Function at 0x140004970
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1190
call fcn.140006cc0
sub rsp, rax
mov rax, qword [0x140012068]
xor rax, rsp
mov qword [rsp + 0x1180], rax
mov rdi, r9
movsxd r13, r8d
mov r14, rdx
mov qword [rsp + 0x90], rdx
mov rsi, rcx
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400049e4
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
lea r9, str.registerVBoxSVC:_aPid_u___x__n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [rsp + 0xe0], 2
mov dword [rsp + 0xe4], 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0x108], xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x138], xmm0
mov qword [rsp + 0x148], rax
call qword [sym.imp.VBoxRT.dll_RTSystemGetNtVersion]
movabs rcx, 0x60000000000000
cmp rax, rcx
jb 0x140004a6b
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerInqCallAttributesW]
mov ebx, eax
xor r15d, r15d
mov rcx, qword [rsp + 0x120]
jmp 0x140004a7c
mov rcx, r13
mov qword [rsp + 0x120], rcx
xor r15d, r15d
mov ebx, r15d
cmp r14, 0x1000
jb 0x140005308
movabs rax, 0xffff800000000000
test rax, r14
jne 0x140005308
cmp rdi, 0x1000
jb 0x140005308
test rax, rdi
jne 0x140005308
test ebx, ebx
jne 0x140005361
cmp rcx, r13
jne 0x1400052c1
mov qword [rdi], r15
lea rcx, [rsp + 0xc0]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCString::constructor_void____ptr64]
lea rbx, vtable.com::Utf8Str.0
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCString::constructor_void____ptr64]
mov qword [rsp + 0xa0], rbx
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xc0]
call fcn.140005870
test al, al
je 0x14000529d
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call fcn.140005c00
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140005296
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140004d22
mov r8, qword [rcx]
mov rdx, rdi
mov rax, qword [r8 + 0x18]
call qword [0x1400096a0]
mov edi, eax
test eax, eax
jns 0x140004b7f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x4c]
mov r12d, 0x8000000a
cmp eax, 0xea60
cmovb edi, r12d
jmp 0x140004b85
mov r12d, 0x8000000a
cmp edi, 0x800706ba
je 0x140004cd3
lea eax, [rdi + 0x7ff8f942]
cmp eax, 1
jbe 0x140004cd3
cmp edi, 0x80010108
je 0x140004cd3
test edi, edi
jns 0x140004d2b
mov r14, 0xffffffffffffffff
lea rcx, [rsi + 0x60]
call qword [sym.imp.VBoxRT.dll_RTCritSectLeave]
lock xadd dword [rsi + 0x58], r14d
cmp r14d, 1
jne 0x1400052a2
lea rcx, [rsi + 0x60]
call qword [sym.imp.VBoxRT.dll_RTCritSectDelete]
cmp qword [rsi + 0x40], 0
je 0x140004c88
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r14, rax
test rax, rax
je 0x140004c43
mov rcx, rsi
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov rbx, rax
lea rcx, [rsi + 0x20]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov ecx, dword [rsi + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea r9, str.i_unchooseTheOne:_Irregular_release_...__pid_d___x__user_s_sid_s__n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x140004c5d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400096a0]
mov qword [rsi + 0x40], r15
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x140004c88
lea r9, str.i_unchooseTheOne:_..._done._n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [rsi + 0x48], 0xffffffff
mov dword [rsi + 0x4c], r15d
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x140004cad
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400096a0]
mov qword [rsi + 0x40], r15
lea rcx, [rsi + 0x20]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
mov rcx, rsi
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
mov edx, 0x90
mov rcx, rsi
call fcn.14000669c
jmp 0x1400052a2
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x140004d02
mov dword [rsp + 0x20], edi
lea r9, str.registerVBoxSVC:_Seems_VBoxSVC_instance_died.__Dropping_it_and_letting_caller_take_over.__hrc_Rhrc__n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dl, 1
mov rcx, rsi
call fcn.140005fa0
jmp 0x140004d28
mov r12d, 0x8000000a
mov edi, r15d
cmp qword [rsi + 0x40], 0
jne 0x140004bb4
mov dword [rsp + 0x70], r15d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareOracleVirtualBoxVBoxSDS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400051e6
mov dword [rsp + 0x74], r15d
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.ServerSession0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400051d8
cmp dword [rsp + 0x74], 4
jne 0x1400051d8
cmp dword [rsp + 0x78], eax
je 0x1400051d8
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r15
call qword [sym.imp.ole32.dll_CoImpersonateClient]
mov edi, eax
test eax, eax
js 0x140005195
mov edi, 0x80004005
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x68]
mov edx, 0x201ef
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140004e8f
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140004e6d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x68], rax
mov edi, r15d
jmp 0x140004ec7
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x140004ec7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.registerVBoxSVC:_DuplicateTokenEx_failed:__ld_n
jmp 0x140004eaf
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x140004ec7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.registerVBoxSVC:_OpenThreadToken_failed:__ld_n
mov dword [rsp + 0x20], eax
mov r8d, 0x147
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
call qword [sym.imp.ole32.dll_CoRevertToSelf]
test edi, edi
js 0x1400051c4
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004f19
mov edi, 0x80004005
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x70]
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140004f76
cmp dword [rsp + 0x60], 4
jne 0x140004f42
mov edi, r15d
cmp dword [rsp + 0x70], 0
je 0x1400051c4
cmp dword [rsi + 0x48], 0xffffffff
je 0x140004fa6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x4c]
cmp eax, 0xea60
ja 0x140004fa6
mov edi, r12d
jmp 0x1400051c4
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400051c4
lea r9, str.registerVBoxSVC:_GetTokenInformation_return_value_has_invalid_size_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1400051c4
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x1400051c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.registerVBoxSVC:_GetTokenInformation_failed:__Rwc_n
mov rcx, rbx
jmp 0x1400051b3
mov dword [rsp + 0x8c], r15d
mov r9d, 4
lea r8, [rsp + 0x8c]
lea edx, [r9 + 8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x140005167
mov r14d, 0x1004
mov edx, r14d
lea rcx, [rsp + 0x170]
call qword [sym.imp.VBoxRT.dll_RTPathAppPrivateArch]
mov ebx, eax
test eax, eax
js 0x140005143
mov edx, r14d
lea rcx, [rsp + 0x170]
call qword [sym.imp.VBoxRT.dll_RTPathEnsureTrailingSeparator]
test rax, rax
je 0x14000511c
lea rcx, [rsp + 0x170]
add rcx, rax
sub r14, rax
lea r8, str.VBoxSVC.exe
mov rdx, r14
call qword [sym.imp.VBoxRT.dll_RTStrCopy]
mov ebx, eax
test eax, eax
js 0x140005143
lea rax, [rsp + 0x170]
mov qword [rsp + 0x150], rax
lea rax, str.__registervbox
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], r15
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x4000
mov r14, 0xffffffffffffffff
mov r8, r14
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x170]
call qword [sym.imp.VBoxRT.dll_RTProcCreateEx]
mov ebx, eax
test eax, eax
js 0x1400050d9
mov eax, dword [rsp + 0x7c]
mov dword [rsi + 0x48], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x4c], eax
mov edi, r12d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400051ed
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400051cb
mov dword [rsp + 0x20], ebx
lea r9, str.registerVBoxSVC:_Create_VBoxSVC_process_failed:__Rrc_n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400051ed
lea rcx, [rsp + 0xa0]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
mov eax, 0xffffff88
jmp 0x14000533e
lea rcx, [rsp + 0xa0]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
mov eax, ebx
jmp 0x14000533e
mov edi, 0x80004005
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x1400051c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.registerVBoxSVC:_SetTokenInformation_failed:__ld_n
mov rcx, rbx
jmp 0x1400051b3
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1400051c4
mov dword [rsp + 0x20], edi
lea r9, str.registerVBoxSVC:_CoImpersonateClient_failed:__Rhrc_n
mov rcx, rax
mov r8d, 0x147
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov r14, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400051ed
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, 0xffffffffffffffff
test edi, edi
js 0x140004bbb
cmp dword [rsp + 0x70], 0
jne 0x140004bbb
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rdi, rax
test rax, rax
je 0x140005258
lea rcx, [rsi + 0x20]
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
lea r9, str.registerVBoxSVC:_Making_aPid_u___x__the_chosen_one_for_user__s___s___n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x14000526e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400096a0]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
mov qword [rsi + 0x40], rcx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400096a0]
mov dword [rsi + 0x48], r13d
mov edi, r15d
jmp 0x140004bbb
mov edi, 0x8007000e
jmp 0x1400052a2
mov edi, 0x80004005
lea rcx, [rsp + 0xa0]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
jmp 0x14000530d
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x140005308
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
lea r9, str.registerVBoxSVC:_Client_PID_mismatch:_aPid_d___x___RPC_ClientPID_zd___zx__n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov edi, 0x80070057
mov ecx, 0x1470020
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x14000533c
mov dword [rsp + 0x20], edi
lea r9, str.VirtualBoxSDS::registerVBoxSVC:_returns__Rhrc_n
mov edx, 0x20
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, edi
mov rcx, qword [rsp + 0x1180]
xor rcx, rsp
call fcn.140006d20
add rsp, 0x1190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x1470010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x140005394
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
lea r9, str.registerVBoxSVC:_rcRpc_d___x___n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8d, 0x147
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov edi, 0x8000ffff
jmp 0x14000530d