Function at 0x1287dc50
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x760
mov qword [rsp + 0x148], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x750], rax
mov rsi, rcx
call fcn.128767c0
lea rdx, [0x1285da60]
mov qword [rsi + 0x550], rdx
mov qword [rsp + 0x178], 7
xor r15d, r15d
mov qword [rsp + 0x170], r15
mov word [rsp + 0x160], r15w
lea rdx, str.CurrentUserSid
lea rcx, [rsp + 0xd0]
call fcn.12804480
nop
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0xd0]
call fcn.12888930
test eax, eax
sete dil
cmp qword [rsp + 0xf0], 8
jb 0x1287dd07
mov rcx, qword [rsp + 0xd8]
call fcn.12958250
mov qword [rsp + 0xf0], 7
mov qword [rsp + 0xe8], r15
mov word [rsp + 0xd8], r15w
test dil, dil
je 0x1287dd42
mov dword [rsp + 0x40], 2
lea rdx, [0x12a1ae28]
lea rcx, [rsp + 0x40]
call fcn.12958e1c
xor r8d, r8d
lea rdx, [rsp + 0x158]
lea rcx, [rsi + 0x20]
call fcn.12851190
lea r8, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae r8, qword [rsp + 0x160]
lea rdx, str.REGISTRYUSER_s
lea rcx, [rsi + 0x48]
call fcn.12804810
lea r8, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae r8, qword [rsp + 0x160]
lea rdx, str.REGISTRYUSER_s_CLASSES
lea rcx, [rsi + 0x70]
call fcn.12804810
lea rcx, [rsi + 0xe8]
lea r8, [0x129bf0a0]
lea rdx, [0x129d09f0]
call fcn.12804810
cmp qword [rsi + 0x90], 8
jb 0x1287ddd4
mov r8, qword [rsi + 0x78]
jmp 0x1287ddd8
lea r8, [rsi + 0x78]
lea rcx, [rsi + 0x110]
lea rdx, [0x129d09f0]
call fcn.12804810
lea r8, str.__CurrentUserData__
lea rdx, [0x129d09f0]
lea rcx, [rsi + 0x138]
call fcn.12804810
cmp qword [rsi + 0x158], 8
jb 0x1287de18
mov rcx, qword [rsi + 0x140]
jmp 0x1287de1f
lea rcx, [rsi + 0x140]
call fcn.1295c2a0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.HopedotVOS
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.HopedotVOS
lea rcx, [rsi + 0xc0]
call fcn.12803dc0
lea rdx, str.VOS_HKLM
mov qword [rsp + 0x250], rdx
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKLM
lea rcx, [rsp + 0x258]
call fcn.12804480
nop
mov qword [rsp + 0x2a0], 7
mov qword [rsp + 0x298], r15
mov word [rsp + 0x288], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x280]
call fcn.12803c90
nop
lea rax, str.VOS_HKCU
mov qword [rsp + 0x2a8], rax
lea rdx, [0x129beea0]
lea rcx, [rsp + 0x2b0]
call fcn.12804480
nop
mov qword [rsp + 0x2f8], 7
mov qword [rsp + 0x2f0], r15
mov word [rsp + 0x2e0], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x2d8]
call fcn.12803c90
nop
lea rax, str.VOS_HKCUC
mov qword [rsp + 0x300], rax
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKCUC
lea rcx, [rsp + 0x308]
call fcn.12804480
nop
mov qword [rsp + 0x350], 7
mov qword [rsp + 0x348], r15
mov word [rsp + 0x338], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x330]
call fcn.12803c90
nop
lea rax, str.VOS_HKCR
mov qword [rsp + 0x358], rax
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKCR
lea rcx, [rsp + 0x360]
call fcn.12804480
nop
mov qword [rsp + 0x3a8], 7
mov qword [rsp + 0x3a0], r15
mov word [rsp + 0x390], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x388]
call fcn.12803c90
nop
lea rax, str.VOS_DEFAULT
mov qword [rsp + 0x3b0], rax
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOT.DEFAULT
lea rcx, [rsp + 0x3b8]
call fcn.12804480
nop
mov qword [rsp + 0x400], 7
mov qword [rsp + 0x3f8], r15
mov word [rsp + 0x3e8], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x3e0]
call fcn.12803c90
nop
lea rax, str.VOS_ROOT_KEY
mov qword [rsp + 0x408], rax
lea rdx, [0x129bed40]
lea rcx, [rsp + 0x410]
call fcn.12804480
nop
mov qword [rsp + 0x458], 7
mov qword [rsp + 0x450], r15
mov word [rsp + 0x440], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x438]
call fcn.12803c90
nop
lea rax, str.VOS_HKU
mov qword [rsp + 0x460], rax
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKU
lea rcx, [rsp + 0x468]
call fcn.12804480
nop
mov qword [rsp + 0x4b0], 7
mov qword [rsp + 0x4a8], r15
mov word [rsp + 0x498], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x490]
call fcn.12803c90
nop
lea rax, str.HOSTHKCUC
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x4e0], 7
mov qword [rsp + 0x4d8], r15
mov word [rsp + 0x4c8], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x70]
lea rcx, [rsp + 0x4c0]
call fcn.12803c90
nop
mov qword [rsp + 0x508], 7
mov qword [rsp + 0x500], r15
mov word [rsp + 0x4f0], r15w
lea rax, str.HOSTHKCU
mov qword [rsp + 0x510], rax
mov qword [rsp + 0x538], 7
mov qword [rsp + 0x530], r15
mov word [rsp + 0x520], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x48]
lea rcx, [rsp + 0x518]
call fcn.12803c90
nop
mov qword [rsp + 0x560], 7
mov qword [rsp + 0x558], r15
mov word [rsp + 0x548], r15w
lea rax, str.HdProductName
mov qword [rsp + 0x568], rax
mov qword [rsp + 0x590], 7
mov qword [rsp + 0x588], r15
mov word [rsp + 0x578], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0xc0]
lea rcx, [rsp + 0x570]
call fcn.12803c90
nop
mov qword [rsp + 0x5b8], 7
mov qword [rsp + 0x5b0], r15
mov word [rsp + 0x5a0], r15w
lea rax, str.CurUserSid
mov qword [rsp + 0x5c0], rax
mov qword [rsp + 0x5e8], 7
mov qword [rsp + 0x5e0], r15
mov word [rsp + 0x5d0], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x5c8]
call fcn.12803c90
nop
mov qword [rsp + 0x610], 7
mov qword [rsp + 0x608], r15
mov word [rsp + 0x5f8], r15w
lea rdi, [rsp + 0x250]
mov qword [rsp + 0x68], rdi
lea r12, [rsp + 0x618]
nop dword [rax + rax]
cmp rdi, r12
je 0x1287e315
mov rdx, qword [rdi]
lea rcx, [rsp + 0xf8]
call fcn.12804480
nop
lea rcx, [rsi + 0x510]
lea rdx, [rsp + 0xf8]
call fcn.12860660
mov rbx, rax
cmp qword [rsp + 0x118], 8
jb 0x1287e2b9
mov rcx, qword [rsp + 0x100]
call fcn.12958250
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x110], r15
mov word [rsp + 0x100], r15w
lea rdx, [rdi + 8]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
call fcn.12803c90
cmp qword [rdi + 0x48], 0
je 0x1287e307
lea rdx, [rdi + 0x30]
lea rcx, [rbx + 0x28]
lea r9, [0x129c6388]
mov r8, rbx
call fcn.12850150
add rdi, 0x58
mov qword [rsp + 0x68], rdi
jmp 0x1287e270
mov rdx, qword [rsi + 0x38]
lea rdi, [rsi + 0x98]
add rdx, 0x23
mov rcx, rdi
call fcn.12803f30
lea rdx, [rsi + 0x20]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rdi
call fcn.12803c90
mov r8d, 1
lea rdx, [0x129c6388]
mov rcx, rdi
call fcn.12803a10
mov r8d, 0x22
lea rdx, [0x129beda0]
mov rcx, rdi
call fcn.12803a10
cmp qword [rdi + 0x20], 8
jb 0x1287e376
mov rdi, qword [rdi + 8]
jmp 0x1287e37a
add rdi, 8
mov qword [rsp + 0x50], rdi
mov rax, qword [rsi + 0xb0]
add rax, rax
mov word [rsp + 0x48], ax
mov rax, qword [rsp + 0x48]
add rax, 2
mov word [rsp + 0x4a], ax
mov qword [rsi], r15
mov dword [rsp + 0xa0], r15d
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xa0], 0x30
mov dword [rsp + 0xb8], 0x40
lea rax, [rsp + 0x48]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], r15
lea r8, [rsp + 0xa0]
mov edx, 0x2000000
mov rcx, rsi
call qword [0x129ae7e0]
xor edx, edx
lea rcx, [rsp + 0x620]
call fcn.12873ed0
nop
lea rdx, str._ALL_
lea rcx, [rsp + 0x120]
call fcn.12804480
nop
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x670]
call fcn.1281d330
mov r11, rax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.ModeV3All
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.ModeV3All
mov rcx, r11
call fcn.12803dc0
nop
cmp qword [rsp + 0x140], 8
jb 0x1287e48e
mov rcx, qword [rsp + 0x128]
call fcn.12958250
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], r15
mov word [rsp + 0x128], r15w
lea rdx, [rsp + 0x620]
lea rcx, str.GlobalHopedotVOSRegMappingFile
call fcn.1287c280
test eax, eax
jne 0x1287e52c
lea rcx, [rsp + 0x620]
call fcn.128622a0
nop
lea r9, [fcn.12830470]
mov edx, 0x58
lea r8d, [rdx - 0x4d]
lea rcx, [rsp + 0x250]
call fcn.1295b4c0
nop
cmp qword [rsp + 0x178], 8
jb 0x1287e507
mov rcx, qword [rsp + 0x160]
call fcn.12958250
mov qword [rsp + 0x178], 7
mov qword [rsp + 0x170], r15
mov word [rsp + 0x160], r15w
or eax, 0xffffffff
jmp 0x1287ec3b
mov dword [rsi + 0x168], r15d
mov dword [rsi + 0x168], 1
lea r8, [rsi + 0x248]
xor r9d, r9d
lea rdx, [rsp + 0x620]
mov rcx, rsi
call fcn.1287cd50
dec dword [rsi + 0x168]
test eax, eax
jne 0x1287e5ca
lea rcx, [rsp + 0x620]
call fcn.128622a0
nop
lea r9, [fcn.12830470]
mov edx, 0x58
lea r8d, [rdx - 0x4d]
lea rcx, [rsp + 0x250]
call fcn.1295b4c0
nop
cmp qword [rsp + 0x178], 8
jb 0x1287e5a5
mov rcx, qword [rsp + 0x160]
call fcn.12958250
mov qword [rsp + 0x178], 7
mov qword [rsp + 0x170], r15
mov word [rsp + 0x160], r15w
or eax, 0xffffffff
jmp 0x1287ec3b
mov qword [rsp + 0x1c8], 7
mov qword [rsp + 0x1c0], r15
mov word [rsp + 0x1b0], r15w
lea rcx, str.explorer.exe
call fcn.12836ce0
test eax, eax
je 0x1287e7d3
mov r8d, 0x27
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKLM
lea rcx, [rsp + 0x1a8]
call fcn.12803dc0
mov r8d, 1
lea rdx, [0x129c6388]
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
mov r8d, 8
lea rdx, [0x129bf110]
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
mov r8d, 1
lea rdx, [0x129c6388]
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
mov r8d, 0x2c
lea rdx, str.MicrosoftWindows_NTCurrentVersionWinlogon
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
call fcn.1280d740
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x38]
mov r8d, 0x2001f
lea rdx, [rsp + 0x1a8]
call fcn.12837b80
test eax, eax
jne 0x1287e6e8
mov dword [rsp + 0x28], 0x10
lea rdi, str.noshell
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.shell
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1287e6ef
lea rdi, str.noshell
mov r8d, 0x27
lea rdx, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKLM
lea rcx, [rsp + 0x1a8]
call fcn.12803dc0
mov r8d, 1
lea rdx, [0x129c6388]
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
mov r8d, 0x14
lea rdx, str.SoftwareWow6432Node
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
mov r8d, 1
lea rdx, [0x129c6388]
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
mov r8d, 0x2c
lea rdx, str.MicrosoftWindows_NTCurrentVersionWinlogon
lea rcx, [rsp + 0x1a8]
call fcn.12803a10
call fcn.1280d740
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x38]
mov r8d, 0x2001f
lea rdx, [rsp + 0x1a8]
call fcn.12837b80
test eax, eax
jne 0x1287e7d3
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.shell
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r15
cmp dword [0x129abaf4], 0
jne 0x1287ea77
lea r9, str.SoftwareWow6432NodeMicrosoft.NETFramework
lea r8, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKLM
lea rdx, str._s_s
lea rcx, [rsp + 0x1a8]
call fcn.12804810
call fcn.1280d740
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x30]
mov r8d, 0x2001f
lea rdx, [rsp + 0x1a8]
call fcn.12837b80
test eax, eax
jne 0x1287ebdb
mov qword [rsp + 0x1a0], 7
mov qword [rsp + 0x198], r15
mov word [rsp + 0x188], r15w
mov qword [rsp + 0x218], 7
mov qword [rsp + 0x210], r15
mov word [rsp + 0x200], r15w
lea rdx, [0x129beb70]
lea rcx, [rsp + 0x70]
call fcn.12804480
nop
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x70]
call fcn.12888930
nop
cmp qword [rsp + 0x90], 8
jb 0x1287e8b0
mov rcx, qword [rsp + 0x78]
call fcn.12958250
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r15
mov word [rsp + 0x78], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rbx, str.Microsoft.NETFramework
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
lea r12, [rbx + rcx*2]
mov qword [rsp + 0x98], rbx
cmp rbx, r12
je 0x1287e999
mov rax, qword [rsp + 0x198]
test rax, rax
je 0x1287e934
lea rdi, [rax - 1]
cmp rax, rdi
ja 0x1287e913
call fcn.129581ac
lea rax, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 8
cmovae rax, qword [rsp + 0x188]
cmp word [rax + rdi*2], 0x5c
je 0x1287e94a
mov edx, 1
lea r8d, [rdx + 0x5b]
lea rcx, [rsp + 0x180]
call fcn.12803b90
lea rax, [0x129bcb5c]
mov qword [rsp + 0x58], rax
mov edx, 0x4d
nop dword [rax + rax]
movzx ecx, word [rax]
test cx, cx
je 0x1287e986
cmp dx, cx
jne 0x1287e97b
add rbx, 2
mov qword [rsp + 0x98], rbx
jmp 0x1287e986
add rax, 2
mov qword [rsp + 0x58], rax
jmp 0x1287e960
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x180]
call fcn.1281aed0
mov edx, 0x5c
lea rcx, [rsp + 0x180]
call fcn.1280d2e0
mov rdx, qword [rsp + 0x198]
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 8
cmovae rcx, qword [rsp + 0x188]
mov eax, edx
lea eax, [rdx + rdx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallRoot
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x218], 8
jb 0x1287ea20
mov rcx, qword [rsp + 0x200]
call fcn.12958250
mov qword [rsp + 0x218], 7
mov qword [rsp + 0x210], r15
mov word [rsp + 0x200], r15w
cmp qword [rsp + 0x1a0], 8
jb 0x1287ea55
mov rcx, qword [rsp + 0x188]
call fcn.12958250
mov qword [rsp + 0x1a0], 7
mov qword [rsp + 0x198], r15
mov word [rsp + 0x188], r15w
jmp 0x1287ebdb
lea r9, str.SoftwareMicrosoft.NETFramework
lea r8, str.SOFTWAREHopedotVOSSYSTEMREGROOTHKLM
lea rdx, str._s_s
lea rcx, [rsp + 0x1a8]
call fcn.12804810
call fcn.1280d740
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x30]
mov r8d, 0x2001f
lea rdx, [rsp + 0x1a8]
call fcn.12837b80
test eax, eax
jne 0x1287ebdb
mov qword [rsp + 0x1f0], 7
mov qword [rsp + 0x1e8], r15
mov word [rsp + 0x1d8], r15w
mov qword [rsp + 0x240], 7
mov qword [rsp + 0x238], r15
mov word [rsp + 0x228], r15w
lea rdx, [0x129beb70]
lea rcx, [rsp + 0x70]
call fcn.12804480
nop
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x70]
call fcn.12888930
nop
lea rcx, [rsp + 0x70]
call fcn.12803630
xor r8d, r8d
lea rdx, str.Microsoft.NETFramework64
lea rcx, [rsp + 0x1d0]
call fcn.1281b460
mov edx, 0x5c
lea rcx, [rsp + 0x1d0]
call fcn.1280d2e0
mov rdx, qword [rsp + 0x1e8]
mov qword [rsp + 0x150], rdx
lea rcx, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 8
cmovae rcx, qword [rsp + 0x1d8]
mov eax, edx
lea eax, [rdx + rdx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallRoot
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x220]
call fcn.12803630
nop
lea rcx, [rsp + 0x1d0]
call fcn.12803630
mov rcx, rsi
call fcn.12862b00
mov rcx, rsi
call fcn.1287d7f0
nop
lea rcx, [rsp + 0x1a8]
call fcn.12803630
nop
lea rcx, [rsp + 0x620]
call fcn.128622a0
nop
lea r9, [fcn.12830470]
mov edx, 0x58
lea r8d, [rdx - 0x4d]
lea rcx, [rsp + 0x250]
call fcn.1295b4c0
nop
lea rcx, [rsp + 0x158]
call fcn.12803630
xor eax, eax
jmp 0x1287ec3b
mov rcx, qword [rsp + 0x750]
xor rcx, rsp
call fcn.12959850
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret