Function at 0x42c6f0
Capabilities:
Create service
Delete service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e7018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x220], ecx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x224], edi
test esi, esi
je 0x42cc4f
test eax, eax
je 0x42cc4f
test edi, edi
je 0x42cc4f
test ecx, ecx
je 0x42cc4f
push 0x20
push edi
call fcn.004110eb
add esp, 8
test eax, eax
je 0x42c7a2
cmp word [edi], 0x22
je 0x42c7a2
push edi
push str.__s_
lea eax, [ebp - 0x214]
push 0x20e
push eax
call fcn.004159a0
lea edi, [ebp - 0x214]
add esp, 0x10
mov dword [ebp - 0x224], edi
push ebx
push str.VNLInstallService:_Stopping_any_pre_existing_instances_of_service
push 2
call fcn.004439a0
push 1
push esi
call fcn.0042d970
push esi
push str.VNLInstallService:_installing_service:__S
push 0x20
call fcn.004439a0
add esp, 0x1c
push 0xf003f
push 0x4ae7f8
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x42c807
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_service_manager_open_failed__0x_08x___attempting_open_with_minimum_permissions
push 1
call fcn.004439a0
add esp, 0xc
push 2
push 0x4ae7f8
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
jmp 0x42c816
push str.VNLInstallService:_service_manager_opened
push 0x10
call fcn.004439a0
add esp, 8
test ebx, ebx
jne 0x42c8e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x42c8b8
cmp eax, 0x57
je 0x42c88a
cmp eax, 0x429
je 0x42c85c
push eax
push str.VNLInstallService:_Service_Manager_open_failed:_0x_08X
push 1
call fcn.004439a0
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_DATABASE_DOES_NOT_EXIST
push 1
call fcn.004439a0
push str.VNLInstallService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
push 1
call fcn.004439a0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_INVALID_PARAMETER
push 1
call fcn.004439a0
push str.VNLInstallService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
push 1
call fcn.004439a0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_ACCESS_DENIED
push 1
call fcn.004439a0
push str.VNLInstallService:_Service_Manager_open_failed:_you_must_be_an_administrator
push 1
call fcn.004439a0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_service_manager_successfully_opened
push 0x10
call fcn.004439a0
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x42c90b
call fcn.0041af30
test eax, eax
je 0x42c90b
mov eax, str.NT_AUTHORITYLocalService
jmp 0x42c90d
xor eax, eax
push 0
push eax
push dword [ebp - 0x220]
push 0
push dword [ebp - 0x21c]
push edi
push 1
push dword [ebp - 0x228]
push dword [ebp - 0x22c]
push 0x20002
push dword [ebp - 0x230]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x42cb92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x42ca23
push eax
push esi
push str.VNLInstallService:_Service__S_already_exists:_0x_08x
push 1
call fcn.004439a0
add esp, 0x10
push 0x20002
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x42ca0b
push ebx
call fcn.0042bdc0
add esp, 4
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x230]
push 0
push 0
push dword [ebp - 0x220]
push 0
push 0
push dword [ebp - 0x224]
push 1
push dword [ebp - 0x228]
push dword [ebp - 0x22c]
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x42c9e1
push str.VNLInstallService:_reconfigured_existing_service
push 0x12
call fcn.004439a0
push dword [ebp - 0x21c]
call fcn.0042bf00
jmp 0x42cb9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_couldnt_reconfigure_existing_service:_0x_08x
push 1
call fcn.004439a0
push dword [ebp - 0x21c]
call fcn.0042bf00
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ca34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_couldnt_open_existing_service:_0x_08x
push 1
call fcn.004439a0
add esp, 0xc
jmp 0x42ca34
push eax
push esi
push str.VNLInstallService:_Service__S_could_not_be_created:_0x_08x
push 1
call fcn.004439a0
add esp, 0x10
push 0x10000
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x42caf8
push str.VNLInstallService:_Deleting_service_and_re_attempt_create
push 1
call fcn.004439a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x42cae0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 5
je 0x42cac8
sub ecx, 1
je 0x42cab0
sub ecx, 0x42a
je 0x42ca98
push eax
push str.VNLInstallService:_Service_could_not_be_deleted:_0x_08x
push 1
call fcn.004439a0
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42cb0e
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_SERVICE_MARKED_FOR_DELETE
push 1
call fcn.004439a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42cb0e
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_INVALID_HANDLE
push 1
call fcn.004439a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42cb0e
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_ACCESS_DENIED
push 1
call fcn.004439a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42cb0e
push str.VNLInstallService:_Service_deleted
push 2
call fcn.004439a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42cb0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_Service_could_not_be_opened_for_delete:_0x_08x
push 1
call fcn.004439a0
add esp, 0xc
push 0
push 0
push dword [ebp - 0x220]
push 0
push 0
push dword [ebp - 0x224]
push 1
push dword [ebp - 0x228]
push dword [ebp - 0x22c]
push 0x20002
push dword [ebp - 0x230]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x42cb8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x42cb5f
push eax
push esi
push str.VNLInstallService:_Service__S_could_not_be_created_since_marked_for_deletion_attempt_2_:_0x_08x
jmp 0x42cb66
push eax
push esi
push str.VNLInstallService:_Service__S_could_not_be_created__attempt_2_:_0x_08x
push 1
call fcn.004439a0
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push esi
push str.VNLInstallService:_Service_created__attempt_2_:__S
jmp 0x42cb98
push esi
push str.VNLInstallService:_Service_created:__S
push 0x12
call fcn.004439a0
add esp, 0xc
mov esi, dword [ebp - 0x218]
test esi, esi
je 0x42cc0d
push str.VNLInstallService:_Attempting_to_store_service_description
push 0x20
call fcn.004439a0
add esp, 8
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x218]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x42cc04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42cbf2
push eax
push str.VNLInstallService:_Description_config_failed:_access_denied_0x_08x
push 1
call fcn.004439a0
add esp, 0xc
jmp 0x42cc1c
push eax
push str.VNLInstallService:_Description_config_failed:_0x_08x
push 1
call fcn.004439a0
add esp, 0xc
jmp 0x42cc1c
push str.VNLInstallService:_Description_config_successful
push 0x10
jmp 0x42cc14
push str.VNLInstallService:_Service_description_not_saved_since_unspecified
push 2
call fcn.004439a0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.VNLInstallService:_returning_success
push 0x10
call fcn.004439a0
add esp, 8
mov eax, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bf1
mov esp, ebp
pop ebp
ret
push ecx
push edi
push eax
push esi
push str.VNLInstallService:_bad_parameters:_0x_08x_0x_08x_0x_08x_0x_08x
push 1
call fcn.004439a0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00401bf1
mov esp, ebp
pop ebp
ret