Function at 0x4a0c70
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x668
mov eax, dword [0x58b3a4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
xor esi, esi
cmp dword [eax + 0x28], esi
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea edi, [esi + 1]
je 0x4a0f8e
lea eax, [esp + 0x34]
push eax
call fcn.0051ec40
lea ecx, [esp + 0x34]
push ecx
call fcn.0051fd30
call fcn.004a05b0
push 0xf003f
push esi
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4a0d17
lea edx, [esp + 0x144]
push edx
call fcn.004b6b20
push 0x20
lea eax, [esp + 0x148]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
je 0x4a0d10
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4a0d09
lea edx, [esp + 0x144]
push edx
push edi
call fcn.004b6bb0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x58b3a4]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x3c]
push ecx
push edx
mov eax, 0x561944
call fcn.004a0470
test eax, eax
jne 0x4a0d53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_copy_Everything.exe:__d
push str._main_do_command_line_installs
push 0x269
push str.._srcmain.c
call fcn.0048dda0
mov eax, dword [0x58b3a4]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x3c]
push ecx
push edx
mov eax, str.Changes.txt
call fcn.004a0470
mov eax, dword [0x58b3a4]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x3c]
push ecx
push edx
mov eax, str.License.txt
call fcn.004a0470
mov eax, dword [0x58b3a4]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x3c]
push ecx
push edx
mov eax, str.Everything.lng
call fcn.004a0470
mov eax, dword [0x58b3a4]
mov ecx, dword [eax + 0x28]
mov edx, dword [esp + 0x3c]
push ecx
push edx
mov eax, str.Uninstall.exe
call fcn.004a0470
test eax, eax
je 0x4a0f0e
lea eax, [esp + 0x144]
push eax
call fcn.0051ec40
lea ecx, [esp + 0x568]
push ecx
call fcn.0051ec40
lea edx, [esp + 0x458]
push edx
call fcn.0051ec40
lea eax, [esp + 0x348]
push eax
call fcn.0051ec40
mov ecx, dword [0x58b3a4]
mov edx, dword [ecx + 0x28]
push str.Uninstall.exe
push edx
lea eax, [esp + 0x14c]
push eax
call fcn.0051f980
mov ecx, dword [0x58b3a4]
mov edx, dword [ecx + 0x28]
push 0x561944
push edx
lea eax, [esp + 0x570]
push eax
call fcn.0051f980
lea ecx, [esp + 0x348]
push ecx
call fcn.00520930
mov edx, dword [esp + 0x350]
push edx
lea eax, [esp + 0x45c]
push str.Everything__s
push eax
call fcn.0051fa10
mov ecx, dword [esp + 0x46c]
add esp, 0xc
push ecx
push str.DisplayName
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b0e90
mov edx, dword [esp + 0x14c]
push edx
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b0e90
push str.David_Carpenter
push str.Publisher
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b0e90
mov eax, dword [esp + 0x570]
push eax
push str.DisplayIcon
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b0e90
mov ecx, dword [esp + 0x350]
push ecx
push str.DisplayVersion
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b0e90
lea edx, [esp + 0x348]
push edx
call fcn.00522920
lea eax, [esp + 0x458]
push eax
call fcn.00522920
lea ecx, [esp + 0x568]
push ecx
call fcn.00522920
lea edx, [esp + 0x144]
push edx
call fcn.00522920
mov eax, dword [0x58b3a4]
cmp dword [eax + 0x2c], 0
je 0x4a0f78
mov eax, dword [eax + 0x2c]
cmp byte [eax], 0
je 0x4a0f78
lea ecx, [esp + 0x144]
push ecx
call fcn.0051ec40
mov edx, dword [0x58b3a4]
mov eax, dword [edx + 0x28]
push 0x561944
push eax
lea ecx, [esp + 0x14c]
push ecx
call fcn.0051f980
mov edx, dword [0x58b3a4]
mov eax, dword [edx + 0x2c]
mov ecx, dword [esp + 0x14c]
push 1
push 1
push 0
push eax
push 0
push ecx
push 0
call fcn.004a9290
lea edx, [esp + 0x144]
push edx
call fcn.00522920
lea eax, [esp + 0x34]
push eax
call fcn.00522920
mov eax, dword [0x58b3a4]
mov esi, 1
mov edi, esi
test dword [eax], 0x8000
je 0x4a1008
call fcn.004a05b0
call fcn.004f66b0
call fcn.004f6bf0
call fcn.004f6a70
lea ecx, [esp + 0x34]
push ecx
call fcn.0051ec40
lea edx, [esp + 0x34]
push edx
call fcn.0051fd30
mov esi, dword [esp + 0x3c]
push 0
call fcn.004a0640
lea eax, [esp + 0x34]
push eax
call fcn.00520010
mov esi, dword [esp + 0x3c]
push 0
call fcn.004a0640
lea ecx, [esp + 0x34]
push ecx
call fcn.005200b0
test eax, eax
je 0x4a0ff7
mov esi, dword [esp + 0x3c]
push 0
call fcn.004a0640
lea edx, [esp + 0x34]
push edx
call fcn.00522920
mov eax, dword [0x58b3a4]
mov esi, edi
cmp dword [eax + 0x30], 0
je 0x4a10e9
call fcn.004a05b0
push 0xf003f
push 0
push 0
call ebx
mov esi, eax
test esi, esi
je 0x4a10a1
lea eax, [esp + 0x144]
push eax
call fcn.004b6b20
push 0x20
lea ecx, [esp + 0x148]
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
je 0x4a1073
lea edx, [esp + 0x18]
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4a1068
lea eax, [esp + 0x144]
push eax
push esi
call fcn.004b6bb0
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
jmp 0x4a1079
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x10000
lea ecx, [esp + 0x148]
push ecx
push esi
call ebp
mov edi, eax
test edi, edi
je 0x4a1099
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push esi
call ebx
mov edi, 1
call fcn.004f66b0
call fcn.004f6bf0
call fcn.004f6a70
call fcn.004f71a0
call fcn.004f6df0
call fcn.004f7720
call fcn.004f7570
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004ab7b0
mov edx, dword [0x58b3a4]
mov esi, dword [edx + 0x30]
push edi
call fcn.004a0640
mov eax, dword [0x58b3a4]
mov esi, edi
mov ecx, 0x80000
test dword [eax + 4], ecx
je 0x4a1100
mov byte [0x58b212], 1
mov dword [esp + 0x14], edi
jmp 0x4a110c
test dword [eax + 8], ecx
je 0x4a1112
mov byte [0x58b212], 0
mov esi, edi
mov dword [esp + 0x10], edi
mov ebx, 2
test byte [eax + 4], bl
je 0x4a1123
call fcn.004fb270
jmp 0x4a112d
test byte [eax + 8], bl
je 0x4a1134
call fcn.004f66b0
mov eax, dword [0x58b3a4]
mov esi, edi
mov ecx, 0x2000000
test dword [eax + 4], ecx
je 0x4a1145
call fcn.004fb400
jmp 0x4a114f
test dword [eax + 8], ecx
je 0x4a1156
call fcn.004f6890
mov eax, dword [0x58b3a4]
mov esi, edi
mov cl, 4
test byte [eax + 4], cl
je 0x4a1164
call fcn.004fb590
jmp 0x4a116e
test byte [eax + 8], cl
je 0x4a1175
call fcn.004f6a70
mov eax, dword [0x58b3a4]
mov esi, edi
mov cl, 8
test byte [eax + 4], cl
je 0x4a1183
call fcn.004fb6f0
jmp 0x4a118d
test byte [eax + 8], cl
je 0x4a1194
call fcn.004f6bf0
mov eax, dword [0x58b3a4]
mov esi, edi
mov ecx, 0x1000000
test dword [eax + 4], ecx
je 0x4a11a5
call fcn.004fb7f0
jmp 0x4a11af
test dword [eax + 8], ecx
je 0x4a11b6
call fcn.004f6cf0
mov eax, dword [0x58b3a4]
mov esi, edi
mov cl, 0x10
test byte [eax + 4], cl
je 0x4a11c4
call fcn.004fb8f0
jmp 0x4a11ce
test byte [eax + 8], cl
je 0x4a11d5
call fcn.004f6df0
mov eax, dword [0x58b3a4]
mov esi, edi
test byte [eax + 4], 0x20
je 0x4a11e2
call fcn.004fbd90
jmp 0x4a11ed
test byte [eax + 8], 0x20
je 0x4a11f4
call fcn.004f7570
mov eax, dword [0x58b3a4]
mov esi, edi
mov cl, 0x40
test byte [eax + 4], cl
je 0x4a1202
call fcn.004fbe90
jmp 0x4a120c
test byte [eax + 8], cl
je 0x4a1213
call fcn.004f7720
mov eax, dword [0x58b3a4]
mov esi, edi
mov ecx, 0x20000
test dword [eax + 4], ecx
je 0x4a1224
call fcn.004fbb80
jmp 0x4a122e
test dword [eax + 8], ecx
je 0x4a1235
call fcn.004f71a0
mov eax, dword [0x58b3a4]
mov esi, edi
mov cl, 0x80
test byte [eax + 4], cl
je 0x4a1245
mov byte [0x58b0b9], 1
jmp 0x4a1251
test byte [eax + 8], cl
je 0x4a1257
mov byte [0x58b0b9], 0
mov esi, edi
mov dword [esp + 0x10], edi
mov ecx, 0x400000
test dword [eax + 4], ecx
je 0x4a126a
mov byte [0x58b22a], 1
jmp 0x4a1276
test dword [eax + 8], ecx
je 0x4a127c
mov byte [0x58b22a], 0
mov esi, edi
mov dword [esp + 0x14], edi
mov ecx, 0x100000
test dword [eax + 4], ecx
je 0x4a12a4
mov byte [0x57e612], 0
mov byte [0x58b0c3], 0
mov byte [0x57e621], 0
mov byte [0x58b0f8], 0
jmp 0x4a12b7
test dword [eax + 8], ecx
je 0x4a12bd
mov byte [0x57e612], 1
mov byte [0x57e621], 1
mov esi, edi
mov dword [esp + 0x10], edi
cmp dword [eax + 0x54], 0
je 0x4a12c9
mov dword [esp + 0x10], edi
mov esi, edi
mov ecx, dword [eax + 0x60]
add ecx, 0xffffffff
cmp ecx, 3
ja case.default.0x4a12d4
jmp dword [ecx*4 + 0x4a1484]
mov ecx, dword [eax + 0x4c]
mov edx, dword [eax + 0x48]
push ecx
push edx
call fcn.004b6f20
jmp 0x4a12fd
call fcn.004b6c20
jmp 0x4a12fd
call fcn.004b6d50
jmp 0x4a12fd
call fcn.004b6e50
mov eax, dword [0x58b3a4]
mov esi, edi
mov ecx, dword [eax + 0x64]
add ecx, 0xffffffff
cmp ecx, 3
ja case.default.0x4a130f
jmp dword [ecx*4 + 0x4a1494]
call fcn.00404370
jmp 0x4a1330
call fcn.004040c0
jmp 0x4a1330
call fcn.004041c0
jmp 0x4a1330
call fcn.00404290
mov eax, dword [0x58b3a4]
mov esi, edi
cmp dword [eax + 0x7c], 0
je 0x4a137c
mov esi, dword [eax + 0x7c]
test esi, esi
je 0x4a137a
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x4a1360
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push eax
push ecx
push edx
push 0
call fcn.004f9740
jmp 0x4a136f
cmp eax, ebx
jne 0x4a136f
mov eax, dword [esi + 8]
push eax
push 0
call fcn.004f97e0
mov esi, dword [esi]
test esi, esi
jne 0x4a1344
mov eax, dword [0x58b3a4]
mov esi, edi
cmp dword [eax + 0x3c], 0
je 0x4a13a2
mov ecx, dword [eax + 0x3c]
mov edx, dword [0x58b28c]
push ecx
push edx
call fcn.0051e5f0
mov dword [0x58b28c], eax
mov eax, dword [0x58b3a4]
mov dword [esp + 0x10], edi
mov esi, edi
test dword [eax], 0x800
je 0x4a1410
call fcn.004abda0
call fcn.004a0320
push edi
push 0
call fcn.004e9830
mov esi, dword [0x58b008]
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
jle 0x4a13ff
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [0x58afe4]
nop
lea ecx, [esp + 0x18]
push ecx
call edi
lea edx, [esp + 0x18]
push edx
call ebp
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
jg 0x4a13e0
call fcn.004e9270
mov eax, dword [0x58b3a4]
mov esi, 1
mov edi, esi
cmp dword [eax + 0x8c], 0
je 0x4a1451
cmp dword [eax + 0x90], 0
je 0x4a1451
mov ecx, dword [eax + 0x9c]
mov edx, dword [eax + 0x98]
push ecx
mov ecx, dword [eax + 0x94]
push edx
mov edx, dword [eax + 0x90]
mov eax, dword [eax + 0x8c]
push ecx
push edx
push eax
call fcn.00497190
mov eax, dword [0x58b3a4]
mov esi, edi
cmp dword [eax + 0x38], 0
je 0x4a145b
mov esi, edi
jmp 0x4a1462
cmp dword [esp + 0x10], 0
je 0x4a1469
push 0
call fcn.00409400
cmp dword [esp + 0x14], 0
je 0x4a1476
push edi
call fcn.00409400
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x668
ret