Function at 0x655280
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c8
push ebx
push ebp
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
jne 0x6552ab
mov eax, 0x325
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x64
lea ecx, [esp + 0xf0]
call fcn.00652370
mov edx, 0x64
lea ecx, [esp + 0x88]
call fcn.00651f40
mov edx, 0x64
lea ecx, [esp + 0x158]
call fcn.006520a0
mov edx, 1
lea ecx, [esp + 0x18]
call fcn.006567f0
and dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
mov edx, 0x64
jne 0x655303
call fcn.00652200
jmp 0x655308
call fcn.006522f0
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x4d8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x6d0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1c0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x2c8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x106
lea eax, [esp + 0x6d4]
push eax
call esi
test eax, eax
je 0x655527
mov edx, 0x106
lea ecx, [esp + 0x1c0]
call fcn.0065aed0
cmp eax, ebx
jne 0x65552c
push 0x20a
lea ecx, [esp + 0x2cc]
push ecx
call esi
test eax, eax
je 0x655527
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6553a3
sub eax, edx
mov edx, eax
cmp edx, 1
jl 0x655527
cmp edx, 0x104
jg 0x655527
lea eax, [esp + 0x1c0]
mov byte [esp + edx + 0x2c8], 0x5c
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6553d6
sub eax, esi
cmp eax, 1
jl 0x655527
cmp eax, 0x104
jg 0x655527
lea ebp, [eax + edx]
lea ecx, [ebp + 1]
cmp ecx, 0x209
ja 0x655527
mov ecx, eax
lea edi, [esp + edx + 0x2c8]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x1c0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + ebp + 0x2c8], bl
mov ebp, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0xf8]
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00655120
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x6554a5
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x6554a5
push 1
mov edx, 0x1f4
lea ecx, [esp + 0x4dc]
call fcn.00656890
test eax, eax
jne 0x65549e
lea eax, [esp + 0x4d8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x655480
sub eax, edx
inc eax
push eax
lea ecx, [esp + 0x4dc]
push ecx
push 1
push ebx
push 0x6ba3e6
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x90]
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00655120
test eax, eax
jne 0x65551d
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x65551d
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6554d3
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x2cc]
push eax
push 1
push ebx
push 0x6ba3e6
push esi
call edi
lea eax, [esp + 0x20]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x6554f8
sub eax, ecx
inc eax
push eax
lea ecx, [esp + 0x24]
push ecx
push 1
push ebx
lea edx, [esp + 0x168]
push edx
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret