Function at 0x140026498
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb0
mov r14, r8
xor r12d, r12d
lea r8, [rbp - 9]
mov qword [rbp - 9], r12
mov rsi, r9
mov rbx, rdx
mov r15, rcx
call fcn.14002aad8
mov edi, eax
test eax, eax
jns 0x1400264f3
cmp qword [0x140076ca8], r12
je 0x14002696b
lea r8, str.InitializeManifestReaderDom_manifestStream__manifestRootNode_
jmp 0x140026528
test r14, r14
jne 0x14002654b
mov rdx, qword [rbp - 9]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.1400298f0
mov edi, eax
test eax, eax
jns 0x140026968
cmp qword [0x140076ca8], r12
je 0x14002696b
lea r8, str.PopulateVisualAssetsForOnePair_manifestRootNode.Get____nullptr__nullptr_
xor r9d, r9d
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], r12
je 0x14002696b
call fcn.140001754
jmp 0x14002696b
xor edx, edx
mov qword [rbp - 0x11], r12
lea rax, [rbp - 0x11]
lea r9, [0x140054538]
mov qword [rsp + 0x20], rax
lea rcx, [0x140054528]
lea r8d, [rdx + 1]
call qword [sym.imp.OLE32.dll_CoCreateInstance]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x1400265a3
cmp qword [0x140076ca8], r12
je 0x140026a52
xor r9d, r9d
lea r8, str._CoCreateInstance____uuidof_AppxFactory___nullptr__CLSCTX_INPROC_SERVER____uuidof__appxFactory.GetAddressOf______IID_PPV_ARGS_Helper_appxFactory.GetAddressOf_____
mov edx, eax
mov cl, 1
call fcn.14000153c
jmp 0x140026a52
mov rcx, qword [rbp - 0x11]
lea r8, [rbp - 0x19]
mov qword [rbp - 0x19], r12
mov rdx, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x140037098]
mov edi, eax
test eax, eax
jns 0x1400265db
cmp qword [0x140076ca8], r12
je 0x140026a38
lea r8, str.appxFactory__CreateManifestReader_manifestStream__manifestReader_
jmp 0x140026606
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp - 0x41]
mov dword [rbp - 0x41], r12d
call fcn.14002bd38
mov edi, eax
test eax, eax
jns 0x140026629
cmp qword [0x140076ca8], r12
je 0x140026a38
lea r8, str.ManifestHelper::GetIsResourcePackage_manifestReader.Get____isResourcePackage_
xor r9d, r9d
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], r12
je 0x140026a38
call fcn.140001754
jmp 0x140026a38
mov eax, dword [rbp - 0x41]
mov rbx, r12
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x39], r12
test eax, eax
je 0x140026792
test rsi, rsi
je 0x140026785
lea r8, [rbp - 0x31]
mov qword [rbp - 0x29], r12
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x31], r12
mov rcx, rsi
call fcn.1400260d0
mov edi, eax
test eax, eax
jns 0x14002667c
cmp qword [0x140076ca8], r12
je 0x14002670d
lea r8, str._GetManifestAndResourcesPriFromAppx_mainPackagePath__mainPackageManifestStream__mainPackageResourcesPriStream__
jmp 0x1400266b5
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140026692
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rdx, qword [rbp - 0x29]
lea r8, [rbp - 0x39]
call fcn.14002aad8
mov edi, eax
test eax, eax
jns 0x1400266c3
cmp qword [0x140076ca8], r12
je 0x14002670d
lea r8, str._InitializeManifestReaderDom_mainPackageManifestStream.Get____mainPackageManifestRootNode__
xor r9d, r9d
mov edx, eax
mov cl, 1
call fcn.14000153c
jmp 0x14002670d
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140026768
lea r9, [rbp - 0x21]
lea r8, [0x140046b60]
lea rdx, str.Resources
call fcn.14002432c
mov edi, eax
test eax, eax
jns 0x14002674a
cmp qword [0x140076ca8], r12
je 0x140026709
xor r9d, r9d
lea r8, str._FileSystemHelper::CreateTempFileFromStream_mainPackageResourcesPriStream.Get____TempResourcesFilePrefix__ResourcesPriFileExtension__mainResourcesPriFile__
mov edx, eax
mov cl, 1
call fcn.14000153c
mov rbx, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140026727
mov qword [rbp - 0x31], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400269fb
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x1400269fb
mov rcx, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x21]
test rcx, rcx
je 0x140026768
mov qword [rbp - 0x31], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140026782
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov eax, dword [rbp - 0x41]
test eax, eax
je 0x140026792
test rsi, rsi
je 0x1400268f7
neg eax
mov qword [rbp + 0x1f], r12
mov rax, qword [rbp + 0x7f]
lea r9, [rbp + 0x1f]
sbb r8, r8
mov qword [rbp + 0x27], r12
and r8, rbx
mov qword [rbp + 0x2f], r12
mov rdx, r14
mov byte [rbp + 0x37], 1
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140026d4c
mov edi, eax
test eax, eax
jns 0x1400267fe
cmp qword [0x140076ca8], r12
je 0x1400269f2
xor r9d, r9d
lea r8, str.PopulateResourcesPriDump__nullptr__resourcesPriStream__isResourcePackage___mainResourcesPriFile.GetFileName___:_nullptr__priDump__makepriExeFullPath_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], r12
je 0x1400269f2
call fcn.140001754
jmp 0x1400269f2
lea rdx, [rbp - 1]
mov qword [rbp - 1], r12
lea rcx, [rbp + 0x1f]
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r12
mov byte [rbp + 0x17], 1
call fcn.14002ac84
mov edi, eax
test eax, eax
jns 0x140026858
cmp qword [0x140076ca8], r12
je 0x1400269e9
xor r9d, r9d
lea r8, str.BuildResourcesDumpDOMList__priDump__resourceDumpsDOMList_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], r12
je 0x1400269e9
call fcn.140001754
jmp 0x1400269e9
mov esi, r12d
cmp qword [rbp + 0x2f], r12
jbe 0x1400268e5
mov rbx, r12
cmp rbx, qword [rbp + 0xf]
jb 0x140026873
mov r9, r12
jmp 0x14002687e
lfence
mov rax, qword [rbp - 1]
mov r9, qword [rax + rbx*8]
mov r9, qword [r9 + 8]
xor r8d, r8d
mov rdx, qword [rbp - 9]
mov rcx, r15
call fcn.1400298f0
mov edi, eax
test eax, eax
js 0x1400269bb
mov rdx, qword [rbp - 0x39]
test rdx, rdx
je 0x1400268d7
cmp rbx, qword [rbp + 0xf]
jb 0x1400268af
mov r9, r12
jmp 0x1400268be
lfence
mov rax, qword [rbp - 1]
mov rdx, qword [rbp - 0x39]
mov r9, qword [rax + rbx*8]
mov r9, qword [r9 + 8]
xor r8d, r8d
mov rcx, r15
call fcn.1400298f0
mov edi, eax
test eax, eax
js 0x1400269a9
inc esi
mov ebx, esi
cmp rbx, qword [rbp + 0x2f]
jb 0x140026868
mov rbx, qword [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140013984
lea rcx, [rbp + 0x1f]
call fcn.14001390c
test rbx, rbx
je 0x14002690b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140026934
mov qword [rbp - 0x39], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14002694e
mov qword [rbp - 0x19], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140026968
mov qword [rbp - 0x11], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov edi, r12d
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140026985
mov qword [rbp - 9], r12
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [0x140037098]
lea r11, [rsp + 0xb0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
cmp qword [0x140076ca8], r12
je 0x1400269e5
lea r8, str.PopulateVisualAssetsForOnePair__mainPackageManifestRootNode.Get____nullptr__resourceDumpsDOMList.At_index___xmlDom.Get___
jmp 0x1400269cb
cmp qword [0x140076ca8], r12
je 0x1400269e5
lea r8, str.PopulateVisualAssetsForOnePair__manifestRootNode.Get____nullptr__resourceDumpsDOMList.At_index___xmlDom.Get___
xor r9d, r9d
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], r12
je 0x1400269e5
call fcn.140001754
mov rbx, qword [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140013984
lea rcx, [rbp + 0x1f]
call fcn.14001390c
test rbx, rbx
je 0x140026a0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140026a38
mov qword [rbp - 0x39], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140026a52
mov qword [rbp - 0x19], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14002696b
mov qword [rbp - 0x11], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x14002696b