Function at 0x432ea0
Capabilities:
Create service
Delete service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x230], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x234], ecx
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x21c], ecx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x220], edi
test esi, esi
je 0x43345b
test eax, eax
je 0x43345b
test edi, edi
je 0x43345b
test ecx, ecx
je 0x43345b
push 0x20
push edi
call fcn.00413d0b
add esp, 8
test eax, eax
je 0x432f52
cmp word [edi], 0x22
je 0x432f52
push edi
push 0x4b9190
lea eax, [ebp - 0x214]
push 0x20e
push eax
call fcn.00419510
lea edi, [ebp - 0x214]
add esp, 0x10
mov dword [ebp - 0x220], edi
push ebx
push str.VNLInstallService:_Stopping_any_pre_existing_instances_of_service
push 2
call fcn.00446b80
push 1
push esi
call fcn.00434160
push esi
push str.VNLInstallService:_installing_service:__S
push 0x20
call fcn.00446b80
add esp, 0x1c
push 0xf003f
push 0x4b9210
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x218], ebx
test ebx, ebx
jne 0x433095
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_service_manager_open_failed__0x_08x___attempting_open_with_minimum_permissions
push 1
call fcn.00446b80
add esp, 0xc
push 2
push 0x4b9210
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x218], eax
test ebx, ebx
jne 0x4330a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x433067
cmp eax, 0x57
je 0x433039
cmp eax, 0x429
je 0x43300b
push eax
push str.VNLInstallService:_Service_Manager_open_failed:_0x_08X
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_DATABASE_DOES_NOT_EXIST
push 1
call fcn.00446b80
push str.VNLInstallService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
push 1
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_INVALID_PARAMETER
push 1
call fcn.00446b80
push str.VNLInstallService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
push 1
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_Service_Manager_open_failed:_ERROR_ACCESS_DENIED
push 1
call fcn.00446b80
push str.VNLInstallService:_Service_Manager_open_failed:_you_must_be_an_administrator
push 1
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLInstallService:_service_manager_opened
push 0x10
call fcn.00446b80
add esp, 8
push str.VNLInstallService:_service_manager_successfully_opened
push 0x10
call fcn.00446b80
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x4330c9
call fcn.0041ec10
test eax, eax
je 0x4330c9
mov eax, str.NT_AUTHORITYLocalService
jmp 0x4330cb
xor eax, eax
push 0
push eax
push dword [ebp - 0x21c]
push 0
push dword [ebp - 0x234]
push edi
push 1
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push 0x20002
push dword [ebp - 0x22c]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x4333fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x433281
push eax
push esi
push str.VNLInstallService:_Service__S_already_exists:_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
push 0x20002
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x433269
push ebx
call fcn.004325b0
add esp, 4
mov ebx, eax
push dword [ebp - 0x22c]
push 0
push 0
push dword [ebp - 0x21c]
push 0
push 0
push dword [ebp - 0x220]
push 1
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x43321f
push str.VNLInstallService:_reconfigured_existing_service
push 0x12
call fcn.00446b80
add esp, 8
test ebx, ebx
je 0x4331b7
push ebx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test eax, eax
jne 0x4331b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseServiceDatabaseLock:_unlock_failed:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
mov ebx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x230]
test esi, esi
je 0x433419
push str.VNLInstallService:_Attempting_to_store_service_description
push 0x20
call fcn.00446b80
add esp, 8
mov dword [ebp - 0x230], esi
lea eax, [ebp - 0x230]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x433410
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov edx, str.VNLInstallService:_Description_config_failed:_0x_08x
mov ecx, str.VNLInstallService:_Description_config_failed:_access_denied_0x_08x
push eax
cmovne ecx, edx
push ecx
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x433428
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_couldnt_reconfigure_existing_service:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
test ebx, ebx
je 0x43325a
push ebx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test eax, eax
jne 0x43325a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseServiceDatabaseLock:_unlock_failed:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 0x218]
jmp 0x433292
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_couldnt_open_existing_service:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x433292
push eax
push esi
push str.VNLInstallService:_Service__S_could_not_be_created:_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
push 0x10000
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x433356
push str.VNLInstallService:_Deleting_service_and_re_attempt_create
push 1
call fcn.00446b80
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x43333e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 5
je 0x433326
sub ecx, 1
je 0x43330e
sub ecx, 0x42a
je 0x4332f6
push eax
push str.VNLInstallService:_Service_could_not_be_deleted:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x43336c
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_SERVICE_MARKED_FOR_DELETE
push 1
call fcn.00446b80
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x43336c
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_INVALID_HANDLE
push 1
call fcn.00446b80
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x43336c
push str.VNLInstallService:_Service_could_not_be_deleted:_ERROR_ACCESS_DENIED
push 1
call fcn.00446b80
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x43336c
push str.VNLInstallService:_Service_deleted
push 2
call fcn.00446b80
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x43336c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLInstallService:_Service_could_not_be_opened_for_delete:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
push 0
push 0
push dword [ebp - 0x21c]
push 0
push 0
push dword [ebp - 0x220]
push 1
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push 0x20002
push dword [ebp - 0x22c]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x4333e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
cmp eax, 0x430
mov edx, str.VNLInstallService:_Service__S_could_not_be_created__attempt_2_:_0x_08x
mov ecx, str.VNLInstallService:_Service__S_could_not_be_created_since_marked_for_deletion_attempt_2_:_0x_08x
cmovne ecx, edx
push esi
push ecx
push 1
call fcn.00446b80
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push esi
push str.VNLInstallService:_Service_created__attempt_2_:__S
push 0x12
call fcn.00446b80
add esp, 0xc
jmp 0x4331bd
push esi
push str.VNLInstallService:_Service_created:__S
push 0x12
call fcn.00446b80
add esp, 0xc
jmp 0x4331bd
push str.VNLInstallService:_Description_config_successful
push 0x10
jmp 0x433420
push str.VNLInstallService:_Service_description_not_saved_since_unspecified
push 2
call fcn.00446b80
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.VNLInstallService:_returning_success
push 0x10
call fcn.00446b80
add esp, 8
mov eax, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push ecx
push edi
push eax
push esi
push str.VNLInstallService:_bad_parameters:_0x_08x_0x_08x_0x_08x_0x_08x
push 1
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret