Function at 0xa511b0
Capabilities:
Get file size
Read file on windows
Read file via mapping
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa8eb5c
push eax
mov dword fs:[0], esp
sub esp, 0x6f8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x71c]
test edi, edi
je 0xa51289
push edi
call fcn.00a7e07a
mov esi, eax
add esp, 4
cmp esi, 0x7ffffffd
jbe 0xa511f6
call fcn.00a7d9b1
mov ecx, dword [0xaf53c4]
test ecx, ecx
je 0xa51223
mov al, byte [ecx - 1]
test al, al
je 0xa51223
cmp al, 0xff
je 0xa51223
test esi, esi
jne 0xa5124f
mov dl, al
push esi
dec dl
mov byte [ecx - 1], dl
mov ecx, 0xaf53c0
call fcn.009f6b50
jmp 0xa51289
test esi, esi
jne 0xa51235
push 1
mov ecx, 0xaf53c0
call fcn.009f6b50
jmp 0xa51289
mov eax, dword [0xaf53cc]
cmp eax, 0x1f
ja 0xa51243
cmp eax, esi
jae 0xa51260
push 1
mov ecx, 0xaf53c0
call fcn.009f6b50
push esi
mov ecx, 0xaf53c0
call fcn.009f83a0
mov ecx, dword [0xaf53c4]
test esi, esi
mov eax, edi
jbe 0xa5127d
sub ecx, edi
mov edx, esi
mov di, word [eax]
mov word [ecx + eax], di
add eax, 2
dec edx
jne 0xa5126a
mov ecx, dword [0xaf53c4]
mov dword [0xaf53c8], esi
mov word [ecx + esi*2], 0
mov ebp, dword [esp + 0x718]
push 0
push 0
push 0
push ebp
mov dword [0xaf53b8], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [0xaf53b8]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x40]
push 0x3c
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xa51751
cmp dword [esp + 0x14], 0x3c
jne 0xa51751
cmp dword [esp + 0x38], 0x8fff7285
jne 0xa51751
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edx, dword [esp + 0x10]
push edx
call fcn.00a7e07a
mov esi, eax
inc esi
push esi
call fcn.009ef380
add esp, 8
mov dword [0xaf53b4], eax
push 0
push 0
push esi
push eax
mov eax, dword [esp + 0x20]
or esi, 0xffffffff
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0xaf53b4]
mov dword [0xaf53b0], eax
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor bl, bl
test eax, eax
jne 0xa51363
mov edx, dword [0xaf53b4]
mov bl, 1
push edx
push 0x58
push eax
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
je 0xa51751
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test bl, bl
mov dword [0xaf53e4], eax
jne 0xa513de
mov ecx, dword [eax + 4]
mov ebx, 0xf00f00
cmp ecx, ebx
je 0xa5139b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
mov eax, dword [0xaf53e4]
cmp dword [eax + 4], ebx
jne 0xa5138d
lea ecx, [esp + 0x1c]
mov dword [0xaf53e0], esi
call fcn.00a50480
lea ecx, [esp + 0x1c]
mov dword [esp + 0x710], 0
call fcn.00a504c0
lea ecx, [esp + 0x1c]
call fcn.00a50710
lea ecx, [esp + 0x1c]
mov dword [esp + 0x710], esi
call fcn.00a51780
mov al, 1
jmp 0xa51753
mov dword [eax + 0x54], 1
mov eax, dword [0xaf53e4]
mov edi, dword [0xaf53b4]
mov ecx, dword [eax + 0x54]
lea edx, [eax + 0x14]
mov dword [0xaf53e0], ecx
mov ecx, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x74]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xaf53e4]
mov ecx, dword [eax + 0x54]
add eax, 0x14
push ecx
push eax
push str._s__d
push edx
call fcn.00a7feb4
mov eax, dword [0xaf53b8]
add esp, 0x10
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [0xaf53b8]
lea ecx, [esp + 0x74]
mov edi, eax
push ecx
push edi
push 0
push 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0xa51751
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
push edi
mov dword [0xaf53a0], ebx
mov dword [0xaf53e8], esi
call fcn.00a50de0
add esp, 4
test al, al
je 0xa516cd
mov edi, dword [esp + 0x71c]
test edi, edi
je 0xa5153c
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x2e8]
call fcn.00a155c0
mov ecx, dword [esp + 0x26]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x26]
push edx
mov edx, dword [esp + 0x26]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push edi
lea eax, [esp + 0x300]
push str._lsDamaged._x__x__x__x._x
push eax
mov dword [esp + 0x730], 1
call fcn.00a16060
mov ecx, dword [esp + 0x310]
push ecx
push ebp
call fcn.00a50f30
add esp, 0x28
lea ecx, [esp + 0x2e8]
mov dword [esp + 0x710], 0xffffffff
call fcn.00a155e0
jmp 0xa51558
push 0
push str.Try_deleting_.tvr_file
push str.Registry_corrupted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0xd8]
call fcn.00a155c0
push edi
lea edx, [esp + 0xdc]
push str._lsRegistry.tvr.backup
push edx
mov dword [esp + 0x71c], 2
call fcn.00a16060
mov eax, dword [esp + 0xec]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call fcn.00a227b0
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
cmp edi, 0xffffffff
je 0xa51641
push ebp
push edi
call fcn.00a510f0
add esp, 8
test al, al
je 0xa5163e
mov ecx, dword [0xaf53b8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edx, [esp + 0x74]
mov dword [esp + 0x18], eax
push edx
push eax
mov eax, dword [0xaf53b8]
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0xa5173a
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov ebp, eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a50de0
add esp, 4
test al, al
je 0xa516ad
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call ebx
mov ebp, dword [esp + 0x718]
jmp 0xa51641
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push ebp
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebp
call esi
push 0
push 0
push 0x10000
push ebp
call edi
push ebp
call esi
mov eax, dword [0xaf53b8]
lea edx, [esp + 0x74]
push edx
push 0x10000
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0xa5173a
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
push 0x10000
push ebp
call fcn.00a50b20
add esp, 8
mov dword [0xaf53a0], ebp
mov dword [0xaf53e8], esi
mov dword [esp + 0x710], 0xffffffff
lea ecx, [esp + 0xd8]
jmp 0xa51725
mov esi, dword [esp + 0x71c]
test esi, esi
je 0xa5172a
lea ecx, [esp + 0x4f8]
call fcn.00a155c0
push esi
lea ecx, [esp + 0x4fc]
push str._lsRegistry.tvr.backup
push ecx
mov dword [esp + 0x71c], 3
call fcn.00a16060
mov edx, dword [esp + 0x50c]
push edx
push ebp
call fcn.00a50f30
add esp, 0x14
mov dword [esp + 0x710], 0xffffffff
lea ecx, [esp + 0x4f8]
call fcn.00a155e0
mov eax, dword [0xaf53e4]
mov dword [eax + 4], 0xf00f00
mov al, 1
jmp 0xa51753
lea ecx, [esp + 0xd8]
mov dword [esp + 0x710], 0xffffffff
call fcn.00a155e0
xor al, al
mov ecx, dword [esp + 0x708]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x704
ret