], 0x1a
call fcn.00403706
push 0x7b6e64
mov ecx, 0x8690d4
mov byte [esp + 0x3cc], 0x1b
call fcn.00403706
push 0x7b6e4c
mov ecx, 0x8690f0
mov byte [esp + 0x3cc], 0x1c
call fcn.00403706
push 0x7b6e30
mov ecx, 0x86910c
mov byte [esp + 0x3cc], 0x1d
call fcn.00403706
push 0x7b6e18
mov ecx, 0x869128
mov byte [esp + 0x3cc], 0x1e
call fcn.00403706
push str.ssl3.dll
mov ecx, 0x869144
mov byte [esp + 0x3cc], 0x1f
call fcn.00403706
push 0x7b6de8
lea ecx, [esp + 0x24]
mov byte [esp + 0x3cc], 0x20
call fcn.004062df
lea ecx, [esp + 0x20]
push ecx
push 0x869160
mov byte [esp + 0x3d0], 0x21
call fcn.00406bef
add esp, 8
lea ecx, [esp + 0x20]
call fcn.00402ed7
push 0x7a5b40
call fcn.00566b2a
add esp, 4
mov byte [esp + 0x3c8], 0x13
mov esi, 0x869010
mov dword [esp + 0x18], 0xd
mov ebp, 8
jmp 0x4c6d10
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x184]
xor edx, edx
push eax
lea ecx, [esp + 0x134]
mov dword [esp + 0x14c], edi
mov dword [esp + 0x148], ebx
mov word [esp + 0x138], dx
call fcn.00406f1e
push 0x5c
push 1
lea ecx, [esp + 0x130]
mov byte [esp + 0x3d0], 0x22
call fcn.00402abd
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x134]
call fcn.004019a1
push 0xffffffffffffffff
xor ecx, ecx
push ebx
lea edx, [esp + 0x1a0]
mov word [esp + 0x16c], cx
push edx
lea ecx, [esp + 0x16c]
mov dword [esp + 0x184], edi
mov dword [esp + 0x180], ebx
call fcn.00406f1e
push 0x5c
push 1
lea ecx, [esp + 0x168]
mov byte [esp + 0x3d0], 0x23
call fcn.00402abd
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x16c]
call fcn.004019a1
mov ecx, dword [esp + 0x164]
cmp dword [esp + 0x178], ebp
jae 0x4c6dd5
lea ecx, [esp + 0x164]
mov eax, dword [esp + 0x12c]
cmp dword [esp + 0x140], ebp
jae 0x4c6dec
lea eax, [esp + 0x12c]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [esp + 0x178], ebp
jb 0x4c6e0e
mov eax, dword [esp + 0x164]
push eax
call fcn.00564155
add esp, 4
xor ecx, ecx
mov dword [esp + 0x178], edi
mov dword [esp + 0x174], ebx
mov word [esp + 0x164], cx
mov byte [esp + 0x3c8], 0x13
cmp dword [esp + 0x140], ebp
jb 0x4c6e47
mov edx, dword [esp + 0x12c]
push edx
call fcn.00564155
add esp, 4
add esi, 0x1c
sub dword [esp + 0x18], 1
jne 0x4c6d10
jmp 0x4c6e5c
mov ebp, 8
push 0x44
lea eax, [esp + 0xcc]
push ebx
push eax
call fcn.00566330
mov eax, dword [esp + 0x154]
add esp, 0xc
mov dword [esp + 0xc8], 0x44
cmp dword [esp + 0x15c], ebp
jae 0x4c6e91
lea eax, [esp + 0x148]
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0xcc]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._Update__Service
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
cmp al, bl
jne 0x4c7044
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x12c]
push eax
call fcn.004083af
mov esi, eax
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0x3d8], 0x24
call fcn.00407662
add esp, 0x10
mov edi, eax
push str.CServiceModule::Replace___Failed_to_run:
lea ecx, [esp + 0x94]
mov byte [esp + 0x3cc], 0x25
call fcn.004062df
push edi
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x3d4], 0x26
call fcn.00402fd1
push 0x7b6f50
push eax
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x3e0], 0x27
call fcn.00405939
push esi
push eax
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x3ec], 0x28
call fcn.00402fd1
add esp, 0x24
push ebx
push eax
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 0x29
call fcn.0054c860
mov edi, 0x10
cmp dword [esp + 0x38], edi
jb 0x4c6f80
mov eax, dword [esp + 0x24]
push eax
call fcn.00564155
add esp, 4
mov esi, 0xf
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp dword [esp + 0x8c], edi
jb 0x4c6fa7
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0x70], edi
jb 0x4c6fcc
mov edx, dword [esp + 0x5c]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
cmp dword [esp + 0xa8], edi
jb 0x4c6ff1
mov eax, dword [esp + 0x94]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0x54], edi
jb 0x4c7019
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x140], edi
jb 0x4c703e
mov edx, dword [esp + 0x12c]
push edx
call fcn.00564155
add esp, 4
mov byte [esp + 0x17], bl
jmp 0x4c7049
mov edi, 0x10
mov eax, dword [esp + 0xb0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xac]
push ecx
call esi
cmp dword [esp + 0x1b0], ebp
jb 0x4c707c
mov edx, dword [esp + 0x19c]
push edx
call fcn.00564155
add esp, 4
xor eax, eax
mov esi, 7
mov dword [esp + 0x1b0], esi
mov dword [esp + 0x1ac], ebx
mov word [esp + 0x19c], ax
cmp dword [esp + 0x124], ebp
jb 0x4c70b2
mov ecx, dword [esp + 0x110]
push ecx
call fcn.00564155
add esp, 4
xor edx, edx
mov dword [esp + 0x124], esi
mov dword [esp + 0x120], ebx
mov word [esp + 0x110], dx
mov byte [esp + 0x3c8], 3
cmp dword [esp + 0x194], ebp
jb 0x4c70f5
mov eax, dword [esp + 0x180]
push eax
call fcn.00564155
add esp, 4
jmp 0x4c70f5
mov edi, 0x10
lea ebp, [edi - 8]
mov eax, dword [esp + 0x1c]
cmp eax, 4
je 0x4c7138
push eax
push 0x7b6f8c
call fcn.004070d6
add esp, 8
test al, al
jne 0x4c7138
push str.CServiceModule::Replace___Failed_setting_service_status__2__
lea ecx, [esp + 0x180]
call fcn.004062df
push 1
lea ecx, [esp + 0x180]
mov byte [esp + 0x3cc], 0x2a
push ecx
jmp 0x4c6741
lea ecx, [esp + 0x17c]
cmp byte [esp + 0x17], bl
je 0x4c71a0
push str.CServiceModule::Replace___Success
call fcn.004062df
push ebx
lea edx, [esp + 0x180]
push edx
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 0x2b
call fcn.0054c860
cmp dword [esp + 0x194], edi
jb 0x4c7183
mov eax, dword [esp + 0x180]
push eax
call fcn.00564155
add esp, 4
cmp dword [esp + 0x15c], ebp
jb 0x4c719c
mov ecx, dword [esp + 0x148]
push ecx
call fcn.00564155
add esp, 4
xor eax, eax
jmp 0x4c71fd
push str.CServiceModule::Replace___Failed_
call fcn.004062df
push 1
lea edx, [esp + 0x180]
push edx
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 0x2c
call fcn.0054c860
cmp dword [esp + 0x194], edi
jb 0x4c71df
mov eax, dword [esp + 0x180]
push eax
call fcn.00564155
add esp, 4
cmp dword [esp + 0x15c], ebp
jb 0x4c71f8
mov ecx, dword [esp + 0x148]
push ecx
call fcn.00564155
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x3c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3a8]
xor ecx, esp
call fcn.00564b24
add esp, 0x3b8
ret