Function at 0x1000ca50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4b78
call fcn.10013bb0
mov eax, dword [0x1002ed28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x4b60]
mov edi, ecx
push eax
push 0x100
lea eax, [ebp - 0x354]
push eax
push str.VBoxSDS
call fcn.1000c750
mov esi, eax
test esi, esi
js 0x1000cb5f
push 0x1460010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
mov esi, dword [ebp - 0x4b60]
add esp, 4
test eax, eax
je 0x1000cad2
push esi
lea ecx, [ebp - 0x354]
push ecx
push str.VBoxSDS_service_is_running_under_the__ls_account_with_start_type__u._n
push str.long___thiscall_VirtualBoxClient::i_investigateVirtualBoxObjectCreationFailure_long_
push str._Rfn:__M
push 0x146
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
lea eax, [ebp - 0x354]
push str.LocalSystem
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16Cmp]
add esp, 8
test eax, eax
je 0x1000cb26
push 0xffffffffffffffff
push 0
push str.VBoxSDS_is_misconfigured_to_run_under_the__ls_account_instead_of_the_SYSTEM_one._nReinstall_VirtualBox_to_fix_it.__Alternatively_you_can_fix_it_using_the_Windows_Service_Control_Manager_or_by_running_sc_config_VBoxSDS_objLocalSystem_on_a_command_line.
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
lea ecx, [ebp - 0x354]
push ecx
push eax
push dword [ebp + 8]
push edi
call fcn.10008d20
add esp, 0x24
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013960
mov esp, ebp
pop ebp
ret 4
cmp esi, 4
jne 0x1000cba2
push 0xffffffffffffffff
push 0
push str.The_VBoxSDS_windows_service_is_disabled._nReinstall_VirtualBox_to_fix_it.__Alternatively_try_reenable_the_service_by_setting_it_to__Manual_startup_type_in_the_Windows_Service_management_console__or_by_runing_sc_config_VBoxSDS_startdemand_on_the_command_line.
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
push eax
push dword [ebp + 8]
push edi
call fcn.10008d20
add esp, 0x20
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013960
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xffffffb2
jne 0x1000cb6f
push 0xffffffffffffffff
push 0
push str.The_VBoxSDS_windows_service_was_not_found._nReinstall_VirtualBox_to_fix_it.__Alternatively_you_can_try_start_VirtualBox_as_Administrator__this_should_automatically_reinstall_the_service__or_you_can_run_VBoxSDS.exe___regservice_command_from_an_elevated_Administrator_command_line.
jmp 0x1000cb34
push 0x1460010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x1000cba2
push esi
push str.VirtualBoxClient::i_getServiceAccount_failed:__Rrc_n
push str.long___thiscall_VirtualBoxClient::i_investigateVirtualBoxObjectCreationFailure_long_
push str._Rfn:__M
push 0x146
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
push ebx
lea eax, [ebp - 0x4b5c]
mov dword [ebp - 0x4b5c], 0
push eax
push 0x100264bc
push 4
push 0
push 0x10026374
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
jns 0x1000cc3a
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
cmp ebx, esi
jne 0x1000cc09
push str.Completely_failed_to_instantiate_CLSID_VirtualBox:__Rhrc
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
push esi
push eax
push esi
push edi
call fcn.10008d20
add esp, 0x24
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013960
mov esp, ebp
pop ebp
ret 4
push str.Completely_failed_to_instantiate_CLSID_VirtualBox:__Rhrc___Rhrc
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
push ebx
push esi
push eax
push esi
push edi
call fcn.10008d20
add esp, 0x28
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013960
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x4b5c]
mov eax, dword [ecx]
mov esi, dword [eax]
lea eax, [ebp - 0x4b74]
push eax
push 0x100262d4
push ecx
mov ecx, esi
call dword [0x1002029c]
call esi
test eax, eax
js 0x1000ccc0
mov eax, dword [ebp - 0x4b74]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1002029c]
call esi
mov eax, dword [ebp - 0x4b5c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1002029c]
call esi
push 0xffffffffffffffff
push 0
push str.Failed_to_instantiate_CLSID_VirtualBox_the_first_time__but_worked_when_checking_out_why_..._weird
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
push eax
push dword [ebp + 8]
push edi
call fcn.10008d20
add esp, 0x20
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013960
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x4b70]
push eax
push 0x20009
push 0
push str.CLSID00020420_0000_0000_C000_000000000046InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x1000cfe2
lea eax, [ebp - 0x4b68]
mov dword [ebp - 0x4b68], 0x3ffe
push eax
lea eax, [ebp - 0x4b54]
mov dword [ebp - 0x4b6c], 0
push eax
lea eax, [ebp - 0x4b6c]
push eax
push 0
push str.InprocServer32
push dword [ebp - 0x4b70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000cf8a
mov eax, dword [ebp - 0x4b68]
and eax, 0xfffffffe
cmp eax, 0x4000
jae 0x1000d00d
xor ecx, ecx
push str.MsiDecomposeDescriptorW
push str.msi.dll
mov word [ebp + eax - 0x4b54], cx
call dword [sym.imp.VBoxRT_x86.dll_RTLdrGetSystemSymbol]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000cf68
mov ecx, dword [ebp - 0x4b6c]
cmp ecx, 1
je 0x1000cd7c
cmp ecx, 7
jne 0x1000cf68
push 0x6e
lea eax, [ebp - 0x74]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x6e
lea eax, [ebp - 0x154]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x6e
lea eax, [ebp - 0xe4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x4b78], 0xffffffff
lea eax, [ebp - 0x4b78]
mov ecx, esi
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x4b54]
push eax
call dword [0x1002029c]
call esi
test eax, eax
jne 0x1000cf68
push str.MsiOpenProductW
push str.msi.dll
call dword [sym.imp.VBoxRT_x86.dll_RTLdrGetSystemSymbol]
push str.MsiCloseHandle
push str.msi.dll
mov esi, eax
call dword [sym.imp.VBoxRT_x86.dll_RTLdrGetSystemSymbol]
push str.MsiGetProductPropertyW
push str.msi.dll
mov dword [ebp - 0x4b60], eax
call dword [sym.imp.VBoxRT_x86.dll_RTLdrGetSystemSymbol]
add esp, 0x18
mov dword [ebp - 0x4b58], eax
test eax, eax
je 0x1000cf52
cmp dword [ebp - 0x4b60], 0
je 0x1000cf52
test esi, esi
je 0x1000cf52
lea eax, [ebp - 0x4b64]
mov dword [ebp - 0x4b64], 0
push eax
lea eax, [ebp - 0x74]
mov ecx, esi
push eax
call dword [0x1002029c]
call esi
test eax, eax
jne 0x1000cf52
mov ebx, dword [ebp - 0x4b58]
xor esi, esi
nop word [eax + eax]
lea eax, [ebp - 0x4b58]
mov dword [ebp - 0x4b58], 0x3ff
push eax
lea eax, [ebp - 0xb54]
mov ecx, ebx
push eax
push dword [esi + 0x10021f7c]
push dword [ebp - 0x4b64]
call dword [0x1002029c]
call ebx
add esi, 4
cmp esi, 0xc
jae 0x1000ceca
test eax, eax
jne 0x1000ce80
mov eax, dword [ebp - 0x4b58]
add eax, 0xfffffffe
cmp eax, 0x3fd
ja 0x1000ce80
push dword [ebp - 0x4b64]
mov ebx, dword [ebp - 0x4b60]
mov ecx, ebx
call dword [0x1002029c]
call ebx
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x1000cf52
mov ecx, dword [ebp - 0x4b58]
cmp ecx, 2
jb 0x1000cf52
mov eax, 0x3ff
cmp ecx, eax
cmovbe eax, ecx
add eax, eax
cmp eax, 0x800
jae 0x1000d00d
xor ecx, ecx
mov word [ebp + eax - 0xb54], cx
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xb54]
push eax
push 0xffffffffffffffff
push ecx
push str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__but_CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_broken_by_the__ls___ls__program__suspecting_that_it_features_the_broken_oleaut32.msm_module_as_component__ls._n_nWe_suggest_you_try_uninstall__ls._n_nSee_also_https:__support.microsoft.com_en_us_kb_316911
push str.VirtualBoxClientWrap
push ecx
call fcn.1000f6b0
add esp, 0x14
push eax
push ebx
push edi
call fcn.10008d20
add esp, 0x1c
jmp 0x1000cfd6
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
push 0
push str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_broken_by_installer__ls_featuring_the_broken_oleaut32.msm_module_as_component__ls._n_nSee_also_https:__support.microsoft.com_en_us_kb_316911
jmp 0x1000cfbc
push 0xffffffffffffffff
push 0
push str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_broken_by_some_installer_featuring_the_broken_oleaut32.msm_module_as_a_component._n_nSee_also_https:__support.microsoft.com_en_us_kb_316911
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
push eax
push ebx
push edi
call fcn.10008d20
add esp, 0x20
jmp 0x1000cfd6
cmp eax, 2
jne 0x1000cfb1
push 0xffffffffffffffff
push 0
push str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__but_CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_fine._Weird
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
push eax
push ebx
push edi
call fcn.10008d20
add esp, 0x20
jmp 0x1000cfd6
push eax
push eax
push 0xffffffffffffffff
push 0
push str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__but_CLSID_VirtualBox_w__IUnknown_works._nChecking_out_PSDispatch_registration_ended_with_error:__u___x_
push str.VirtualBoxClientWrap
push 0
call fcn.1000f6b0
add esp, 0x14
push eax
push ebx
push edi
call fcn.10008d20
add esp, 0x14
push dword [ebp - 0x4b70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x4b5c]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x1002029c]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.10013960
mov esp, ebp
pop ebp
ret 4
call fcn.10013acd
int3