Function at 0x654290
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c8
push ebx
push ebp
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
jne 0x6542bb
mov eax, 0x325
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x64
lea ecx, [esp + 0xf0]
call fcn.00651380
mov edx, 0x64
lea ecx, [esp + 0x88]
call fcn.00650f50
mov edx, 0x64
lea ecx, [esp + 0x158]
call fcn.006510b0
mov edx, 1
lea ecx, [esp + 0x18]
call fcn.00655800
and dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
mov edx, 0x64
jne 0x654313
call fcn.00651210
jmp 0x654318
call fcn.00651300
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x4d8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x6d0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1c0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x2c8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x106
lea eax, [esp + 0x6d4]
push eax
call esi
test eax, eax
je 0x654537
mov edx, 0x106
lea ecx, [esp + 0x1c0]
call fcn.00659ee0
cmp eax, ebx
jne 0x65453c
push 0x20a
lea ecx, [esp + 0x2cc]
push ecx
call esi
test eax, eax
je 0x654537
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6543b3
sub eax, edx
mov edx, eax
cmp edx, 1
jl 0x654537
cmp edx, 0x104
jg 0x654537
lea eax, [esp + 0x1c0]
mov byte [esp + edx + 0x2c8], 0x5c
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6543e6
sub eax, esi
cmp eax, 1
jl 0x654537
cmp eax, 0x104
jg 0x654537
lea ebp, [eax + edx]
lea ecx, [ebp + 1]
cmp ecx, 0x209
ja 0x654537
mov ecx, eax
lea edi, [esp + edx + 0x2c8]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x1c0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + ebp + 0x2c8], bl
mov ebp, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0xf8]
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00654130
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x6544b5
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x6544b5
push 1
mov edx, 0x1f4
lea ecx, [esp + 0x4dc]
call fcn.006558a0
test eax, eax
jne 0x6544ae
lea eax, [esp + 0x4d8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x654490
sub eax, edx
inc eax
push eax
lea ecx, [esp + 0x4dc]
push ecx
push 1
push ebx
push 0x6b93e6
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x90]
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00654130
test eax, eax
jne 0x65452d
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x65452d
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6544e3
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x2cc]
push eax
push 1
push ebx
push 0x6b93e6
push esi
call edi
lea eax, [esp + 0x20]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x654508
sub eax, ecx
inc eax
push eax
lea ecx, [esp + 0x24]
push ecx
push 1
push ebx
lea edx, [esp + 0x168]
push edx
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret