Function at 0x46ded0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5103db
mov eax, dword fs:[0]
push eax
sub esp, 0x614
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x618], edi
mov dword [ebp - 0x620], 1
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], edi
movq qword [ebp - 0x20], xmm0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x610], esi
test esi, esi
je 0x46e259
mov esi, dword [ebp - 0x61c]
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x614], edi
test edi, edi
je 0x46e253
mov ecx, 0x51a1d0
nop dword [eax + eax]
mov ax, word [esi]
cmp ax, word [ecx]
jne 0x46dfa6
test ax, ax
je 0x46dfa2
mov ax, word [esi + 2]
cmp ax, word [ecx + 2]
jne 0x46dfa6
add esi, 4
add ecx, 4
test ax, ax
jne 0x46df80
xor eax, eax
jmp 0x46dfab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x46e074
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x608]
mov dword [ebp - 4], eax
call fcn.004aade0
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 1
call fcn.004ae7e0
test eax, eax
jne 0x46e054
push eax
push eax
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 2
call fcn.004b2200
jmp 0x46dff9
push 1
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x608]
push 0
mov byte [ebp - 4], 4
call fcn.004b2200
jmp 0x46e021
push 2
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x608]
push 0
mov byte [ebp - 4], 6
call fcn.004b2200
lea ecx, [ebp - 0x608]
call fcn.004ab670
jmp 0x46e06d
lea ecx, [ebp - 0x608]
call fcn.004ab670
jmp 0x46e06d
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x620], 0
mov esi, dword [ebp - 0x60c]
je 0x46e0e1
cmp dword [0x571500], 0
jne 0x46e0e1
push str.STOPPING_DRIVER
call fcn.004bb8b0
add esp, 4
push eax
push 0
push 0x180
push 0x651
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x18b
push 0x651
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
call esi
push 0
dec eax
push eax
push 0x197
push 0x651
push dword [ebp - 0x60c]
call esi
mov dword [ebp - 0x614], 0
nop dword [eax + eax]
xor esi, esi
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46e253
mov eax, dword [ebp - 0x2c]
cmp eax, 2
je 0x46e117
cmp eax, 3
je 0x46e117
cmp eax, 5
jne 0x46e12b
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc esi
cmp esi, 3
jl 0x46e0f2
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x614], 0
jne 0x46e156
cmp eax, 1
je 0x46e164
lea eax, [ebp - 0x30]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x46e164
mov dword [ebp - 0x614], 1
jmp 0x46e0f0
cmp eax, 1
je 0x46e164
cmp eax, 3
jne 0x46e253
cmp dword [ebp - 0x620], 0
je 0x46e1d1
cmp dword [0x571500], 0
jne 0x46e1d1
push str.REMOVING_DRIVER
call fcn.004bb8b0
mov esi, dword [ebp - 0x60c]
add esp, 4
push eax
push 0
push 0x180
push 0x651
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x18b
push 0x651
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
call esi
push 0
dec eax
push eax
push 0x197
push 0x651
push dword [ebp - 0x60c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x610]
xor edi, edi
call esi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x46e259
push 0xf01ff
push dword [ebp - 0x61c]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x46e259
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x46e26f
cmp dword [ebp - 0x620], eax
je 0x46e259
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x430
jne 0x46e259
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
push 0x3e8
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x620], edi
jmp 0x46df34
mov esi, dword [ebp - 0x610]
cmp dword [ebp - 0x618], 0
jne 0x46e299
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x424
jne 0x46e27b
mov dword [ebp - 0x618], 1
jmp 0x46e299
push dword [ebp - 0x60c]
call fcn.00417c00
push dword [ebp - 0x60c]
push str.DRIVER_UINSTALL_FAILED
call fcn.00419a00
add esp, 0xc
test edi, edi
je 0x46e2a8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
jmp 0x46e2ae
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x46e2b5
push esi
call edi
cmp dword [ebp - 0x618], 0
je 0x46e351
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x46e33a
push 0xf01ff
push dword [ebp - 0x61c]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x61c], eax
test edi, edi
jne 0x46e317
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x424
je 0x46e323
test edi, edi
je 0x46e31e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x61c]
call dword [sym.imp.KERNEL32.DLL_SetLastError]
test edi, edi
je 0x46e351
push dword [ebp - 0x60c]
push str.DRIVER_UINSTALL_FAILED
call fcn.00419a00
add esp, 8
xor eax, eax
jmp 0x46e357
mov eax, dword [ebp - 0x618]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret