WooYun.org

interface Service
{
	long RunRavProgram(in string filePath);
	long QuitRavProgram(in string filePath);
	long InstallSoftware(in long agr1, in string agr2, in string agr3, in string agr4, in long agr5);
	char InstallControl(in string arg1, in short arg2);
	char UninstallControl();
	DiskInfo GetAllDisk();
	DiskInfo GetAllHardDisk();
	DiskInfo GetAllHardNetDisk();
	char GetFileStatus(in string filePath, out FileState state);
	long GetFile(in string filePath, in long nPos, out List buffer);
	long GetFileEx(in string filePath, in long nPos, out List buffer);
	long ReadFile(in string filePath, in long nPos, out List buffer);
	long AddTask(in string taskInfo, in long replayCount, in string remoteIP, in long nPort, in string objectName, in string macAddress, in string arg3, in string arg4);
	long DeleteTask(in long taskId);
	long QueryTask(in long fastId, in long count, out TaskInfoList askList);
	long OnFinishTask(in string taskInfo, in string arg1, in long arg2, in string agr3);
	DiagnoseInfo GetDiagnose(in long type);
	//List GetRegInfoList(in List info);
	// SysDef、AppCtrl、ActVirus、RemovMon、WebMon、RsSelf、FileMon、MailMon
	long CtrlMonitorEx(in InfoValueList arg0);
	long ReadConfig(in string name, in string arg2, out string retValue);
	long WriteConfig(in string name, in string arg2, in string value);
	long GetRsConfig(in long arg0, out List arg1, out long arg2);
	long SetRsConfig(in long arg0, in List arg1, in long arg2);
	long GetClientStatus(out ClientInfo info);
};

case 42:
        result = remote_Uninstall(v7, (int)readPos, (DWORD)readSize, (char *)readBuffer, (int)writeBuffer);
        break;
      case 43:
        result = remote_UninstallControl(v7, (int)readPos, (int)readSize, (int)readBuffer, (int)writeBuffer);
        break;
      case 44:
        result = remote_UninstallReceiver(v7, (int)readPos, (int)readSize, (int)readBuffer, writeBuffer);
        break;
      case 45:
        result = remote_UninstallSender(v7, (int)readPos, (int)readSize, (int)readBuffer, writeBuffer);
        break;
      case 46:
        result = remote_UpdateClient(v7, (int)readPos, (int)readSize, (int)readBuffer, (int)writeBuffer);
        break;
      case 47:
        result = remote_UpdateStrategy(v7, (int)readPos, (DWORD)readSize, (char *)readBuffer, (int)writeBuffer);
        break;
      case 48:
        result = remote_WriteConfig(v7, (int)readPos, (int)readSize, (char *)readBuffer, writeBuffer);
        break;
      default:
        goto LABEL_52;
    }
  }
  return result;
}
int __cdecl ServiceCreateProcess(LPCSTR lpString2)
{
  int v1; // eax@1
  int result; // eax@4
  char ArgList[4]; // [sp+0h] [bp-4h]@1
  *(_DWORD *)ArgList = 0;
  CheckSystemVersion_sub_10001380(ArgList);
  v1 = (int)GetNCRsLogUtility();
  OutputLogToFile_0(v1, "ServiceCreateProcess():%d-%s");
  if ( ArgList[0] == 0x93 || ArgList[0] == 0x91 || ArgList[0] == 0x92 )
    result = (int)ExecuteProcessAsUser((int)lpString2);
  else
    result = ExecuteProcess(lpString2);
  return result;
}