Function at 0x4a2990
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x77c
mov eax, dword [0x596f48]
xor eax, esp
mov dword [esp + 0x778], eax
mov eax, dword [0x598104]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
xor esi, esi
cmp dword [eax + 0x28], esi
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea edi, [esi + 1]
je 0x4a2cdc
lea eax, [esp + 0x34]
push eax
call fcn.00522730
lea ecx, [esp + 0x34]
push ecx
call fcn.005238a0
call fcn.004a2630
push 0xf003f
push esi
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4a2a45
lea edx, [esp + 0x584]
push edx
call fcn.004b9700
push 0x20
lea eax, [esp + 0x588]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
je 0x4a2a3e
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4a2a37
lea edx, [esp + 0x584]
push edx
push edi
call fcn.004b97b0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x598104]
mov edx, dword [eax + 0x28]
mov ecx, dword [esp + 0x3c]
push 0x56bff4
call fcn.004a24d0
test eax, eax
jne 0x4a2a7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_copy_Everything.exe:__d
push str._main_do_command_line_installs
push 0x267
push str.._srcmain.c
call fcn.0048f250
mov ecx, dword [0x598104]
mov edx, dword [ecx + 0x28]
mov ecx, dword [esp + 0x3c]
push str.Changes.txt
call fcn.004a24d0
mov edx, dword [0x598104]
mov edx, dword [edx + 0x28]
mov ecx, dword [esp + 0x3c]
push str.License.txt
call fcn.004a24d0
mov eax, dword [0x598104]
mov edx, dword [eax + 0x28]
mov ecx, dword [esp + 0x3c]
push str.Everything.lng
call fcn.004a24d0
mov ecx, dword [0x598104]
mov edx, dword [ecx + 0x28]
mov ecx, dword [esp + 0x3c]
push str.Uninstall.exe
call fcn.004a24d0
test eax, eax
je 0x4a2c5c
lea edx, [esp + 0x584]
push edx
call fcn.00522730
lea eax, [esp + 0x364]
push eax
call fcn.00522730
lea ecx, [esp + 0x254]
push ecx
call fcn.00522730
lea edx, [esp + 0x474]
push edx
call fcn.00522730
lea eax, [esp + 0x144]
push eax
call fcn.00522730
mov ecx, dword [0x598104]
mov edx, dword [ecx + 0x28]
push str.Uninstall.exe
push edx
lea eax, [esp + 0x58c]
push eax
call fcn.00523470
mov ecx, dword [0x598104]
mov edx, dword [ecx + 0x28]
push 0x56bff4
push edx
lea eax, [esp + 0x36c]
push eax
call fcn.00523470
lea ecx, [esp + 0x474]
push ecx
call fcn.005244e0
lea edx, [esp + 0x144]
push edx
call fcn.00524510
mov eax, dword [esp + 0x47c]
push eax
lea ecx, [esp + 0x258]
push str.Everything__s
push ecx
call fcn.00523500
mov edx, dword [esp + 0x268]
add esp, 0xc
push edx
push str.DisplayName
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b3080
mov eax, dword [esp + 0x58c]
push eax
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b3080
push str.David_Carpenter
push str.Publisher
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b3080
mov ecx, dword [esp + 0x36c]
push ecx
push str.DisplayIcon
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b3080
mov edx, dword [esp + 0x14c]
push edx
push str.DisplayVersion
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004b3080
lea eax, [esp + 0x144]
push eax
call fcn.00401260
lea ecx, [esp + 0x474]
push ecx
call fcn.00401260
lea edx, [esp + 0x254]
push edx
call fcn.00401260
lea eax, [esp + 0x364]
push eax
call fcn.00401260
lea ecx, [esp + 0x584]
push ecx
call fcn.00401260
mov eax, dword [0x598104]
cmp dword [eax + 0x2c], 0
je 0x4a2cc6
mov edx, dword [eax + 0x2c]
cmp byte [edx], 0
je 0x4a2cc6
lea eax, [esp + 0x584]
push eax
call fcn.00522730
mov ecx, dword [0x598104]
mov edx, dword [ecx + 0x28]
push 0x56bff4
push edx
lea eax, [esp + 0x58c]
push eax
call fcn.00523470
mov ecx, dword [0x598104]
mov edx, dword [ecx + 0x2c]
mov eax, dword [esp + 0x58c]
push 1
push 1
push 0
push edx
push 0
push eax
push 0
call fcn.004ab5e0
lea ecx, [esp + 0x584]
push ecx
call fcn.00401260
lea edx, [esp + 0x34]
push edx
call fcn.00401260
mov eax, dword [0x598104]
mov esi, 1
mov edi, esi
test dword [eax], 0x8000
je 0x4a2d56
call fcn.004a2630
call fcn.004f9910
call fcn.004f9eb0
call fcn.004f9d10
lea eax, [esp + 0x34]
push eax
call fcn.00522730
lea ecx, [esp + 0x34]
push ecx
call fcn.005238a0
mov esi, dword [esp + 0x3c]
push 0
call fcn.004a2720
lea edx, [esp + 0x34]
push edx
call fcn.00523b70
mov esi, dword [esp + 0x3c]
push 0
call fcn.004a2720
lea eax, [esp + 0x34]
push eax
call fcn.00523c20
test eax, eax
je 0x4a2d45
mov esi, dword [esp + 0x3c]
push 0
call fcn.004a2720
lea ecx, [esp + 0x34]
push ecx
call fcn.00401260
mov eax, dword [0x598104]
mov esi, edi
cmp dword [eax + 0x30], 0
je 0x4a2e37
call fcn.004a2630
push 0xf003f
push 0
push 0
call ebx
mov esi, eax
test esi, esi
je 0x4a2def
lea edx, [esp + 0x584]
push edx
call fcn.004b9700
push 0x20
lea eax, [esp + 0x588]
push eax
push esi
call ebp
mov edi, eax
test edi, edi
je 0x4a2dc1
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4a2db6
lea edx, [esp + 0x584]
push edx
push esi
call fcn.004b97b0
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
jmp 0x4a2dc7
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x10000
lea eax, [esp + 0x588]
push eax
push esi
call ebp
mov edi, eax
test edi, edi
je 0x4a2de7
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push esi
call ebx
mov edi, 1
call fcn.004f9910
call fcn.004f9eb0
call fcn.004f9d10
call fcn.004fa4e0
call fcn.004fa0e0
call fcn.004faa80
call fcn.004fa8c0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallEverything
push reloc.WS2_32.dll_bind
call fcn.004adcb0
mov ecx, dword [0x598104]
mov esi, dword [ecx + 0x30]
push edi
call fcn.004a2720
mov eax, dword [0x598104]
mov esi, edi
mov ecx, 0x80000
test dword [eax + 4], ecx
je 0x4a2e4e
mov byte [0x597f7f], 1
mov dword [esp + 0x14], edi
jmp 0x4a2e5a
test dword [eax + 8], ecx
je 0x4a2e60
mov byte [0x597f7f], 0
mov esi, edi
mov dword [esp + 0x10], edi
mov ebx, 2
test byte [eax + 4], bl
je 0x4a2e71
call fcn.004fe730
jmp 0x4a2e7b
test byte [eax + 8], bl
je 0x4a2e82
call fcn.004f9910
mov eax, dword [0x598104]
mov esi, edi
mov ecx, 0x2000000
test dword [eax + 4], ecx
je 0x4a2e93
call fcn.004fe8e0
jmp 0x4a2e9d
test dword [eax + 8], ecx
je 0x4a2ea4
call fcn.004f9b10
mov eax, dword [0x598104]
mov esi, edi
mov cl, 4
test byte [eax + 4], cl
je 0x4a2eb2
call fcn.004fea90
jmp 0x4a2ebc
test byte [eax + 8], cl
je 0x4a2ec3
call fcn.004f9d10
mov eax, dword [0x598104]
mov esi, edi
mov cl, 8
test byte [eax + 4], cl
je 0x4a2ed1
call fcn.004fec10
jmp 0x4a2edb
test byte [eax + 8], cl
je 0x4a2ee2
call fcn.004f9eb0
mov eax, dword [0x598104]
mov esi, edi
mov ecx, 0x1000000
test dword [eax + 4], ecx
je 0x4a2ef3
call fcn.004fed20
jmp 0x4a2efd
test dword [eax + 8], ecx
je 0x4a2f04
call fcn.004f9fd0
mov eax, dword [0x598104]
mov esi, edi
mov cl, 0x10
test byte [eax + 4], cl
je 0x4a2f12
call fcn.004fee30
jmp 0x4a2f1c
test byte [eax + 8], cl
je 0x4a2f23
call fcn.004fa0e0
mov eax, dword [0x598104]
mov esi, edi
test byte [eax + 4], 0x20
je 0x4a2f30
call fcn.004ff300
jmp 0x4a2f3b
test byte [eax + 8], 0x20
je 0x4a2f42
call fcn.004fa8c0
mov eax, dword [0x598104]
mov esi, edi
mov cl, 0x40
test byte [eax + 4], cl
je 0x4a2f50
call fcn.004ff420
jmp 0x4a2f5a
test byte [eax + 8], cl
je 0x4a2f61
call fcn.004faa80
mov eax, dword [0x598104]
mov esi, edi
mov ecx, 0x20000
test dword [eax + 4], ecx
je 0x4a2f72
call fcn.004ff0e0
jmp 0x4a2f7c
test dword [eax + 8], ecx
je 0x4a2f83
call fcn.004fa4e0
mov eax, dword [0x598104]
mov esi, edi
mov cl, 0x80
test byte [eax + 4], cl
je 0x4a2f93
mov byte [0x597e1a], 1
jmp 0x4a2f9f
test byte [eax + 8], cl
je 0x4a2fa5
mov byte [0x597e1a], 0
mov esi, edi
mov dword [esp + 0x10], edi
mov ecx, 0x400000
test dword [eax + 4], ecx
je 0x4a2fb8
mov byte [0x597f97], 1
jmp 0x4a2fc4
test dword [eax + 8], ecx
je 0x4a2fca
mov byte [0x597f97], 0
mov esi, edi
mov dword [esp + 0x14], edi
mov ecx, 0x100000
test dword [eax + 4], ecx
je 0x4a2ff2
mov byte [0x58a611], 0
mov byte [0x597e58], 0
mov byte [0x58a614], 0
mov byte [0x597e59], 0
jmp 0x4a3005
test dword [eax + 8], ecx
je 0x4a300b
mov byte [0x58a611], 1
mov byte [0x58a614], 1
mov esi, edi
mov dword [esp + 0x10], edi
cmp dword [eax + 0x54], 0
je 0x4a3017
mov dword [esp + 0x10], edi
mov esi, edi
mov ecx, dword [eax + 0x60]
add ecx, 0xffffffff
cmp ecx, 3
ja case.default.0x4a3022
jmp dword [ecx*4 + 0x4a31e4]
mov edx, dword [eax + 0x4c]
mov eax, dword [eax + 0x48]
push edx
push eax
call fcn.004b9be0
jmp 0x4a304b
call fcn.004b9820
jmp 0x4a304b
call fcn.004b9990
jmp 0x4a304b
call fcn.004b9ad0
mov eax, dword [0x598104]
mov esi, edi
mov ecx, dword [eax + 0x64]
add ecx, 0xffffffff
cmp ecx, 3
ja case.default.0x4a305d
jmp dword [ecx*4 + 0x4a31f4]
call fcn.00404490
jmp 0x4a307e
call fcn.004041e0
jmp 0x4a307e
call fcn.004042e0
jmp 0x4a307e
call fcn.004043b0
mov eax, dword [0x598104]
mov esi, edi
cmp dword [eax + 0x7c], 0
je 0x4a30ca
mov esi, dword [eax + 0x7c]
test esi, esi
je 0x4a30c8
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x4a30ae
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ecx
push edx
push eax
push 0
call fcn.004fcbb0
jmp 0x4a30bd
cmp eax, ebx
jne 0x4a30bd
mov ecx, dword [esi + 8]
push ecx
push 0
call fcn.004fcc50
mov esi, dword [esi]
test esi, esi
jne 0x4a3092
mov eax, dword [0x598104]
mov esi, edi
cmp dword [eax + 0x3c], 0
je 0x4a30ef
mov edx, dword [eax + 0x3c]
mov eax, dword [0x597ffc]
push edx
push eax
call fcn.005220d0
mov dword [0x597ffc], eax
mov eax, dword [0x598104]
mov dword [esp + 0x10], edi
mov esi, edi
test dword [eax], 0x800
je 0x4a3160
call fcn.004ae3b0
call fcn.004a2350
push edi
push 0
call fcn.004ecab0
mov esi, dword [0x597d78]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
jle 0x4a314f
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [0x597d54]
lea esp, [esp]
lea edx, [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x18]
push eax
call ebp
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
jg 0x4a3130
call fcn.004ec4b0
mov eax, dword [0x598104]
mov esi, 1
mov edi, esi
cmp dword [eax + 0x8c], 0
je 0x4a31a1
cmp dword [eax + 0x90], 0
je 0x4a31a1
mov edx, dword [eax + 0x9c]
mov ecx, dword [eax + 0x98]
push edx
mov edx, dword [eax + 0x94]
push ecx
mov ecx, dword [eax + 0x90]
push edx
mov edx, dword [eax + 0x8c]
push ecx
push edx
call fcn.004990c0
mov eax, dword [0x598104]
mov esi, edi
cmp dword [eax + 0x38], 0
je 0x4a31ab
mov esi, edi
jmp 0x4a31b2
cmp dword [esp + 0x10], 0
je 0x4a31b9
push 0
call fcn.004096f0
cmp dword [esp + 0x14], 0
je 0x4a31c6
push edi
call fcn.004096f0
mov ecx, dword [esp + 0x788]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054899c
add esp, 0x77c
ret