Function at 0x140028538
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
xor r15d, r15d
lea rcx, [rbp + 0x48]
mov edi, r15d
mov rbx, r8
mov r14, rdx
call fcn.140017070
lea rdx, [0x1400aca54]
lea rcx, [rbp + 0x48]
call fcn.14000ee80
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferencesHME
lea rcx, [rbp + 0x48]
call fcn.14000ee80
lea rdx, [0x1400aca54]
lea rcx, [rbp + 0x48]
call fcn.14000ee80
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.14000ee80
mov rbx, qword [rbp + 0x48]
lea rax, [rbp - 8]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
mov qword [rbp - 8], r15
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov r12d, 0x80070000
test eax, eax
je 0x140028682
jg 0x1400285e9
mov edi, eax
jmp 0x1400285ef
movzx edi, ax
or edi, r12d
test edi, edi
jns 0x140028682
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.14000a900
lea rdx, [0x1400aca54]
lea rcx, [rbp + 0x48]
call fcn.14000ee80
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferencesHME
lea rcx, [rbp + 0x48]
call fcn.14000ee80
lea rdx, str.Default
lea rcx, [rbp + 0x48]
call fcn.14000ee80
mov rbx, qword [rbp + 0x48]
lea rax, [rbp - 8]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14002867f
jle 0x14002866d
movzx edi, ax
or edi, r12d
test edi, edi
jns 0x140028682
mov edi, r15d
mov dword [rsi], 1
jmp 0x14002892b
mov edi, r15d
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea r8, str.AccessPrivateContent
lea rax, [rbp + 0x48]
mov dword [rsi], r15d
mov qword [rsp + 0x28], rax
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r9d, r14d
mov qword [rsp + 0x20], r15
xor edx, edx
mov dword [rbp - 0x10], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x1400286d5
jg 0x1400286cf
mov edi, eax
jmp 0x1400286d5
movzx edi, ax
or edi, r12d
test edi, edi
js 0x140028881
cmp dword [rbp + 0x48], r15d
lea r8, str.ZeroStars
mov rcx, qword [rbp - 8]
mov eax, r15d
setne al
mov r9d, r14d
mov dword [rsi + 4], eax
xor edx, edx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x140028735
jg 0x140028727
mov edi, eax
jmp 0x14002872d
movzx edi, ax
or edi, r12d
test edi, edi
js 0x140028881
cmp dword [rbp + 0x48], r15d
lea r8, str.MinStars
mov rcx, qword [rbp - 8]
mov eax, r15d
setne al
mov r9d, r14d
mov dword [rsi + 0x10], eax
xor edx, edx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14002878d
jg 0x14002877f
mov edi, eax
jmp 0x140028785
movzx edi, ax
or edi, r12d
test edi, edi
js 0x140028881
mov eax, dword [rbp + 0x48]
lea r8, str.AllStars
mov rcx, qword [rbp - 8]
mov r9d, r14d
mov dword [rsi + 0xc], eax
xor edx, edx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x1400287de
jg 0x1400287d0
mov edi, eax
jmp 0x1400287d6
movzx edi, ax
or edi, r12d
test edi, edi
js 0x140028881
cmp dword [rbp + 0x48], r15d
lea r8, str.AllParentalRatings
mov rcx, qword [rbp - 8]
mov eax, r15d
setne al
mov r9d, r14d
mov dword [rsi + 8], eax
xor edx, edx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x140028832
jg 0x140028828
mov edi, eax
jmp 0x14002882e
movzx edi, ax
or edi, r12d
test edi, edi
js 0x140028881
cmp dword [rbp + 0x48], r15d
lea r8, str.ParentalRatingData
mov rcx, qword [rbp - 8]
mov eax, r15d
setne al
mov r9d, 8
mov dword [rsi + 0x14], eax
xor edx, edx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x140028881
jg 0x14002887b
mov edi, eax
jmp 0x140028881
movzx edi, ax
or edi, r12d
cmp dword [rsi + 0x14], r15d
jne 0x14002892b
test edi, edi
js 0x14002892b
mov ecx, dword [rbp - 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov qword [rsi + 0x20], rax
test rax, rax
jne 0x1400288b2
mov edi, 0x8007000e
jmp 0x14002892b
lea rcx, [rbp - 0x10]
mov r9d, 8
mov qword [rsp + 0x30], rcx
lea r8, str.ParentalRatingData
mov rcx, qword [rbp - 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x140028914
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rsi + 0x20], r15
test r14d, r14d
jg 0x140028909
mov edi, r14d
jmp 0x140028910
movzx edi, r14w
or edi, r12d
test edi, edi
js 0x14002892b
mov ecx, dword [rbp - 0x10]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 3
mov dword [rsi + 0x18], edx
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140028940
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rcx, [rbx - 0x18]
call fcn.14000ccd0
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret