Function at 0x1c0009878
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f], rax
and dword [rbp + 0xb], 0
lea r8, [rbp + 7]
and dword [rbp + 0x23], 0
xor eax, eax
and qword [rbp + 0xf], rax
xorps xmm0, xmm0
mov qword [rbp + 0x17], rcx
mov edx, 0x20019
lea rcx, [rbp - 0x19]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
xor ebx, ebx
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x47], eax
mov qword [0x1c00042a0], rax
mov qword [0x1c00042a8], rax
mov byte [0x1c00042b0], al
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x1c000997d
lea rdx, str.HyperVNonStandardVideoResolution
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x37]
lea r8d, [rbx + 2]
mov dword [rsp + 0x20], 0x14
lea rdx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop dword [rax + rax]
test edi, edi
js 0x1c000997d
cmp dword [rbp + 0x3b], 4
jne 0x1c0009978
cmp dword [rbp + 0x3f], 4
jne 0x1c0009978
mov ebx, dword [rbp + 0x43]
jmp 0x1c000997d
mov edi, 0xc0000001
mov byte [0x1c00042b0], 0
cmp ebx, 0xb
ja 0x1c0009a4f
je 0x1c0009a43
cmp ebx, 6
ja 0x1c00099ff
je 0x1c00099f3
sub ebx, 1
je 0x1c00099e7
sub ebx, 1
je 0x1c00099db
sub ebx, 1
je 0x1c00099cf
sub ebx, 1
je 0x1c00099c3
cmp ebx, 1
jne 0x1c0009a84
lea rax, [0x1c000b018]
jmp 0x1c0009af7
lea rax, [0x1c000b03c]
jmp 0x1c0009af7
lea rax, [0x1c000b038]
jmp 0x1c0009af7
lea rax, [0x1c000b040]
jmp 0x1c0009af7
lea rax, [0x1c000b008]
jmp 0x1c0009af7
lea rax, [0x1c000b034]
jmp 0x1c0009af7
sub ebx, 7
je 0x1c0009a37
sub ebx, 1
je 0x1c0009a2b
sub ebx, 1
je 0x1c0009a1f
cmp ebx, 1
jne 0x1c0009a84
lea rax, section.PAGEDATA
jmp 0x1c0009af7
lea rax, [0x1c000b044]
jmp 0x1c0009af7
lea rax, [0x1c000b01c]
jmp 0x1c0009af7
lea rax, [0x1c000b02c]
jmp 0x1c0009af7
lea rax, [0x1c000b014]
jmp 0x1c0009af7
sub ebx, 0xc
je 0x1c0009af0
sub ebx, 1
je 0x1c0009ae7
sub ebx, 1
je 0x1c0009ade
sub ebx, 1
je 0x1c0009ad5
sub ebx, 1
je 0x1c0009acc
sub ebx, 1
je 0x1c0009ac3
sub ebx, 1
je 0x1c0009aba
sub ebx, 1
je 0x1c0009ab1
cmp ebx, 1
je 0x1c0009aa8
lea rax, [0x1c000b050]
mov dword [0x1c00042a8], 0xd
mov dword [0x1c00042ac], 2
mov byte [0x1c00042b0], 1
jmp 0x1c0009b01
lea rax, [0x1c000b04c]
jmp 0x1c0009af7
lea rax, [0x1c000b00c]
jmp 0x1c0009af7
lea rax, [0x1c000b020]
jmp 0x1c0009af7
lea rax, [0x1c000b028]
jmp 0x1c0009af7
lea rax, [0x1c000b048]
jmp 0x1c0009af7
lea rax, [0x1c000b010]
jmp 0x1c0009af7
lea rax, [0x1c000b030]
jmp 0x1c0009af7
lea rax, [0x1c000b004]
jmp 0x1c0009af7
lea rax, [0x1c000b024]
mov dword [0x1c00042a8], 1
mov qword [0x1c00042a0], rax
mov eax, edi
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1c0001f70
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret