Function at 0xa0f960
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0xa8abcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
push ebx
push esi
push edi
call fcn.00a35850
lea ecx, [esp + 0x50]
mov esi, eax
call fcn.00a155c0
mov edi, dword [esp + 0x270]
mov dword [esp + 0x268], 0
test edi, edi
je 0xa0f9af
push edi
call fcn.00a7e07a
add esp, 4
jmp 0xa0f9b1
xor eax, eax
push eax
push edi
lea ecx, [esp + 0x58]
call fcn.00a15880
push 0x5c
lea ecx, [esp + 0x54]
call fcn.00a15cc0
test esi, esi
je 0xa0f9d6
push esi
call fcn.00a7e07a
add esp, 4
jmp 0xa0f9d8
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x58]
call fcn.00a15880
mov eax, str.Registry.ro.tvr
test eax, eax
je 0xa0f9f7
push eax
call fcn.00a7e07a
add esp, 4
jmp 0xa0f9f9
xor eax, eax
push eax
push str.Registry.ro.tvr
lea ecx, [esp + 0x58]
call fcn.00a15880
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00a1fd60
test al, 0x10
je 0xa0fa38
mov edx, dword [esp + 0x58]
push edx
push str.Probing_for_external_RO__File_not_found__ls_n
call fcn.009fe320
add esp, 8
mov dword [esp + 0x268], 0xffffffff
jmp 0xa0fbef
mov eax, dword [esp + 0x58]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call fcn.00a227b0
mov ebx, eax
or edi, 0xffffffff
cmp ebx, edi
jne 0xa0fa7b
mov esi, dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Probing_for_external_RO_registry___Open__ls_failed_with_errocode__x_n
call fcn.009fe320
add esp, 0xc
jmp 0xa0fbe8
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x3c
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xa0fbcf
cmp dword [esp + 0xc], 0x3c
jne 0xa0fbcf
cmp dword [esp + 0x14], 0x8fff7285
je 0xa0fabf
push str._Bad_Readonly_registry_file_format_n
call fcn.009fe320
add esp, 4
jmp 0xa0fbe8
lea eax, [esp + 0x10]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edx, dword [esp + 0x14]
push edx
push 0
push 0xf001f
call fcn.00a22d00
mov ebp, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0xa0fafe
push 0
push 0
push 0
push 6
push edi
call ebp
mov esi, eax
test esi, esi
jne 0xa0fb3f
push 0
push 0
push 0
push 6
push edi
call ebp
mov esi, eax
test esi, esi
jne 0xa0fb3f
mov eax, dword [esp + 0x2c]
push eax
call fcn.00a7e295
add esp, 4
mov esi, eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
pop ebp
cmp esi, ebx
je 0xa0fbb4
mov eax, str..thfd
test eax, eax
je 0xa0fb61
push eax
call fcn.00a7e07a
add esp, 4
jmp 0xa0fb63
xor eax, eax
push eax
push str..thfd
lea ecx, [esp + 0x58]
call fcn.00a15880
mov eax, dword [esp + 0x58]
cmp eax, ebx
mov edi, eax
jne 0xa0fb80
xor eax, eax
jmp 0xa0fb89
push eax
call fcn.00a7e07a
add esp, 4
push eax
push edi
mov ecx, 0xaf4a00
call fcn.00a15a90
mov ecx, dword [esp + 0x270]
mov dword [0xaf4760], ebx
push ecx
push esi
mov dword [0xaf4764], ebx
call fcn.00a50c20
add esp, 8
cmp esi, ebx
lea ecx, [esp + 0x50]
mov dword [esp + 0x268], 0xffffffff
setne bl
call fcn.00a155e0
mov al, bl
jmp 0xa0fbfa
mov edx, dword [esp + 0x58]
push edx
push str.Probing_for_external_RO_registry__File_corrupted:__ls_n
call fcn.009fe320
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x268], edi
lea ecx, [esp + 0x50]
call fcn.00a155e0
xor al, al
mov ecx, dword [esp + 0x260]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x260
ret