Function at 0x140002a70
Capabilities:
Accept command line arguments
Delete registry key
Delete service
Get token membership
Modify service
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, rcx
xor ecx, ecx
mov dword [rsp + 0x78], ecx
mov r13b, cl
mov byte [rsp + 0x61], cl
mov byte [rsp + 0x60], cl
lea r15d, [rcx + 0x20]
mov qword [0x140025318], rax
movzx esi, r15w
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [r15 - 0x1e]
mov dword [rsp + 0x20], 0xb
mov r14d, 0x200
lea r8, str.SPTD_setup_V_d._02d
mov r9d, edi
lea rcx, [0x140025110]
mov edx, r14d
mov rbx, rax
call fcn.1400012b0
lea rax, str.2004_2016
mov edx, r14d
lea r9, [0x140025110]
mov qword [rsp + 0x20], rax
lea r8, str._s__C___s_Duplex_Secure_Ltd
lea rcx, [0x140024cd0]
call fcn.1400012b0
lea ecx, [rdi + 0x20]
cmp word [rbx], cx
jne 0x140002b25
mov esi, ecx
add rbx, rdi
xor r14d, r14d
jmp 0x140002b32
cmp ax, si
je 0x140002b3a
add rbx, rdi
movzx eax, word [rbx]
test ax, ax
jne 0x140002b2a
cmp si, cx
jne 0x140002b4b
cmp word [rbx], cx
jne 0x140002c38
add rbx, rdi
movzx eax, word [rbx]
mov ecx, 9
test ax, ax
je 0x140002c5e
cmp ax, r15w
je 0x140002b67
cmp ax, cx
jne 0x140002b72
add rbx, rdi
movzx eax, word [rbx]
test ax, ax
jne 0x140002b5c
cmp word [rbx], r14w
je 0x140002c5e
mov r8d, 3
lea rdx, [0x14001f950]
mov rcx, rbx
call fcn.1400071a0
mov esi, 1
test eax, eax
jne 0x140002baa
mov r15d, esi
lea r12, [0x14001f958]
add rbx, 6
jmp 0x140002bd1
mov r8d, 6
lea rdx, str.remove
mov rcx, rbx
call fcn.1400071a0
test eax, eax
jne 0x140002c38
mov r15d, r14d
lea r12, str.from
add rbx, 0xc
movzx eax, word [rbx]
test ax, ax
je 0x140002c75
mov ecx, 0x20
lea edx, [rcx - 0x17]
cmp ax, cx
je 0x140002bf9
cmp ax, dx
jne 0x140002c38
cmp ax, cx
je 0x140002bf9
cmp ax, dx
jne 0x140002c04
add rbx, rdi
movzx eax, word [rbx]
test ax, ax
jne 0x140002bef
cmp word [rbx], r14w
je 0x140002c75
lea rdx, [0x14001fa68]
mov rcx, rbx
call fcn.1400051e8
test eax, eax
je 0x140002c30
lea rdx, [0x14001fa70]
mov rcx, rbx
call fcn.1400051e8
test eax, eax
jne 0x140002c38
mov dword [0x140024ee0], esi
jmp 0x140002c75
mov r9d, 0x40
lea r8, [0x140024cd0]
lea rdx, str.Usage:_sptdinst_action_nInstalls_uninstalls_SCSI_Pass_Through_Direct__SPTD__layer._nAction_must_be_add_or_remove_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 3
jmp 0x140003366
mov r15d, dword [rbp + 0x90]
mov esi, 1
mov r12, qword [rbp + 0x90]
mov dword [rsp + 0x78], esi
call fcn.1400014e0
test eax, eax
jne 0x140002ca2
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, [0x140024cd0]
lea rdx, str.This_platform_is_not_supported.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 7
jmp 0x140003366
lea rax, [rbp - 0x80]
mov dword [rsp + 0x68], r14d
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], r14d
mov r9d, 0x220
mov dword [rsp + 0x40], r14d
mov r8d, 0x20
mov dword [rsp + 0x38], r14d
mov dl, dil
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov word [rsp + 0x6c], 0x500
mov qword [rbp - 0x80], r14
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140003345
mov rdx, qword [rbp - 0x80]
lea r8, [rsp + 0x64]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp - 0x80]
neg eax
sbb edx, edx
and edx, dword [rsp + 0x64]
mov dword [rsp + 0x64], edx
test rcx, rcx
je 0x140002d2b
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [rsp + 0x64]
test edx, edx
je 0x140003345
call fcn.140001844
test eax, eax
je 0x140003310
mov rcx, qword [0x140024ed0]
or ebx, 0xffffffff
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x140003310
mov ebx, r14d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x140002d84
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, esi
cmp ebx, 5
jb 0x140002d5d
mov qword [0x140024ed8], r14
test r14, r14
jne 0x140002db6
lea r9d, [r14 + 0x10]
xor ecx, ecx
lea r8, [0x140024cd0]
lea rdx, str.Unable_to_open_service_manager.
call qword [sym.imp.USER32.dll_MessageBoxW]
lea edi, [r14 + 4]
xor r14d, r14d
jmp 0x140003233
lea rdx, [rsp + 0x70]
mov ecx, 0x10008
call fcn.140001ca8
xor r14d, r14d
test eax, eax
je 0x140002e7a
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov r9d, 0x10004
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x14001fb90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002e6f
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], r14
lea rdx, str.VolatileTest
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140002ee2
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
lea rdx, str.VolatileTest
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
lea rdx, [0x14001fb90]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x64]
lea rcx, [0x140024ef0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x140002eac
mov r9d, eax
lea r8, [rsp + 0x64]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x61]
call fcn.14000135c
mov r13b, byte [rsp + 0x61]
lea rcx, [rbp - 0x40]
call fcn.140001428
test eax, eax
je 0x140002f31
mov al, byte [rbp - 0x38]
mov cl, byte [rbp - 0x37]
mov byte [0x140024ee4], al
mov byte [0x140024ee5], cl
mov dword [0x140025538], esi
cmp r13b, al
ja 0x140002f31
jne 0x140002f46
mov dl, byte [rsp + 0x60]
cmp dl, cl
jbe 0x140002f46
jmp 0x140002f35
cmp eax, 0x3fd
jne 0x140002e52
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140024ee0], r14d
jne 0x140003233
mov r9d, 0x10
lea r8, [0x140024cd0]
lea rdx, str.You_must_reboot_after_previous_operation.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003233
mov dl, byte [rsp + 0x60]
mov al, r13b
mov byte [0x140024ee5], dl
mov byte [0x140024ee4], al
mov cl, dl
cmp al, dil
ja 0x14000320b
jne 0x140002f5a
cmp cl, 0xb
ja 0x14000320b
mov rcx, qword [0x140024ed8]
lea rdx, str.sptd
mov r8d, 0x10000
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [0x140025310], rax
test rax, rax
je 0x140002f9d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [0x140025310]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [0x140025310], r14
mov rcx, qword [0x140024ed8]
lea rdx, [0x14001f170]
mov r8d, 7
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [0x140025310], rax
test rax, rax
je 0x140002ff9
lea rcx, [rsp + 0x64]
mov r9d, 0x24
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x70]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140002ff9
mov eax, dword [0x140025538]
cmp dword [rbp - 0x6c], 4
cmove eax, esi
mov dword [0x140025538], eax
mov ebx, dword [rsp + 0x78]
test ebx, ebx
je 0x1400030c6
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x90]
lea r9, [0x140001e2c]
mov rcx, r14
lea edx, [r8 + 0x67]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, rdi
jne 0x14000303c
mov r15d, esi
lea r12, [0x14001f958]
jmp 0x1400030d6
cmp rax, rsi
jne 0x1400030bc
xor r15d, r15d
lea r12, str.from
mov ebx, 0x141
lea r9, str.remove
test r15d, r15d
jne 0x1400031b7
mov edi, 0x400
mov qword [rsp + 0x20], r12
lea r14, [0x140025540]
mov edx, edi
mov rcx, r14
lea r8, str.This_program_will__s_SCSI_Pass_Through_Direct__SPTD__layer__s_your_computer._n
call fcn.1400012b0
lea r8, str.WARNING___uninstallation_of_SPTD_will_cause_malfunction_of_any_application_that_depends_on_it__nAre_you_sure_you_want_to_remove_SPTD_from_this_machine_
mov edx, edi
mov rcx, r14
call fcn.1400011e8
mov r9d, ebx
lea r8, [0x140024cd0]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r14d, r14d
cmp eax, esi
je 0x140003143
lea edi, [r15 + 0xa]
jmp 0x140003233
mov edi, 0xa
jmp 0x140002dae
mov r14, qword [rbp + 0x90]
test r15d, r15d
je 0x14000304b
mov al, byte [0x140024ee4]
cmp al, dil
jne 0x140003125
cmp byte [0x140024ee5], 0xb
jne 0x140003129
cmp dword [0x140024ee0], 0
jne 0x140003129
test ebx, ebx
jne 0x140003129
mov r9d, 0x141
lea r8, [0x140024cd0]
lea rdx, str.Same_SPTD_version_is_already_installed__do_you_want_to_continue_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, esi
je 0x14000311f
xor r14d, r14d
jmp 0x140003230
mov al, byte [0x140024ee4]
test al, al
je 0x140003132
lea r9, str.update
jmp 0x140003139
lea r9, str.install
mov ebx, 0x41
jmp 0x140003057
lea rdx, [rbp + 0x90]
mov dword [rbp + 0x90], r14d
mov ecx, esi
call fcn.140001f30
mov edi, eax
test eax, eax
jne 0x140003233
mov rcx, qword [0x140025310]
test rcx, rcx
je 0x1400031a7
mov qword [rsp + 0x50], r14
lea rax, [0x140025320]
mov qword [rsp + 0x48], r14
lea r8d, [rdi + 4]
mov qword [rsp + 0x40], r14
mov r9d, esi
mov qword [rsp + 0x38], r14
mov edx, esi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea rcx, [0x140024ef0]
call fcn.14000737c
mov edi, esi
jmp 0x140003233
and qword [rsp + 0x20], 0
lea r9, [0x1400029a4]
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 0x68]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rcx, [rax + 1]
cmp rcx, rsi
jbe 0x1400031e5
lea edi, [rax - 1]
jmp 0x140002dae
mov r9d, 0x10
lea r8, [0x140024cd0]
lea rdx, str.Internal_error_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 9
jmp 0x140002dae
cmp dword [0x140024ee0], r14d
jne 0x140003230
mov r9d, 0x40
lea r8, [0x140024cd0]
lea rdx, str.Higher_SPTD_version_was_already_installed._Run_its_setup_for_maintenance.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, r14d
mov rcx, qword [0x140025310]
test rcx, rcx
je 0x14000324c
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [0x140025310], r14
mov rcx, qword [0x140024ed8]
test rcx, rcx
je 0x140003265
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [0x140024ed8], r14
cmp edi, esi
jne 0x1400032f2
lea rdx, [rsp + 0x70]
mov ecx, 4
call fcn.140001ca8
test eax, eax
je 0x1400032cd
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], r14
lea rdx, [0x14001fb90]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400032c2
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140024ee0], r14d
jne 0x1400032f2
mov r9d, 0x40
lea r8, [0x140024cd0]
lea rdx, str.You_need_to_reboot_for_changes_to_take_effect.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [0x140024ed0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x140024ed0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140003366
mov r9d, 0x10
lea r8, [0x140024cd0]
lea rdx, str.Unable_to_initialize_setup.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [0x140024ed0]
test rcx, rcx
je 0x14000333e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 9
jmp 0x140003366
mov r9d, 0x10
lea r8, [0x140024cd0]
lea rdx, str.You_need_local_administrator_privileges.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 8
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret