Function at 0x14002fc50
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x660
lea rbp, [rsp + 0x30]
mov rax, qword [0x14004b2a8]
xor rax, rbp
mov qword [rbp + 0x620], rax
mov rbx, rcx
lea rdi, [rbp + 0x668]
call fcn.14001fbe0
mov qword [rsp + 0x28], rdi
lea rdx, [rbp + 0x10]
xor edi, edi
mov r9, rbx
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax]
or rcx, 1
lea r8, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea rdx, [rbp + 0x410]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.AcroBroker.log
mov edx, 0x104
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [0x14003d5a0]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
mov rcx, 0xffffffffffffffff
lea rax, [rbp + 0x10]
inc rcx
cmp byte [rax + rcx], dil
jne 0x14002fd07
lea edx, [rcx + 1]
movabs r14, 0xffffffffffffff0
cmp edx, 0x3fffffff
jg 0x14002fd7e
movsxd rax, ecx
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14002fd3c
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039680
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14002fd7e
mov dword [rsp + 0x28], edx
lea r8, [rbp + 0x10]
xor edx, edx
mov word [rbx], di
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
jmp 0x14002fd81
mov rbx, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140030a30
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rbp + 8]
mov dword [rbp + 4], 0x400
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp], edi
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCPrivate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002fea3
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, str.bAlertOnUnexpectedWrites
lea rax, [rbp]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002fe99
cmp dword [rbp], edi
je 0x14002fe99
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x14002fe12
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14002fe7e
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14002fe3c
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039680
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14002fe7e
mov dword [rsp + 0x28], edx
lea r8, [rbp + 0x10]
xor edx, edx
mov word [rbx], di
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
jmp 0x14002fe81
mov rbx, rdi
mov r9d, 0x10000
lea r8, str.AcroBroker:_Unexpected_Write_Warning__
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp], edi
jne 0x14002ffaf
lea rax, [rbp + 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCPrivate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ffaf
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, str.bAlertOnUnexpectedWrites
lea rax, [rbp]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ffa5
cmp dword [rbp], edi
je 0x14002ffa5
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14002ff20
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14002ff8d
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14002ff4a
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039680
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14002ff8d
mov dword [rsp + 0x28], edx
lea r8, [rbp + 0x10]
xor edx, edx
mov word [rbx], di
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
mov rdi, rbx
mov r9d, 0x10000
lea r8, str.AcroBroker:_Unexpected_Write_Warning__
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x620]
xor rcx, rbp
call fcn.140039070
lea rsp, [rbp + 0x630]
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret