Function at 0x140028524
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [rdx]
mov r14, rdx
mov r15, rcx
lea rdx, [rbp + 0x2f]
xor esi, esi
mov rcx, r14
mov r12, r9
mov qword [rbp + 0x2f], rsi
mov rax, qword [rax + 0x28]
mov r13, r8
call qword [0x140037098]
mov ebx, eax
test eax, eax
jns 0x1400285aa
cmp qword [0x140076ca8], rsi
je 0x140028b5a
xor r9d, r9d
lea r8, str.bundleReader__GetManifest_bundleManifestReader_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140028b5a
call fcn.140001754
jmp 0x140028b5a
mov word [rbp + 0x6f], 1
lea rdi, [rbp + 0x6f]
mov sil, byte [rdi]
lea r9, [rbp + 0x17]
and qword [rbp + 0x17], 0
mov r8b, sil
mov rdx, r14
mov rcx, r15
call fcn.140027d8c
mov ebx, eax
test eax, eax
js 0x140028b09
mov rcx, qword [rbp + 0x2f]
lea rdx, [rbp - 0x19]
and qword [rbp - 0x19], 0
and dword [rbp - 0x29], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028ac1
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp - 0x29]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028aad
xor ebx, ebx
jmp 0x140028854
mov qword [rbp - 0x21], rbx
lea rdx, [rbp - 0x21]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028a65
mov rcx, qword [rbp - 0x21]
lea r8, [rbp + 0xf]
and qword [rbp + 0xf], 0
lea rdx, [0x14006f5b8]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028a2b
mov rcx, qword [rbp - 0x21]
lea r8, [rbp + 7]
and qword [rbp + 7], 0
lea rdx, [0x14006f5a8]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x1400289f1
mov rcx, qword [rbp + 0xf]
lea rdx, [rbp + 0x1f]
and dword [rbp + 0x1f], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x1400289dd
mov rcx, qword [rbp + 7]
lea rdx, [rbp - 0x11]
and dword [rbp - 0x11], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140037098]
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x1400289c7
cmp dword [rbp + 0x1f], eax
jne 0x1400287e5
test sil, sil
je 0x1400286f9
cmp dword [rbp - 0x11], eax
jne 0x140028702
jmp 0x1400287e5
cmp dword [rbp - 0x11], eax
jne 0x1400287e5
mov rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x27]
mov qword [rbp + 0x27], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028959
mov rax, qword [r14]
lea r8, [rbp - 1]
mov rdx, qword [rbp + 0x27]
mov rcx, r14
and qword [rbp - 1], 0
mov rax, qword [rax + 0x38]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028911
mov rcx, qword [rbp - 1]
lea rdx, [rbp - 9]
and qword [rbp - 9], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x1400288c9
mov rax, qword [r15]
mov rcx, r15
mov r9, qword [rbp + 0x17]
mov r8, qword [rbp - 9]
mov rdx, qword [rbp + 0x27]
mov rax, qword [rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x1400288b5
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400287ba
and qword [rbp - 9], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400287d5
and qword [rbp - 1], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp - 0x29]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x140037098]
mov ebx, eax
test eax, eax
js 0x140028999
mov rcx, qword [rbp + 7]
xor ebx, ebx
test rcx, rcx
je 0x140028820
mov qword [rbp + 7], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14002883a
mov qword [rbp + 0xf], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140028854
mov qword [rbp - 0x21], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x19]
cmp dword [rbp - 0x29], ebx
jne 0x140028626
xor esi, esi
test rcx, rcx
je 0x140028879
mov qword [rbp - 0x19], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140028892
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
lea rax, [rbp + 0x71]
inc rdi
cmp rdi, rax
jne 0x1400285b4
mov ebx, esi
jmp 0x140028b5a
xor edi, edi
cmp qword [0x140076ca8], rdi
je 0x1400288f5
lea r8, str.PopulateResourcesPriDumpAndMainPackageExemptedManifestEntriesForPackage__packageFileName__packageStream.Get____mainResourcesPriFile.GetFileName____priDumps__makepriExeFullPath_
jmp 0x1400288db
xor edi, edi
cmp qword [0x140076ca8], rdi
je 0x1400288f5
lea r8, str.currentPackageFile__GetStream_packageStream_
xor r9d, r9d
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rdi
je 0x1400288f5
call fcn.140001754
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14002893d
mov qword [rbp - 9], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x14002893d
xor edi, edi
cmp qword [0x140076ca8], rdi
je 0x14002893d
xor r9d, r9d
lea r8, str.bundleReader__GetPayloadPackage_packageFileName__currentPackageFile_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rdi
je 0x14002893d
call fcn.140001754
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x140028985
mov qword [rbp - 1], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x140028985
cmp qword [0x140076ca8], 0
je 0x140028985
xor r9d, r9d
lea r8, str.currentPackage__GetFileName_packageFileName_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], 0
je 0x140028985
call fcn.140001754
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
xor esi, esi
jmp 0x140028a0f
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028a0f
lea r8, str.payloadPackages__MoveNext_hasCurrent_
mov edx, eax
xor r9d, r9d
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140028a0f
call fcn.140001754
jmp 0x140028a0f
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028a0f
lea r8, str.currentPackage4__GetIsStub_isPackageStub_
mov edx, ebx
jmp 0x1400289ad
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028a0f
lea r8, str.currentPackage2__GetIsPackageReference_isPackageReference_
jmp 0x1400289ab
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028a0f
xor r9d, r9d
lea r8, str._currentPackage.As_currentPackage4__
mov edx, eax
mov cl, 1
call fcn.14000153c
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140028a49
mov qword [rbp + 7], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x140028a49
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028a49
xor r9d, r9d
lea r8, str._currentPackage.As_currentPackage2__
mov edx, eax
mov cl, 1
call fcn.14000153c
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140028a91
mov qword [rbp + 0xf], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x140028a91
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028a91
xor r9d, r9d
lea r8, str.payloadPackages__GetCurrent_currentPackage_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140028a91
call fcn.140001754
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140028aed
mov qword [rbp - 0x21], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x140028aed
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028aed
lea r8, str.payloadPackages__GetHasCurrent_hasCurrent_
jmp 0x140028ad3
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028aed
lea r8, str.bundleManifestReader__GetPackageInfoItems_payloadPackages_
xor r9d, r9d
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140028aed
call fcn.140001754
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140028b35
mov qword [rbp - 0x19], rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x140028b35
xor esi, esi
cmp qword [0x140076ca8], rsi
je 0x140028b35
xor r9d, r9d
lea r8, str.ExtractMainResourcesPriForBundle_bundleReader__processStub__mainResourcesPriFile_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140028b35
call fcn.140001754
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140028b4e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140028b74
mov qword [rbp + 0x2f], rsi
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [0x140037098]
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret