Function at 0x140026d4c
Capabilities:
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor esi, esi
lea rbx, str.MakePri.exe
mov r15, rcx
mov qword [rbp - 0x30], rbx
mov rcx, qword [rbp + 0x50]
mov r12, r9
mov qword [rbp - 0x40], rsi
mov r13, rdx
test rcx, rcx
je 0x140026eb7
lea rax, [rbp - 0x40]
mov qword [rbp - 0x18], rsi
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x10], 1
call fcn.140020728
mov r14d, eax
cmp byte [rbp - 0x10], sil
je 0x140026df8
mov rdi, qword [rbp - 0x20]
mov rsi, qword [rdi]
test rsi, rsi
je 0x140026def
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [rbp - 0x18]
xor esi, esi
mov qword [rdi], rax
test r14d, r14d
jns 0x140026e35
cmp qword [0x140076ca8], rsi
je 0x140027355
xor r9d, r9d
lea r8, str.StringHelper::GetFullOutputPath_makepriExeFullPath__wil::out_param_normalizedMakePriExePath__
mov edx, r14d
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140027355
call fcn.140001754
jmp 0x140027355
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jns 0x140026eaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
jns 0x140026eaf
cmp r14d, 0x80070003
jne 0x140026e88
mov rcx, qword [rbp - 0x40]
call fcn.14002024c
test al, al
mov ecx, 0x800700ce
cmovne r14d, ecx
cmp qword [0x140076ca8], rsi
je 0x140027355
mov r9, qword [rbp - 0x40]
lea r8, str.lastError
mov edx, r14d
mov cl, 1
call fcn.14000153c
jmp 0x140027355
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x30], rax
lea r9, [rbp - 0x38]
mov qword [rbp - 0x38], rsi
lea r8, [0x140046b60]
mov rcx, r13
lea rdx, str.Resources
call fcn.14002432c
mov rdi, qword [rbp - 0x38]
mov r14d, eax
test eax, eax
jns 0x140026f05
cmp qword [0x140076ca8], rsi
je 0x140027332
xor r9d, r9d
lea r8, str._FileSystemHelper::CreateTempFileFromStream_resourcesPriStream__TempResourcesFilePrefix__ResourcesPriFileExtension__tempResourcesPriFile__
mov edx, eax
mov cl, 1
call fcn.14000153c
jmp 0x140027332
mov dword [rbp - 0x10], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
test r15, r15
je 0x140026f5a
mov rdx, r15
lea rcx, [rbp - 0x20]
call fcn.140032250
mov r14d, eax
test eax, eax
jns 0x140026f5a
cmp qword [0x140076ca8], rsi
je 0x140026f51
xor r9d, r9d
lea r8, str.packageNameNew.SetValueFromString_packageName_
mov edx, eax
mov cl, 1
call fcn.14000153c
cmp qword [0x140076ca8], rsi
je 0x140026f51
call fcn.140001754
mov rbx, qword [rbp - 0x18]
jmp 0x140027325
mov r13d, 0x10
lea rdx, [0x140037388]
mov ecx, r13d
call fcn.140033b94
mov rbx, qword [rbp - 0x18]
mov r15, rax
test rax, rax
je 0x140026fb5
mov qword [rax], rsi
mov qword [rax + 8], rsi
test rbx, rbx
je 0x140026f91
xor ecx, ecx
call fcn.140033d70
mov qword [r15], rbx
lea rdx, [0x140037388]
mov ecx, 8
call fcn.140033b94
test rax, rax
je 0x140026fac
mov qword [rax], rsi
jmp 0x140026faf
mov rax, rsi
mov qword [r15 + 8], rax
jmp 0x140026fb8
mov r15, rsi
xor eax, eax
mov rsi, r15
test r15, r15
jne 0x140026fee
cmp qword [0x140076ca8], rax
mov r14d, 0x8007000e
je 0x14002731d
xor r9d, r9d
lea r8, str._newDumpNode___NULL
mov edx, r14d
mov cl, 1
call fcn.14000153c
jmp 0x14002731d
mov r9, qword [r15 + 8]
lea r8, [rbp - 0x38]
lea rdx, [0x14005a080]
mov qword [rbp - 0x28], rax
lea rcx, str.Resources
mov qword [rbp - 0x38], rax
mov rbx, rax
call fcn.140024174
xor r8d, r8d
mov r14d, eax
test eax, eax
jns 0x140027071
cmp qword [0x140076ca8], r8
je 0x14002704e
xor r9d, r9d
lea r8, str.FileSystemHelper::CreateTempFileAndGetStream__TempResourcesFilePrefix__XmlExtension__tempResourcesPriXmlStream__newDumpNode__resourcePriDumpFilePath__GetFileNameAddress___
mov edx, eax
mov cl, 1
call fcn.14000153c
xor r8d, r8d
cmp qword [0x140076ca8], r8
je 0x14002704e
call fcn.140001754
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14002731d
mov qword [rbp - 0x38], r8
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
jmp 0x14002731d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14002708e
mov qword [rbp - 0x38], r8
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037098]
xor r8d, r8d
mov rax, qword [r15 + 8]
or r9, 0xffffffffffffffff
mov rcx, qword [rax]
mov rax, r9
inc rax
cmp word [rcx + rax*2], r8w
jne 0x14002709c
mov rcx, r9
inc rcx
cmp word [rdi + rcx*2], r8w
jne 0x1400270a9
mov rdx, qword [rbp - 0x30]
add eax, ecx
mov rcx, r9
inc rcx
cmp word [rdx + rcx*2], r8w
jne 0x1400270bc
lea edx, [rcx + 0x13]
mov rcx, qword [rbp + 0x40]
add edx, eax
test rcx, rcx
je 0x1400270e6
mov rax, r9
inc rax
cmp word [rcx + rax*2], r8w
jne 0x1400270d7
add edx, 5
add edx, eax
mov r14d, edx
mov eax, 2
mul r14
lea rdx, [0x140037388]
mov qword [rbp - 0x38], r14
cmovo rax, r9
mov rcx, rax
call fcn.140033d7c
mov rbx, rax
xor eax, eax
test rbx, rbx
jne 0x14002713e
cmp qword [0x140076ca8], rax
mov r14d, 0x8007000e
je 0x140027311
xor r9d, r9d
lea r8, str._makePriCmdLine___NULL
mov edx, r14d
mov cl, 1
call fcn.14000153c
jmp 0x140027311
mov rax, qword [r15 + 8]
lea r8, str._s_dump__if__s__of__s__o
mov r9, qword [rbp - 0x30]
mov rdx, r14
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.140013a04
xor ecx, ecx
mov r14d, eax
test eax, eax
jns 0x140027189
cmp qword [0x140076ca8], rcx
je 0x140027311
lea r8, str.StringCchPrintf__makePriCmdLine__makepriCmdLength__L__s_dump__if__s__of__s__o___makepriExecutableFullPath__tempResourcesPriFile.GetFileName____newDumpNode__resourcePriDumpFilePath__GetFileName___
mov edx, eax
jmp 0x1400272f2
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x1400271cc
mov rdx, qword [rbp - 0x38]
lea r8, str._s__es__s
mov r9, rbx
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140013a04
xor ecx, ecx
mov r14d, eax
test eax, eax
jns 0x1400271cc
cmp qword [0x140076ca8], rcx
je 0x140027311
lea r8, str.StringCchPrintf__makePriCmdLine__makepriCmdLength__L__s__es__s___static_cast_PCWSTR__makePriCmdLine___mainResourcePriFilePath_
jmp 0x140027182
mov dword [rbp + 0x50], ecx
lea rdx, [rbp + 0x50]
mov rcx, rbx
call fcn.14002b0e8
xor r8d, r8d
mov r14d, eax
test eax, eax
jns 0x1400271fb
cmp qword [0x140076ca8], r8
je 0x140027311
lea r8, str.InvokeMakePri_makePriCmdLine__output_
jmp 0x140027182
cmp dword [rbp + 0x50], r8d
je 0x140027224
mov rcx, qword [rbp + 0x28]
lea r8, str.onecoreprintscan_appxpackaginglibcore_src_fileexemptionbuilderbase.cpp
mov r14d, 0x8000ffff
mov edx, 0x20a
mov r9d, r14d
call fcn.140002204
jmp 0x140027311
mov rcx, qword [r12 + 0x10]
mov rsi, r8
mov rax, qword [r12 + 8]
lea rdx, [rcx + 1]
cmp rdx, rax
jbe 0x1400272ca
mov ecx, 0x3fffffff
cmp rax, rcx
jne 0x140027253
mov r14d, 0x8000000b
jmp 0x1400272da
test rax, rax
je 0x140027262
lea r13, [rax + rax*2]
shr r13, 1
inc r13
cmp rdx, r13
cmova r13, rdx
lea rdx, [0x140037388]
cmp r13, rcx
cmova r13, rcx
mov rcx, r13
shl rcx, 3
call fcn.140033d7c
xor r8d, r8d
mov r14, rax
test rax, rax
jne 0x140027296
mov r14d, 0x8007000e
jmp 0x1400272da
mov rdx, qword [r12]
test rdx, rdx
je 0x1400272bc
mov r8, qword [r12 + 0x10]
mov rcx, r14
shl r8, 3
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov rcx, qword [r12]
call fcn.140033d70
xor r8d, r8d
mov rcx, qword [r12 + 0x10]
mov qword [r12], r14
mov qword [r12 + 8], r13
mov rax, qword [r12]
mov r14d, r8d
mov qword [rax + rcx*8], r15
inc qword [r12 + 0x10]
test r14d, r14d
jns 0x14002730e
cmp qword [0x140076ca8], r8
je 0x140027311
lea r8, str.priDumps.Add_newDumpNode.Detach___
mov edx, r14d
xor r9d, r9d
mov cl, 1
call fcn.14000153c
xor eax, eax
cmp qword [0x140076ca8], rax
je 0x140027311
call fcn.140001754
jmp 0x140027311
mov r14d, r8d
mov rcx, rbx
call fcn.140033d70
mov rbx, qword [rbp - 0x28]
mov rcx, rsi
call fcn.14002baf4
test rbx, rbx
je 0x140027332
mov rcx, rbx
call fcn.140033d70
test rdi, rdi
je 0x140027346
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002736a
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
nop dword [rax + rax]
lea r11, [rsp + 0x70]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret