Function at 0x428990
Capabilities:
Create service
Delete service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
mov ecx, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x228], ecx
test ebx, ebx
je 0x428edd
test eax, eax
je 0x428edd
test esi, esi
je 0x428edd
test ecx, ecx
je 0x428edd
push 0x20
push esi
call fcn.00459b73
add esp, 8
test eax, eax
je 0x428a2c
cmp word [esi], 0x22
je 0x428a2c
push esi
push str.__s_
lea eax, [ebp - 0x214]
push 0x20e
push eax
call fcn.00457d45
lea ecx, [ebp - 0x214]
add esp, 0x10
mov dword [ebp - 0x218], ecx
jmp 0x428a32
mov dword [ebp - 0x218], esi
push edi
push str.VNLInstallService:_Stopping_any_pre_existing_instances_of_service
push 2
call fcn.004343f0
push 1
push ebx
call fcn.00426f20
push ebx
push str.VNLInstallService:_installing_service:__S
push 0x20
call fcn.004343f0
mov edi, dword [0x465034]
add esp, 0x1c
push 0xf003f
push str.ServicesActive
push 0
call edi
mov esi, eax
test esi, esi
jne 0x428a95
call dword [0x4651b0]
push eax
push str.VNLInstallService:_service_manager_open_failed__0x_08x___attempting_open_with_minimum_permissions
push 1
call fcn.004343f0
add esp, 0xc
push 2
push str.ServicesActive
push esi
call edi
mov esi, eax
jmp 0x428aa4
push str.VNLInstallService:_service_manager_opened
push 0x10
call fcn.004343f0
add esp, 8
test esi, esi
jne 0x428b74
call dword [0x4651b0]
cmp eax, 5
je 0x428b46
cmp eax, 0x57
je 0x428b18
cmp eax, 0x429
je 0x428aea
push eax
push str.VNLInstallService:_Service_Manager_open_failed:_0x_08X
push 1
call fcn.004343f0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_DATABASE_DOES_NOT_EXIST
push 1
call fcn.004343f0
push str.VNLInstallService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_INVALID_PARAMETER
push 1
call fcn.004343f0
push str.VNLInstallService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_ACCESS_DENIED
push 1
call fcn.004343f0
push str.VNLInstallService:_Service_Manager_open_failed:_you_must_be_an_administrator
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_service_manager_successfully_opened
push 0x10
call fcn.004343f0
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x428b99
call fcn.00412a50
test eax, eax
je 0x428b99
mov eax, str.NT_AUTHORITYLocalService
jmp 0x428b9b
xor eax, eax
mov edx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x218]
push 0
push eax
mov eax, dword [ebp - 0x21c]
push edx
mov edx, dword [ebp + 0x18]
push 0
push eax
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 0x220]
push 1
push edx
push eax
push 0x20002
push ecx
push ebx
push esi
call dword [0x46500c]
mov edi, eax
test edi, edi
jne 0x428e22
call dword [0x4651b0]
cmp eax, 0x431
jne 0x428cb4
push eax
push ebx
push str.VNLInstallService:_Service__S_already_exists:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
push 0x20002
push ebx
push esi
call dword [0x465038]
mov edi, eax
test edi, edi
je 0x428c9c
call fcn.00428150
mov edx, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x218]
push edx
mov edx, dword [ebp + 0x18]
push 0
push 0
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x228]
push eax
mov eax, dword [ebp + 0x14]
push 0
push 0
push ecx
push 1
push edx
push eax
push edi
call dword [0x465018]
test eax, eax
je 0x428c72
push str.VNLInstallService:_reconfigured_existing_service
push 0x12
call fcn.004343f0
mov eax, dword [ebp - 0x21c]
add esp, 8
call fcn.00428280
jmp 0x428e32
call dword [0x4651b0]
push eax
push str.VNLInstallService:_couldnt_reconfigure_existing_service:_0x_08x
push 1
call fcn.004343f0
mov eax, dword [ebp - 0x21c]
add esp, 0xc
call fcn.00428280
push edi
call dword [0x46503c]
jmp 0x428cc5
call dword [0x4651b0]
push eax
push str.VNLInstallService:_couldnt_open_existing_service:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x428cc5
push eax
push ebx
push str.VNLInstallService:_Service__S_could_not_be_created:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
push 0x10000
push ebx
push esi
call dword [0x465038]
mov edi, eax
test edi, edi
je 0x428d89
push str.VNLInstallService:_Deleting_service_and_re_attempt_create
push 1
call fcn.004343f0
add esp, 8
push edi
call dword [0x465010]
test eax, eax
jne 0x428d71
call dword [0x4651b0]
mov ecx, eax
sub ecx, 5
je 0x428d59
sub ecx, 1
je 0x428d41
sub ecx, 0x42a
je 0x428d29
push eax
push str.VNLInstallService:_Service_could_not_be_deleted:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
push edi
call dword [0x46503c]
jmp 0x428d9f
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_SERVICE_MARKED_FOR_DELETE
push 1
call fcn.004343f0
add esp, 8
push edi
call dword [0x46503c]
jmp 0x428d9f
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_INVALID_HANDLE
push 1
call fcn.004343f0
add esp, 8
push edi
call dword [0x46503c]
jmp 0x428d9f
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_ACCESS_DENIED
push 1
call fcn.004343f0
add esp, 8
push edi
call dword [0x46503c]
jmp 0x428d9f
push str.VNLInstallService:_Service_deleted
push 2
call fcn.004343f0
add esp, 8
push edi
call dword [0x46503c]
jmp 0x428d9f
call dword [0x4651b0]
push eax
push str.VNLInstallService:_Service_could_not_be_opened_for_delete:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp + 0x18]
push 0
push 0
push ecx
mov ecx, dword [ebp + 0x14]
push 0
push 0
push edx
mov edx, dword [ebp - 0x220]
push 1
push eax
push ecx
push 0x20002
push edx
push ebx
push esi
call dword [0x46500c]
mov edi, eax
test edi, edi
jne 0x428e1a
call dword [0x4651b0]
cmp eax, 0x430
jne 0x428def
push eax
push ebx
push str.VNLInstallService:_Service__S_could_not_be_created_since_marked_for_deletion_attempt_2_:_0x_08x
jmp 0x428df6
push eax
push ebx
push str.VNLInstallService:_Service__S_could_not_be_created__attempt_2_:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
push esi
call dword [0x46503c]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push ebx
push str.VNLInstallService:_Service_created__attempt_2_:__S
jmp 0x428e28
push ebx
push str.VNLInstallService:_Service_created:__S
push 0x12
call fcn.004343f0
add esp, 0xc
mov ebx, dword [ebp - 0x224]
test ebx, ebx
je 0x428e9d
push str.VNLInstallService:_Attempting_to_store_service_description
push 0x20
call fcn.004343f0
add esp, 8
lea eax, [ebp - 0x224]
push eax
push 1
push edi
mov dword [ebp - 0x224], ebx
call dword [0x46501c]
test eax, eax
jne 0x428e94
call dword [0x4651b0]
cmp eax, 5
jne 0x428e82
push eax
push str.VNLInstallService:_Description_config_failed:_access_denied_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x428eac
push eax
push str.VNLInstallService:_Description_config_failed:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x428eac
push str.VNLInstallService:_Description_config_successful
push 0x10
jmp 0x428ea4
push str.VNLInstallService:_Service_description_not_saved_since_unspecified
push 2
call fcn.004343f0
add esp, 8
push edi
mov edi, dword [0x46503c]
call edi
push esi
call edi
push str.VNLInstallService:_returning_success
push 0x10
call fcn.004343f0
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push ecx
push esi
push eax
push ebx
push str.VNLInstallService:_bad_parameters:_0x_08x_0x_08x_0x_08x_0x_08x
push 1
call fcn.004343f0
mov ecx, dword [ebp - 4]
add esp, 0x18
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040506e
mov esp, ebp
pop ebp
ret