Function at 0x140057890
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x60], rcx
mov ecx, 0x2000
mov r13, r9
mov qword [rsp + 0x48], r8
mov r14, rdx
mov qword [rsp + 0x58], rax
xor ebx, ebx
call fcn.14005c274
mov r15, rax
test rax, rax
jne 0x1400578ff
lea rdx, str.GetHidSdpRecords:_malloc_failed_n
lea ecx, [rbx + 1]
call fcn.140046d10
lea ebx, [r15 + 0xe]
jmp 0x140057b11
xor bpl, bpl
xor r12b, r12b
xor esi, esi
lea edi, [rsi + 1]
test r13, r13
je 0x140057914
test bpl, bpl
je 0x140057926
test r14, r14
je 0x140057ac2
test r12b, r12b
jne 0x140057ac2
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x68]
mov edx, esi
mov dword [rsp + 0x50], 0x20
mov dword [rsp + 0x40], 0x2000
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, eax
test eax, eax
jne 0x140057aa2
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x14005798e
lea rdx, str.GetHidSdpRecords:_ignore_SDP_record_with_wrong_length_n
lea ecx, [rax + 4]
call fcn.140046d10
jmp 0x140057a48
mov rcx, r15
call fcn.14005a294
test eax, eax
jne 0x1400579ec
test r13, r13
jne 0x1400579b5
lea rdx, str.GetHidSdpRecords:_Ignore_HID_record_n
mov ecx, 4
call fcn.140046d10
jmp 0x140057a48
test bpl, bpl
jne 0x140057a6c
mov rbp, qword [rsp + 0x58]
mov eax, dword [rsp + 0x40]
cmp dword [rbp], eax
jb 0x140057a54
mov r8d, eax
mov rdx, r15
mov rcx, r13
call fcn.14005bdf0
mov r11d, dword [rsp + 0x40]
mov dword [rbp], r11d
mov bpl, dil
jmp 0x140057a48
cmp eax, edi
jne 0x140057a34
test r14, r14
jne 0x1400579fe
lea rdx, str.GetHidSdpRecords:_Ignore_PNP_record_n
jmp 0x1400579a6
test r12b, r12b
jne 0x140057a99
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
cmp dword [rcx], eax
jb 0x140057a84
mov r8d, eax
mov rdx, r15
mov rcx, r14
call fcn.14005bdf0
mov rax, qword [rsp + 0x48]
mov r11d, dword [rsp + 0x40]
mov dword [rax], r11d
mov r12b, dil
jmp 0x140057a48
lea rdx, str.GetHidSdpRecords:_ignore_unknown_record__d_n
mov r8d, eax
mov ecx, 4
call fcn.140046d10
add esi, edi
cmp esi, 0x64
jae 0x140057ac2
jmp 0x14005790a
lea rdx, str.GetHidSdpRecords:_insufficient_buffer_for_HID_SDP_record_n
mov ecx, edi
call fcn.140046d10
mov ebx, 0x7a
jmp 0x140057b09
lea rdx, str.GetHidSdpRecords:_second_HID_record_n
mov ecx, edi
call fcn.140046d10
mov ebx, ntohl
jmp 0x140057b09
lea rdx, str.GetHidSdpRecords:_insufficient_buffer_for_PNP_SDP_record_n
mov ecx, edi
call fcn.140046d10
mov ebx, 0x7a
jmp 0x140057aba
lea rdx, str.GetHidSdpRecords:_error:_second_PNP_record_n
jmp 0x140057a73
cmp eax, 0x103
je 0x140057ac0
lea rdx, str.GetHidSdpRecords:_RegEnumValue_failed._err_d_n
mov r8d, eax
mov ecx, edi
call fcn.140046d10
test ebx, ebx
jne 0x140057b09
jmp 0x140057ac2
xor ebx, ebx
test r13, r13
je 0x140057ae6
test bpl, bpl
jne 0x140057ae6
lea rdx, str.GetHidSdpRecords:_HID_record_is_not_found_n
mov ecx, 4
call fcn.140046d10
mov r11, qword [rsp + 0x58]
and dword [r11], 0
test r14, r14
je 0x140057b09
test r12b, r12b
jne 0x140057b09
lea rdx, str.GetHidSdpRecords:_PNP_record_is_not_found_n
mov ecx, 4
call fcn.140046d10
mov rax, qword [rsp + 0x48]
and dword [rax], 0
mov rcx, r15
call fcn.14005c1e4
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14005ba20
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret