Function at 0x40be70
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x59c]
sub esp, 0x61c
mov eax, dword [0x43c510]
xor eax, ebp
mov dword [ebp + 0x598], eax
push ebx
push esi
push edi
call dword [0x43c4f0]
mov ecx, dword [ebp + 0x5a4]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x5a8]
push eax
push ecx
lea edx, [ebp + 0x198]
push edx
call dword [sym.imp.MSVCR80.dll_vsprintf]
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.AcroBroker.log
lea ecx, [ebp - 0x70]
push 0x104
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
lea edx, [ebp - 0x70]
push 0x433014
push edx
call dword [sym.imp.MSVCR80.dll__wfopen]
mov edi, eax
add esp, 0x14
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jg 0x40bf38
lea eax, [esi + esi]
call fcn.0042fd60
mov ebx, esp
test ebx, ebx
je 0x40bf38
mov edx, dword [ebp - 0x7c]
push esi
push ebx
push 0xffffffffffffffff
lea ecx, [ebp + 0x198]
push ecx
push 0
push edx
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, ebx
jmp 0x40bf3a
xor eax, eax
push eax
push edi
call dword [sym.imp.MSVCR80.dll_fwprintf]
push edi
call dword [sym.imp.MSVCR80.dll_fclose]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_Acrobat9.0Private
push SysReAllocString
mov dword [ebp - 0x80], 0x400
mov dword [ebp - 0x78], 0
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x40bff8
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x78]
push edx
push 0
push 0
push str.bAlertOnUnexpectedWrites
push eax
call ebx
test eax, eax
jne 0x40bfee
cmp dword [ebp - 0x78], eax
je 0x40bfee
lea ecx, [ebp + 0x198]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jle 0x40bfbf
xor eax, eax
jmp 0x40bfdb
lea eax, [esi + esi]
call fcn.0042fd60
mov edx, dword [ebp - 0x7c]
mov eax, esp
push edx
push esi
lea ecx, [ebp + 0x198]
push ecx
push eax
call fcn.004093b0
push 0x10000
push str.AcroBroker:_Unexpected_Write_Warning__
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x78], 0
jne 0x40c092
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
push 0x432ee0
push SysReAllocString
call edi
test eax, eax
jne 0x40c092
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x78]
push edx
push eax
push eax
mov eax, dword [ebp - 0x74]
push str.bAlertOnUnexpectedWrites
push eax
call ebx
test eax, eax
jne 0x40c088
cmp dword [ebp - 0x78], eax
je 0x40c088
lea ecx, [ebp + 0x198]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jle 0x40c059
xor eax, eax
jmp 0x40c075
lea eax, [esi + esi]
call fcn.0042fd60
mov edx, dword [ebp - 0x7c]
mov eax, esp
push edx
push esi
lea ecx, [ebp + 0x198]
push ecx
push eax
call fcn.004093b0
push 0x10000
push str.AcroBroker:_Unexpected_Write_Warning__
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x598]
xor ecx, ebp
call fcn.0042fc34
add ebp, 0x59c
mov esp, ebp
pop ebp
ret