Function at 0x6556f0
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c8
push ebx
push ebp
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
jne 0x65571b
mov eax, 0x325
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x64
lea ecx, [esp + 0xf0]
call fcn.006527e0
mov edx, 0x64
lea ecx, [esp + 0x88]
call fcn.006523b0
mov edx, 0x64
lea ecx, [esp + 0x158]
call fcn.00652510
mov edx, 1
lea ecx, [esp + 0x18]
call fcn.00656c60
and dword [esp + 0x18], 1
lea ecx, [esp + 0x20]
mov edx, 0x64
jne 0x655773
call fcn.00652670
jmp 0x655778
call fcn.00652760
xor eax, eax
mov ecx, 0x7d
lea edi, [esp + 0x4d8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x6d0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x1c0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x2c8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x106
lea eax, [esp + 0x6d4]
push eax
call esi
test eax, eax
je 0x655997
mov edx, 0x106
lea ecx, [esp + 0x1c0]
call fcn.0065b340
cmp eax, ebx
jne 0x65599c
push 0x20a
lea ecx, [esp + 0x2cc]
push ecx
call esi
test eax, eax
je 0x655997
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x655813
sub eax, edx
mov edx, eax
cmp edx, 1
jl 0x655997
cmp edx, 0x104
jg 0x655997
lea eax, [esp + 0x1c0]
mov byte [esp + edx + 0x2c8], 0x5c
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x655846
sub eax, esi
cmp eax, 1
jl 0x655997
cmp eax, 0x104
jg 0x655997
lea ebp, [eax + edx]
lea ecx, [ebp + 1]
cmp ecx, 0x209
ja 0x655997
mov ecx, eax
lea edi, [esp + edx + 0x2c8]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x1c0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + ebp + 0x2c8], bl
mov ebp, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0xf8]
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00655590
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x655915
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x655915
push 1
mov edx, 0x1f4
lea ecx, [esp + 0x4dc]
call fcn.00656d00
test eax, eax
jne 0x65590e
lea eax, [esp + 0x4d8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6558f0
sub eax, edx
inc eax
push eax
lea ecx, [esp + 0x4dc]
push ecx
push 1
push ebx
push 0x6ba446
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x90]
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00655590
test eax, eax
jne 0x65598d
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x65598d
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x655943
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x2cc]
push eax
push 1
push ebx
push 0x6ba446
push esi
call edi
lea eax, [esp + 0x20]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x655968
sub eax, ecx
inc eax
push eax
lea ecx, [esp + 0x24]
push ecx
push 1
push ebx
lea edx, [esp + 0x168]
push edx
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x382
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret