Function at 0x10017800
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
xor eax, eax
mov dword [esp + 0x1c], edi
cmp edi, esi
je 0x10017c44
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push edi
mov byte [esp + 0x30], al
mov dword [esp + 0x31], eax
mov word [esp + 0x35], ax
mov byte [esp + 0x37], al
call ebx
test eax, eax
je 0x10017c42
push str..rickroll
push edi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call ebp
test eax, eax
je 0x1001788c
push str..cryptoid
push edi
call ebx
push eax
call ebp
test eax, eax
je 0x1001788c
push str..desu
push edi
call ebx
push eax
call ebp
test eax, eax
je 0x1001788c
push str..Aurora
push edi
call ebx
push eax
call ebp
test eax, eax
jne 0x10017c42
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100178de
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 8
lea edx, [esp + 0x38]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
test ecx, ecx
jl 0x10017c42
mov eax, dword [esp + 0x20]
jg 0x100178f8
test eax, eax
jbe 0x10017c42
cmp byte [0x101e063c], 0
jne 0x10017c2a
test ecx, ecx
jl 0x10017c2a
jg 0x10017918
cmp eax, 8
jb 0x10017c2a
cmp dword [esp + 0x18], 8
jne 0x10017c2a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100cf8cb
add esp, 4
push edi
mov esi, eax
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov edx, esi
call fcn.10003d40
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push str..desu
push edi
call ebx
push eax
call ebp
test eax, eax
jne 0x10017b10
push esi
call ebx
cmp word [eax], 0
jne 0x10017b10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
jne 0x10017ba3
mov edi, eax
shr edi, 1
lea eax, [edi + 1]
push eax
call fcn.100cf8cb
mov esi, eax
add esp, 4
xor eax, eax
mov byte [edi + esi], 0
test edi, edi
jbe 0x10017a79
lea esp, [esp]
mov byte [eax + esi], 0
movzx ecx, word [ebp + eax*4]
cmp cx, 0x41
jb 0x100179de
cmp cx, 0x46
ja 0x100179de
mov cl, byte [ebp + eax*4]
sub cl, 0x37
jmp 0x10017a11
cmp cx, 0x61
jb 0x100179f6
cmp cx, 0x66
ja 0x100179f6
mov dl, byte [ebp + eax*4]
sub dl, 0x57
mov byte [eax + esi], dl
jmp 0x10017a14
cmp cx, 0x30
jb 0x10017b9a
cmp cx, 0x39
ja 0x10017b9a
mov cl, byte [ebp + eax*4]
sub cl, 0x30
mov byte [eax + esi], cl
mov cl, byte [eax + esi]
shl cl, 4
mov byte [eax + esi], cl
movzx edx, word [ebp + eax*4 + 2]
cmp dx, 0x41
jb 0x10017a39
cmp dx, 0x46
ja 0x10017a39
mov dl, byte [ebp + eax*4 + 2]
add dl, cl
sub dl, 0x37
jmp 0x10017a6d
cmp dx, 0x61
jb 0x10017a50
cmp dx, 0x66
ja 0x10017a50
mov dl, byte [ebp + eax*4 + 2]
add dl, cl
sub dl, 0x57
jmp 0x10017a6d
cmp dx, 0x30
jb 0x10017b9a
cmp dx, 0x39
ja 0x10017b9a
mov dl, byte [ebp + eax*4 + 2]
add dl, cl
sub dl, 0x30
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jb 0x100179c0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x10017b9a
lea eax, [edi + edi + 0x208]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x10017b9a
push edi
push ebp
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x10129ee0
push ecx
call ebx
lea eax, [eax + eax + 2]
call fcn.100044f0
mov edx, dword [esp + 0x1c]
push ebp
push edx
call ebx
lea eax, [eax + eax + 2]
call fcn.100044f0
push esi
call fcn.100d072d
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, edi
push esi
call ebx
mov esi, eax
push 0x1012a050
push esi
call ebp
test eax, eax
je 0x10017c19
push 0x1012a05c
push esi
call ebp
test eax, eax
je 0x10017c19
push 0x1012a068
push esi
call ebp
test eax, eax
je 0x10017c19
push 0x1012a07c
push esi
call ebp
test eax, eax
je 0x10017bf0
push 0x1012a088
push esi
call ebp
test eax, eax
je 0x10017bf0
push 0x1012a0a0
push esi
call ebp
test eax, eax
jne 0x10017bbb
push 5
push str._PDF_
lea eax, [esp + 0x34]
push eax
call fcn.10018020
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100d0738
add esp, 0x2c
ret
push esi
call fcn.100d072d
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100d0738
add esp, 0x2c
ret
push 0x1012a0b4
push esi
call ebp
test eax, eax
jne 0x10017c2a
push 4
push 0x1012a0c0
lea ecx, [esp + 0x34]
push ecx
call fcn.10018020
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100d0738
add esp, 0x2c
ret
push 8
push 0x1012a094
lea edx, [esp + 0x34]
push edx
call fcn.10018020
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100d0738
add esp, 0x2c
ret
push 4
push 0x1012a074
lea eax, [esp + 0x34]
push eax
call fcn.10018020
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100d0738
add esp, 0x2c
ret
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x2c
ret