Function at 0x1077b01
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
xor esi, esi
push 0x1026700
mov dword [ebp - 4], esi
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x1077b2c
mov eax, SysStringLen
jmp 0x1077b76
push edi
push 0x10266f8
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x1077b44
mov eax, 0x80000000
jmp 0x1077b76
push edi
push 0x10266f0
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x1077b5c
mov eax, 0x80000001
jmp 0x1077b76
push edi
push 0x10266ec
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x1077d79
mov eax, SysStringLen
lea ecx, [ebp - 8]
push ecx
push 0x20019
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x1077ba2
push eax
push dword [ebp + 0xc]
push edi
push 0x10266d0
push 0x10266ac
jmp 0x1077d8a
mov ebx, dword [ebp + 0x10]
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1077baa
sub eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 4]
push ecx
push esi
neg eax
lea ecx, [ebp - 0xc]
push ecx
sbb eax, eax
push esi
and eax, ebx
push eax
push dword [ebp - 8]
call edi
cmp eax, esi
je 0x1077bda
cmp eax, 0xea
jne 0x1077bdf
cmp dword [ebp - 4], esi
ja 0x1077bf3
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x10266d0
push 0x1026684
jmp 0x1077c16
push dword [ebp - 4]
call sub.msvcrt.dll_malloc
mov esi, eax
test esi, esi
pop ecx
jne 0x1077c23
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push 0x10266d0
push 0x1026644
call fcn.01071ac0
add esp, 0x18
jmp 0x1077d6e
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
mov byte [esi], 0
push dword [ebp - 8]
call edi
test eax, eax
je 0x1077c57
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x10266d0
push 0x102661c
call fcn.01071ac0
jmp 0x1077d49
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1077caa
cmp dword [ebp - 0xc], 2
jne 0x1077caa
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push esi
call edi
test eax, eax
mov dword [ebp - 0x10], eax
jbe 0x1077d4e
push eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1077d2b
push dword [ebp - 0x10]
push ebx
push esi
call edi
test eax, eax
jbe 0x1077d2b
push esi
call sub.msvcrt.dll_free
pop ecx
mov esi, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2c
push esi
call sub.msvcrt.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x1077cc4
mov byte [eax], 0
push 0x3b
push esi
call sub.msvcrt.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x1077cd5
mov byte [eax], 0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1077cda
sub eax, edx
test esi, esi
je 0x1077d06
cmp byte [esi], 0x22
jne 0x1077d06
cmp byte [eax + esi - 1], 0x22
jne 0x1077d06
mov byte [eax + esi - 1], cl
dec eax
push eax
lea eax, [esi + 1]
push eax
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1077d27
test al, 0x10
jne 0x1077d27
push 0x5c
push esi
call sub.msvcrt.dll_strrchr
test eax, eax
pop ecx
pop ecx
je 0x1077d27
mov byte [eax], 0
mov eax, esi
jmp 0x1077d94
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x10266d0
push 0x10265f4
call fcn.01071ac0
push ebx
call sub.msvcrt.dll_free
add esp, 0x18
jmp 0x1077d67
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x10266d0
push 0x10265b8
call fcn.01071ac0
add esp, 0x14
push esi
call sub.msvcrt.dll_free
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1077d92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push 0x10266d0
push 0x1026588
call fcn.01071ac0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc