Function at 0x1400303a0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x660
lea rbp, [rsp + 0x30]
mov rax, qword [0x14004d2c0]
xor rax, rbp
mov qword [rbp + 0x620], rax
mov rbx, rcx
lea rdi, [rbp + 0x668]
call fcn.14001f710
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x28], rdi
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [rdi - 1]
lea rdx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea rdx, [rbp + 0x410]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.AcroBroker.log
mov edx, 0x104
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [0x14003e580]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
lea rax, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], dil
jne 0x140030457
lea edx, [rcx + 1]
movabs r14, 0xffffffffffffff0
cmp edx, 0x3fffffff
jle 0x14003047a
mov rbx, rdi
jmp 0x1400304d6
movsxd rax, ecx
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140030491
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039e40
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400304d3
mov word [rbx], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
jmp 0x1400304d6
mov rbx, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.1400311a0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rbp + 4], 0x400
mov dword [rbp], edi
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCPrivate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400305fd
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bAlertOnUnexpectedWrites
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400305f3
cmp dword [rbp], eax
je 0x1400305f3
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140030567
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jle 0x140030580
mov rbx, rdi
jmp 0x1400305db
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140030596
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039e40
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400305d8
mov word [rbx], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
jmp 0x1400305db
mov rbx, rdi
mov r9d, 0x10000
lea r8, str.AcroBroker:_Unexpected_Write_Warning__
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp], 0
jne 0x14003070f
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCPrivate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003070f
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bAlertOnUnexpectedWrites
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140030705
cmp dword [rbp], eax
je 0x140030705
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140030680
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400306ed
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400306aa
mov rcx, r14
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140039e40
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400306ed
mov word [rbx], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
mov rdi, rbx
mov r9d, 0x10000
lea r8, str.AcroBroker:_Unexpected_Write_Warning__
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x620]
xor rcx, rbp
call fcn.140039850
lea rsp, [rbp + 0x630]
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret