Function at 0x401160
Capabilities:
Delete file
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x182c
call fcn.00401630
mov eax, dword [0x409040]
push ebx
push esi
push edi
push str.Begin_RemoveService_....__n
push str.c:_temp_rmsvr.log
mov dword [esp + 0x183c], eax
call fcn.00401000
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x4011d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_error__errorcode_d__n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 0xc
mov ecx, dword [esp + 0x1834]
call fcn.004015aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x7ea
lea eax, [esp + 0x834]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x830]
push 0x5c
push ecx
call fcn.00401600
add esp, 8
test eax, eax
je 0x401237
mov edx, dword [str.LavaShareService.exe]
inc eax
mov dword [eax], edx
mov ecx, dword [0x407370]
mov dword [eax + 4], ecx
mov edx, dword [0x407374]
mov dword [eax + 8], edx
mov ecx, dword [0x407378]
mov dword [eax + 0xc], ecx
mov edx, dword [0x40737c]
mov dword [eax + 0x10], edx
mov cl, byte [0x407380]
mov byte [eax + 0x14], cl
lea edx, [esp + 0x30]
push 0x5c
mov ecx, 0x200
lea esi, [esp + 0x834]
lea edi, [esp + 0x34]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00401600
add esp, 8
test eax, eax
je 0x4012a7
mov ecx, dword [str.rdss.exe]
inc eax
mov dword [eax], ecx
mov edx, dword [0x407364]
mov dword [eax + 4], edx
mov cl, byte [0x407368]
mov byte [eax + 8], cl
lea eax, [esp + 0x30]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401280
mov ecx, dword [0x407358]
sub eax, edx
lea edx, [esp + eax + 0x30]
mov eax, dword [str.__service]
mov dword [edx], eax
mov ax, word [0x40735c]
mov dword [edx + 4], ecx
mov word [edx + 8], ax
mov ecx, 0x200
lea esi, [esp + 0x830]
lea edi, [esp + 0x1030]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1030]
push 0x5c
push ecx
call fcn.00401600
add esp, 8
test eax, eax
je 0x4012ed
mov edx, dword [str.rdss.exe]
inc eax
mov dword [eax], edx
mov ecx, dword [0x407364]
mov dword [eax + 4], ecx
mov dl, byte [0x407368]
mov byte [eax + 8], dl
lea eax, [esp + 0x830]
push eax
push str.oldServiceFile___s__n
push str.c:_temp_rmsvr.log
call fcn.00401000
lea ecx, [esp + 0x3c]
push ecx
push str.newServiceFile___s__n
push str.c:_temp_rmsvr.log
call fcn.00401000
lea edx, [esp + 0x1048]
push edx
push str.curServiceFile___s__n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 0x24
push 0xf01ff
push str.LavaShareService
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
je 0x40141f
push str.Now_StopService_....__n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 8
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4013f2
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
je 0x4013aa
lea esp, [esp]
cmp dword [esp + 0x18], 3
jne 0x4013aa
push 0x3e8
call ebx
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x401390
cmp dword [esp + 0x18], 1
jne 0x4013d7
push str.service_statusSERVICE_STOPPED___now_DeleteService_...__n
push str.c:_temp_rmsvr.log
call fcn.00401000
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004010e0
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401438
push str.service_status_SERVICE_STOPPED__n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401438
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StopService_error___errorcode_d___but_still_DeleteService...__n
push str.c:_temp_rmsvr.log
call fcn.00401000
lea ecx, [esp + 0x3c]
push ecx
push esi
call fcn.004010e0
add esp, 0x14
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401438
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_error___errorcode_d___n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 0xc
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x830]
push 0
push eax
call fcn.004015b8
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 8
cmp eax, 0xffffffff
je 0x40147c
push str.Delete_the_old_service_exe_file___n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 8
lea ecx, [esp + 0x830]
push ecx
call edi
push 0xbb8
call ebx
xor esi, esi
lea edx, [esp + 0x1030]
push 0
push edx
call fcn.004015b8
add esp, 8
cmp eax, 0xffffffff
je 0x4014c9
push str.Delete_the_rdss.exe_file___n
push str.c:_temp_rmsvr.log
call fcn.00401000
add esp, 8
lea eax, [esp + 0x1030]
push eax
call edi
test eax, eax
je 0x4014c9
push 0x3e8
call ebx
inc esi
cmp esi, 0x1e
jl 0x401485
mov ecx, dword [esp + 0x1834]
call fcn.004015aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret