Function at 0x419490
Capabilities:
Delete service
Query or enumerate registry value
Query service configuration
Set registry value

Disassembly:
sub esp, 0x9ac
mov eax, dword [0x4382c4]
xor eax, esp
mov dword [esp + 0x9a4], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x18c
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x2c], ebx
call fcn.00420f50
add esp, 0xc
push 0x7ff
lea ecx, [esp + 0x1b5]
push ebx
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x1bc], bl
call fcn.00420f50
add esp, 0xc
push 0xf003f
push ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
cmp ebp, ebx
jne 0x41951b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CTDIInstaller::UninstallDriver:OpenSCManager:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x419709
push 0xf01ff
push str.tdisvn
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
jne 0x419550
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CTDIInstaller::UninstallDriver:OpenService:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x4196f9
lea edx, [esp + 0x14]
push edx
push 0x800
lea eax, [esp + 0x1b8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x41958b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CTDIInstaller::UninstallDriver:QueryServiceConfig_hTcpip_:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x4196f9
mov esi, dword [esp + 0x1c4]
lea ecx, [esp + 0x18]
push ecx
push str.SYSTEMCurrentControlSetControlGroupOrderList
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
je 0x4195c3
push eax
push str.CTDIInstaller::UninstallDriver:RegOpenKey:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x4196f9
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push str.PNP_TDI
push edx
mov dword [esp + 0x2c], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x419607
push eax
push str.CTDIInstaller::UninstallDriver:RegQueryValueEx:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x4196ee
mov ecx, dword [esp + 0x14]
shr ecx, 2
mov eax, 1
cmp ecx, eax
mov dword [esp + 0x14], ecx
jbe 0x419656
jmp 0x419620
cmp dword [esp + eax*4 + 0x20], esi
je 0x41962f
add eax, 1
cmp eax, ecx
jb 0x419620
jmp 0x419656
sub ecx, eax
lea ecx, [ecx*4 - 4]
push ecx
lea edx, [esp + eax*4 + 0x28]
push edx
lea eax, [esp + eax*4 + 0x28]
push eax
call fcn.0041d730
mov ecx, dword [esp + 0x20]
add esp, 0xc
sub ecx, 1
mov dword [esp + 0x14], ecx
lea eax, [ecx*4]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [ecx - 1]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x24]
push edx
push ebx
push str.PNP_TDI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x419699
push eax
push str.CTDIInstaller::UninstallDriver:RegSetValueEx:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x4196ee
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4196dc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x430
je 0x4196ca
call esi
push eax
push str.CTDIInstaller::UninstallDriver:DeleteService:__d_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 8
jmp 0x4196ee
push str.Restart_Windows_to_changes_has_effect_n
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
push str.CTDIInstaller::UninstallDriver:Success
mov ecx, 0x43b48c
call fcn.0040a090
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x419706
push edi
call esi
push ebp
call esi
push str.CTDIInstaller::UninstallDriver:_cleanup
mov ecx, 0x43b48c
call fcn.0040a090
mov ecx, dword [esp + 0x9b8]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041aec3
add esp, 0x9ac
ret