Function at 0x4c63e0
Capabilities:
Copy file
Create process on windows
Persist via application shimming

Disassembly:
jmp 0x4c63e0
push 0xffffffffffffffff
push 0x785ce6
mov eax, dword fs:[0]
push eax
sub esp, 0x3ac
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x3a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x3c0]
mov dword fs:[0], eax
push 0x3c
mov edi, ecx
xor ebx, ebx
push str.CServiceModule::Replace___Trying_to_replace_running_process_n
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push ebx
lea eax, [esp + 0x110]
push eax
mov ecx, 0x868edc
mov dword [esp + 0x3d0], ebx
call fcn.0054c860
cmp dword [esp + 0x124], 0x10
mov dword [esp + 0x3c8], 0xffffffff
jb 0x4c648a
mov ecx, dword [esp + 0x110]
push ecx
call fcn.00564155
add esp, 4
push 0xf003f
push ebx
push ebx
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
je 0x4c64c5
push 1
add edi, 0x30
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp eax, ebx
je 0x4c64be
push eax
mov ebp, 1
call edi
push esi
call edi
cmp ebp, ebx
jne 0x4c652b
push 0x42
push str.CServiceModule::Replace___Not_installed_as_service__cant_replace_
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push 1
lea edx, [esp + 0x110]
push edx
mov ecx, 0x868edc
mov dword [esp + 0x3d0], 1
call fcn.0054c860
cmp dword [esp + 0x124], 0x10
jb 0x4c71f8
mov eax, dword [esp + 0x110]
push eax
jmp 0x4c71f0
push 0x2e
mov edi, 0xf
push str.CServiceModule::Replace___Service_is_installed
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push ebx
lea ecx, [esp + 0x110]
push ecx
mov ecx, 0x868edc
mov dword [esp + 0x3d0], 2
call fcn.0054c860
mov esi, 0x10
cmp dword [esp + 0x124], esi
jb 0x4c6594
mov edx, dword [esp + 0x110]
push edx
call fcn.00564155
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x15c], 7
mov dword [esp + 0x158], ebx
mov word [esp + 0x148], ax
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x7b6c3c
mov dword [esp + 0x3d4], 3
call fcn.00401816
add esp, 0xc
test al, al
jne 0x4c6655
push 0x38
push str.CServiceModule::Replace___Failed_getting_service_status_
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.00405920
push 1
lea eax, [esp + 0x110]
push eax
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 4
call fcn.0054c860
cmp dword [esp + 0x124], esi
jb 0x4c663a
mov ecx, dword [esp + 0x110]
push ecx
call fcn.00564155
add esp, 4
cmp dword [esp + 0x15c], 8
jb 0x4c71f8
mov edx, dword [esp + 0x148]
push edx
jmp 0x4c71f0
push 0x7b6c8c
call fcn.00407ed2
add esp, 4
test al, al
jne 0x4c66c2
push str.CServiceModule::Replace___Failed_to_shutdown_service_
lea ecx, [esp + 0x24]
call fcn.004062df
push 1
lea eax, [esp + 0x24]
push eax
mov ecx, 0x868edc
mov byte [esp + 0x3d0], 5
call fcn.0054c860
mov byte [esp + 0x3c8], 3
cmp dword [esp + 0x38], esi
jb 0x4c66a8
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00564155
add esp, 4
push 0x7b6cd8
call fcn.004017e4
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4c6704
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
lea ecx, [ecx]
push 0x7b6cf4
call fcn.00402248
add esp, 4
test al, al
je 0x4c66ec
push 0x64
call edi
sub esi, 1
jne 0x4c66d0
jmp 0x4c66f0
cmp esi, ebx
jne 0x4c6704
push 0x7b6d10
call fcn.004017e4
add esp, 4
push 0x3e8
call edi
cmp dword [esp + 0x1c], 4
je 0x4c6768
push 4
push 0x7b6d2c
call fcn.004070d6
add esp, 8
test al, al
jne 0x4c6768
push str.CServiceModule::Replace___Failed_setting_service_status_
lea ecx, [esp + 0x180]
call fcn.004062df
push 1
lea edx, [esp + 0x180]
mov byte [esp + 0x3cc], 6
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x17c]
call fcn.00402ed7
lea ecx, [esp + 0x144]
call fcn.00403a26
jmp 0x4c71f8
push 0x208
lea eax, [esp + 0x1b8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x18], 0xa
jmp 0x4c6790
dec dword [esp + 0x18]
push 0x7b6d7c
call fcn.004017e4
add esp, 4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x15c], 8
mov eax, dword [esp + 0x148]
jae 0x4c67c4
lea eax, [esp + 0x148]
push ebx
push eax
lea ecx, [esp + 0x1bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
mov byte [esp + 0x17], al
cmp al, bl
jne 0x4c6af0
xor edx, edx
lea eax, [esp + 0x1b4]
mov dword [esp + 0x124], 7
mov dword [esp + 0x120], ebx
mov word [esp + 0x110], dx
lea ecx, [eax + 2]
jmp 0x4c6810
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4c6810
sub eax, ecx
sar eax, 1
push eax
lea eax, [esp + 0x1b8]
push eax
lea ecx, [esp + 0x114]
call fcn.00405ef2
mov byte [esp + 0x3c8], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004083af
mov esi, eax
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x80]
push eax
mov byte [esp + 0x3d8], 8
call fcn.00407662
mov edi, eax
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x6c]
push edx
mov byte [esp + 0x3e0], 9
call fcn.00407662
add esp, 0x18
mov ebp, eax
push 0x34
push str.CServiceModule::Replace___Failed_copying_file_from:
lea ecx, [esp + 0x130]
mov byte [esp + 0x3d0], 0xa
mov dword [esp + 0x148], 0xf
mov dword [esp + 0x144], ebx
mov byte [esp + 0x134], bl
call fcn.00405920
push ebp
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0x3d4], 0xb
call fcn.00402fd1
push 0x7b6da8
push eax
lea edx, [esp + 0x50]
push edx
mov byte [esp + 0x3e0], 0xc
call fcn.00405939
push edi
push eax
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0x3ec], 0xd
invalid