Function at 0x40ca60
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x598]
sub esp, 0x618
mov eax, dword [0x443574]
xor eax, ebp
mov dword [ebp + 0x594], eax
mov ecx, dword [ebp + 0x5a0]
push ebx
push esi
push edi
lea eax, [ebp + 0x5a4]
push eax
push ecx
lea edx, [ebp + 0x194]
push edx
call dword [sym.imp.MSVCR90.dll_vsprintf]
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.AcroBroker.log
lea ecx, [ebp - 0x74]
push 0x104
push ecx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
lea edx, [ebp - 0x74]
push 0x4393b4
push edx
call dword [sym.imp.MSVCR90.dll__wfopen]
mov edi, eax
add esp, 0x14
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jg 0x40cb1a
lea eax, [esi + esi]
call fcn.004354c0
mov ebx, esp
test ebx, ebx
je 0x40cb1a
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp + 0x194]
xor ecx, ecx
push edx
push ecx
push 3
mov word [ebx], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, ebx
jmp 0x40cb1c
xor eax, eax
push eax
push edi
call dword [sym.imp.MSVCR90.dll_fwprintf]
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_Acrobat10.0Private
push SysReAllocString
mov dword [ebp - 0x80], 0x400
mov dword [ebp - 0x7c], 0
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cbd6
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x7c]
push edx
push 0
push 0
push str.bAlertOnUnexpectedWrites
push eax
call ebx
test eax, eax
jne 0x40cbcc
cmp dword [ebp - 0x7c], eax
je 0x40cbcc
lea ecx, [ebp + 0x194]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x40cb9f
xor eax, eax
jmp 0x40cbb9
lea eax, [esi + esi]
call fcn.004354c0
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x194]
push edx
push eax
call fcn.00409d50
push 0x10000
push str.AcroBroker:_Unexpected_Write_Warning__
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 0
jne 0x40cc6e
lea ecx, [ebp - 0x78]
push ecx
push 0x20019
push 0
push 0x439280
push SysReAllocString
call edi
test eax, eax
jne 0x40cc6e
mov ecx, dword [ebp - 0x78]
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push str.bAlertOnUnexpectedWrites
push ecx
call ebx
test eax, eax
jne 0x40cc64
cmp dword [ebp - 0x7c], eax
je 0x40cc64
lea edx, [ebp + 0x194]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x40cc37
xor eax, eax
jmp 0x40cc51
lea eax, [esi + esi]
call fcn.004354c0
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x194]
push ecx
push eax
call fcn.00409d50
push 0x10000
push str.AcroBroker:_Unexpected_Write_Warning__
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x594]
xor ecx, ebp
call fcn.0043539d
add ebp, 0x598
mov esp, ebp
pop ebp
ret