Function at 0x1800a7380
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x4ae8]
mov eax, 0x4be8
call fcn.18010fc30
sub rsp, rax
mov rax, qword [0x180212a58]
xor rax, rsp
mov qword [rbp + 0x4ac0], rax
mov ebx, edx
lea rax, [rsp + 0x40]
lea rdx, str.VBoxSDS
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, [rbp + 0xc0]
mov rsi, rcx
call fcn.1800a6ff0
mov edi, eax
test eax, eax
js 0x1800a74c2
mov ecx, 0x1460010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov edi, dword [rsp + 0x40]
test rax, rax
je 0x1800a7434
mov dword [rsp + 0x38], edi
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x30], rcx
lea r9, str._Rfn:__M
lea rcx, str.VBoxSDS_service_is_running_under_the__ls_account_with_start_type__u._n
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x28], rcx
mov r8d, 0x146
lea rcx, str.long___cdecl_VirtualBoxClient::i_investigateVirtualBoxObjectCreationFailure_long_
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
lea rdx, str.LocalSystem
lea rcx, [rbp + 0xc0]
call qword [sym.imp.VBoxRT.dll_RTUtf16Cmp]
test eax, eax
je 0x1800a7486
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r8, str.VBoxSDS_is_misconfigured_to_run_under_the__ls_account_instead_of_the_SYSTEM_one._nReinstall_VirtualBox_to_fix_it.__Alternatively_you_can_fix_it_using_the_Windows_Service_Control_Manager_or_by_running_sc_config_VBoxSDS_objLocalSystem_on_a_command_line.
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
call fcn.1800c7fc0
lea r9, [rbp + 0xc0]
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a3e
cmp edi, 4
jne 0x1800a7541
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r8, str.The_VBoxSDS_windows_service_is_disabled._nReinstall_VirtualBox_to_fix_it.__Alternatively_try_reenable_the_service_by_setting_it_to__Manual_startup_type_in_the_Windows_Service_management_console__or_by_runing_sc_config_VBoxSDS_startdemand_on_the_command_line.
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
call fcn.1800c7fc0
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a3e
cmp edi, 0xffffffb2
jne 0x1800a74fa
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r8, str.The_VBoxSDS_windows_service_was_not_found._nReinstall_VirtualBox_to_fix_it.__Alternatively_you_can_try_start_VirtualBox_as_Administrator__this_should_automatically_reinstall_the_service__or_you_can_run_VBoxSDS.exe___regservice_command_from_an_elevated_Administrator_command_line.
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
call fcn.1800c7fc0
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a3e
mov ecx, 0x1460010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800a7541
lea rcx, str.VirtualBoxClient::i_getServiceAccount_failed:__Rrc_n
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rcx
lea r9, str._Rfn:__M
lea rcx, str.long___cdecl_VirtualBoxClient::i_investigateVirtualBoxObjectCreationFailure_long_
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rcx
mov r8d, 0x146
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x4c20], r12
xor r12d, r12d
mov qword [rsp + 0x20], rax
lea r9, [0x1801cb498]
mov qword [rsp + 0x50], r12
xor edx, edx
lea rcx, [0x1801c59b8]
lea r8d, [r12 + 4]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
jns 0x1800a75db
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
cmp eax, ebx
jne 0x1800a75b6
lea r8, str.Completely_failed_to_instantiate_CLSID_VirtualBox:__Rhrc
call fcn.1800c7fc0
mov r9d, ebx
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a36
lea r8, str.Completely_failed_to_instantiate_CLSID_VirtualBox:__Rhrc___Rhrc
call fcn.1800c7fc0
mov r9d, ebx
mov dword [rsp + 0x20], edi
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a36
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
lea rdx, [0x1801c5408]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x18000f288.0]
test eax, eax
js 0x1800a7653
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000f288.0]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000f288.0]
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r8, str.Failed_to_instantiate_CLSID_VirtualBox_the_first_time__but_worked_when_checking_out_why_..._weird
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
call fcn.1800c7fc0
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a36
lea rax, [rsp + 0x60]
mov qword [rsp + 0x4bd8], r14
mov r9d, 0x20009
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x4bd0], r15
lea rdx, str.CLSID00020420_0000_0000_C000_000000000046InprocServer32
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800a7a12
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp + 0xac0]
mov dword [rsp + 0x4c], 0x3ffe
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.InprocServer32
mov dword [rsp + 0x40], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1800a79b2
mov eax, dword [rsp + 0x4c]
and rax, 0xfffffffffffffffe
cmp rax, 0x4000
jae 0x1800a7a5f
lea rdx, str.MsiDecomposeDescriptorW
mov word [rbp + rax + 0xac0], r12w
lea rcx, str.msi.dll
call qword [sym.imp.VBoxRT.dll_RTLdrGetSystemSymbol]
test rax, rax
je 0x1800a7994
mov ecx, dword [rsp + 0x40]
cmp ecx, 1
je 0x1800a7725
cmp ecx, 7
jne 0x1800a7994
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0xffffffff
xor ecx, ecx
lea r9, [rbp - 0x20]
mov qword [rbp - 0x30], rcx
lea r8, [rbp + 0x50]
mov dword [rbp - 0x28], ecx
lea rdx, [rsp + 0x70]
mov word [rbp - 0x24], cx
mov qword [rbp + 0xb0], rcx
mov dword [rbp + 0xb8], ecx
mov word [rbp + 0xbc], cx
mov qword [rbp + 0x40], rcx
mov dword [rbp + 0x48], ecx
mov word [rbp + 0x4c], cx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xac0]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
call qword [case.0x18000f288.0]
test eax, eax
jne 0x1800a7994
lea rdx, str.MsiOpenProductW
lea rcx, str.msi.dll
call qword [sym.imp.VBoxRT.dll_RTLdrGetSystemSymbol]
lea rdx, str.MsiCloseHandle
mov rdi, rax
lea rcx, str.msi.dll
call qword [sym.imp.VBoxRT.dll_RTLdrGetSystemSymbol]
lea rdx, str.MsiGetProductPropertyW
mov r15, rax
lea rcx, str.msi.dll
call qword [sym.imp.VBoxRT.dll_RTLdrGetSystemSymbol]
mov r14, rax
test rax, rax
je 0x1800a7956
test r15, r15
je 0x1800a7956
test rdi, rdi
je 0x1800a7956
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], r12d
lea rcx, [rsp + 0x70]
mov rax, rdi
call qword [case.0x18000f288.0]
test eax, eax
jne 0x1800a7956
mov qword [rsp + 0x4be0], r13
mov edi, r12d
lea r13, str.InstalledProductName
nop dword [rax]
mov ecx, dword [rsp + 0x44]
lea r9, [rsp + 0x48]
mov edx, edi
lea r8, [rbp + 0x2c0]
mov rax, r14
mov dword [rsp + 0x48], 0x3ff
mov rdx, qword [r13 + rdx*8]
call qword [case.0x18000f288.0]
inc edi
cmp edi, 3
jae 0x1800a78b1
test eax, eax
jne 0x1800a7870
mov eax, dword [rsp + 0x48]
add eax, 0xfffffffe
cmp eax, 0x3fd
ja 0x1800a7870
mov ecx, dword [rsp + 0x44]
mov rax, r15
call qword [case.0x18000f288.0]
mov r13, qword [rsp + 0x4be0]
test eax, eax
jne 0x1800a7956
mov eax, dword [rsp + 0x48]
cmp eax, 2
jb 0x1800a7956
cmp eax, 0x3ff
ja 0x1800a78ef
add rax, rax
cmp rax, 0x800
jae 0x1800a7a59
jmp 0x1800a78f4
mov eax, 0x7fe
xor r9d, r9d
mov word [rbp + rax + 0x2c0], r12w
lea r8, str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__but_CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_broken_by_the__ls___ls__program__suspecting_that_it_features_the_broken_oleaut32.msm_module_as_component__ls._n_nWe_suggest_you_try_uninstall__ls._n_nSee_also_https:__support.microsoft.com_en_us_kb_316911
mov qword [rsp + 0x20], 0xffffffffffffffff
lea rdx, str.VirtualBoxClientWrap
xor ecx, ecx
call fcn.1800c7fc0
mov r8, rax
lea r9, [rbp + 0x2c0]
lea rax, [rbp + 0x2c0]
mov edx, ebx
mov qword [rsp + 0x30], rax
mov rcx, rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.180012db0
jmp 0x1800a7a07
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r8, str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_broken_by_installer__ls_featuring_the_broken_oleaut32.msm_module_as_component__ls._n_nSee_also_https:__support.microsoft.com_en_us_kb_316911
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
call fcn.1800c7fc0
mov r8, rax
lea r9, [rsp + 0x70]
lea rax, [rbp - 0x20]
mov edx, ebx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180012db0
jmp 0x1800a7a07
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
xor ecx, ecx
lea r8, str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_broken_by_some_installer_featuring_the_broken_oleaut32.msm_module_as_a_component._n_nSee_also_https:__support.microsoft.com_en_us_kb_316911
lea rdx, str.VirtualBoxClientWrap
jmp 0x1800a79d3
xor r9d, r9d
mov qword [rsp + 0x20], 0xffffffffffffffff
xor ecx, ecx
lea rdx, str.VirtualBoxClientWrap
cmp edi, 2
jne 0x1800a79e7
lea r8, str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__but_CLSID_VirtualBox_w__IUnknown_works._nPSDispatch_looks_fine._Weird
call fcn.1800c7fc0
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
jmp 0x1800a7a07
lea r8, str.Failed_to_instantiate_CLSID_VirtualBox_w__IVirtualBox__but_CLSID_VirtualBox_w__IUnknown_works._nChecking_out_PSDispatch_registration_ended_with_error:__u___x_
call fcn.1800c7fc0
mov r8, rax
mov dword [rsp + 0x20], edi
mov r9d, edi
mov edx, ebx
mov rcx, rsi
call fcn.180012db0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000f288.0]
mov r14, qword [rsp + 0x4bd8]
mov eax, ebx
mov r15, qword [rsp + 0x4bd0]
mov r12, qword [rsp + 0x4c20]
mov rcx, qword [rbp + 0x4ac0]
xor rcx, rsp
call fcn.18010fb80
add rsp, 0x4be8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010fda4
int3
call fcn.18010fda4
int3