Function at 0x14008dd80
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x660
lea rbp, [rsp + 0x30]
mov rax, qword [0x14036aa00]
xor rax, rbp
mov qword [rbp + 0x620], rax
mov rbx, rcx
lea rdi, [rbp + 0x668]
call fcn.14007d320
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x28], rdi
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [rdi - 1]
lea rdx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea rdx, [rbp + 0x410]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.AcroBroker.log
mov edx, 0x104
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [0x1402bff10]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
lea rax, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], dil
jne 0x14008de37
lea edx, [rcx + 1]
movabs r14, 0xffffffffffffff0
cmp edx, 0x3fffffff
jle 0x14008de5a
mov rbx, rdi
jmp 0x14008deb6
movsxd rax, ecx
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14008de71
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1402b4ee0
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14008deb3
mov word [rbx], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
jmp 0x14008deb6
mov rbx, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14008eb80
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rbp + 4], 0x400
mov dword [rbp], edi
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCPrivate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008dfdd
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bAlertOnUnexpectedWrites
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008dfd3
cmp dword [rbp], eax
je 0x14008dfd3
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14008df47
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jle 0x14008df60
mov rbx, rdi
jmp 0x14008dfbb
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14008df76
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1402b4ee0
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14008dfb8
mov word [rbx], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
jmp 0x14008dfbb
mov rbx, rdi
mov r9d, 0x10000
lea r8, str.AcroBroker:_Unexpected_Write_Warning__
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp], 0
jne 0x14008e0ef
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCPrivate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008e0ef
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bAlertOnUnexpectedWrites
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008e0e5
cmp dword [rbp], eax
je 0x14008e0e5
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14008e060
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14008e0cd
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14008e08a
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1402b4ee0
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14008e0cd
mov word [rbx], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
mov rdi, rbx
mov r9d, 0x10000
lea r8, str.AcroBroker:_Unexpected_Write_Warning__
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x620]
xor rcx, rbp
call fcn.1402b48e0
lea rsp, [rbp + 0x630]
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret