Function at 0x14003a534
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5c8]
sub rsp, 0x6a0
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov sil, dl
mov byte [rsp + 0x40], dl
mov rbx, rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x50], rcx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
mov eax, dword [0x1401a5978]
lea rdi, [0x14019b9a8]
lea r12d, [r15 + 1]
test r12b, al
jne 0x14003a5d8
or eax, r12d
mov dword [0x1401a5978], eax
mov rcx, rdi
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401a5980], rax
lea rcx, [0x140105270]
call fcn.1400bb7e0
nop
mov eax, dword [0x1401a5978]
test al, 2
jne 0x14003a610
or eax, 2
mov dword [0x1401a5978], eax
mov rcx, rdi
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401a5970], rax
lea rcx, [0x140105240]
call fcn.1400bb7e0
nop
mov eax, dword [0x1401a5978]
test al, 4
jne 0x14003a648
or eax, 4
mov dword [0x1401a5978], eax
mov rcx, rdi
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401a5968], rax
lea rcx, [0x140105210]
call fcn.1400bb7e0
nop
mov eax, dword [0x1401a5978]
test al, 8
jne 0x14003a67a
or eax, 8
mov dword [0x1401a5978], eax
mov rcx, rdi
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401a5988], rax
lea rcx, [0x1401051e0]
call fcn.1400bb7e0
nop
mov rax, qword [0x1401a5970]
cmp dword [rax - 0x10], r15d
je 0x14003a6d4
mov ecx, r15d
mov rax, qword [0x1401a4eb0]
test rax, rax
setne cl
test ecx, ecx
jne 0x14003a6a6
mov ecx, 0x80004005
call fcn.14000187c
int3
mov rcx, qword [0x1401a5988]
sub rax, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003a6c7
add rcx, 2
test dx, dx
jne 0x14003a6b0
mov eax, r15d
jmp 0x14003a6cc
sbb eax, eax
or eax, r12d
test eax, eax
je 0x14003b0d8
lea rdx, [0x1401a4eb0]
lea rcx, [0x1401a5988]
call fcn.1400021c4
lea rcx, [0x1401a5980]
call fcn.140002054
lea rcx, [0x1401a5970]
call fcn.140002054
lea rcx, [0x1401a5968]
call fcn.140002054
mov r13d, r15d
mov rcx, rdi
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rcx, rdi
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rdi, 0xffffffff80000001
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, 0x82
test eax, eax
jne 0x14003a99a
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003a989
mov edi, 0x104
mov dword [rsp + 0x44], edi
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14003a7d3
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.14000239c
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003a82c
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bbd4c
test eax, eax
js 0x14003a821
cmp eax, dword [rbx - 0xc]
jg 0x14003a821
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
jmp 0x14003a83b
mov ecx, 0x80070057
call fcn.14000187c
int3
lea rcx, [rsp + 0x58]
call fcn.140002054
mov rbx, qword [rsp + 0x58]
mov dword [rsp + 0x44], edi
mov rax, qword [0x1401a5980]
mov edx, r12d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r14d
or ecx, edx
jge 0x14003a86c
mov edx, r14d
lea rcx, [0x1401a5980]
call fcn.14000239c
mov rax, qword [0x1401a5980]
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003a8db
mov rcx, qword [0x1401a5980]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400bbd4c
mov rcx, rax
test eax, eax
js 0x14003a8d0
mov rax, qword [0x1401a5980]
cmp ecx, dword [rax - 0xc]
jg 0x14003a8d0
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401a5980]
mov word [rax + rcx*2], r15w
jmp 0x14003a8e7
mov ecx, 0x80070057
call fcn.14000187c
int3
lea rcx, [0x1401a5980]
call fcn.140002054
mov dword [rsp + 0x44], edi
mov rax, qword [rsp + 0x60]
mov ecx, r12d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14003a90d
mov edx, r14d
lea rcx, [rsp + 0x60]
call fcn.14000239c
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003a96b
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400bbd4c
test eax, eax
js 0x14003a960
cmp eax, dword [rdi - 0xc]
jg 0x14003a960
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r15w
jmp 0x14003a97c
mov ecx, 0x80070057
call fcn.14000187c
int3
lea rdx, [0x1401a5980]
lea rcx, [rsp + 0x60]
call fcn.1400021c4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003a99a
lea rdx, [0x1401a5980]
lea rcx, [rsp + 0x60]
call fcn.1400021c4
call fcn.14003a30c
test al, al
je 0x14003adcc
mov dil, r12b
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ac35
mov dword [rsp + 0x44], 0x104
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14003aa03
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.14000239c
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003abd8
mov r9d, dword [0x1401a3d80]
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x13
jne 0x14003aacc
mov esi, r15d
lea r14, [rbp - 0x40]
mov r10d, r15d
lea edi, [r10 + 1]
lea ecx, [rsi + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, esi
imul r8d, ecx
mov eax, r9d
cdq
idiv edi
add r8d, eax
sub r8d, r10d
mov dword [r14], r8d
mov edx, r8d
lea rcx, [0x140131288]
call fcn.1400bb9dc
mov r10d, edi
add r14, 4
cmp edi, 9
jge 0x14003aabb
mov r9d, dword [0x1401a3d80]
jmp 0x14003aa6f
add esi, r12d
cmp esi, 6
jge 0x14003aacc
mov r9d, dword [0x1401a3d80]
jmp 0x14003aa6c
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bbd4c
test eax, eax
js 0x14003abc2
cmp eax, dword [rbx - 0xc]
jg 0x14003abc2
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
mov r8d, dword [0x1401a3d80]
mov eax, r8d
imul eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x14003ab15
sub eax, r12d
or eax, 0xfffffff0
add eax, r12d
cmp eax, 0xc
jne 0x14003ab8b
xor r13d, r13d
mov r10d, r13d
lea r9, [rbp + 0x1b0]
mov dil, r8b
sub dil, r10b
mov r11d, r12d
mov esi, 0xa
mov r14, r13
mov eax, r8d
cdq
idiv r11d
mov r12d, edx
mov r15d, 1
mov eax, r8d
cdq
idiv r15d
mov ecx, eax
mov al, r12b
imul cl
mov cl, al
mov al, dil
imul cl
mov byte [r14 + r9], al
inc r15d
inc r14
cmp r14, 0xb
jl 0x14003ab48
mov r12d, 1
add r11d, r12d
add r9, 0xb
sub rsi, r12
jne 0x14003ab35
add r10d, r12d
cmp r10d, 9
jl 0x14003ab27
xor r15d, r15d
mov dil, r15b
cmp dword [rbx - 0x10], r15d
jl 0x14003abcd
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400bbf1c
mov sil, byte [rsp + 0x40]
mov r14d, 0x82
test rax, rax
je 0x14003abd8
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14003abd8
mov r13d, r12d
jmp 0x14003abd8
mov ecx, 0x80070057
call fcn.14000187c
int3
mov sil, byte [rsp + 0x40]
mov r14d, 0x82
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xa
jne 0x14003ac2c
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401a3d80]
test dil, dil
je 0x14003ad7d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ad73
mov dword [rsp + 0x44], 0x104
mov r9d, dword [0x1401a3d80]
lea r8d, [r9 + 2]
lea eax, [r9 + 1]
imul r8d, eax
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 9
jne 0x14003acc8
mov r8d, r15d
test r9d, r9d
je 0x14003acc1
mov ecx, r9d
and ecx, r12d
add r8d, ecx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x14003acab
mov dword [0x1401a3d80], r8d
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14003acea
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.14000239c
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bbd4c
test eax, eax
js 0x14003ad68
cmp eax, dword [rbx - 0xc]
jg 0x14003ad68
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
call fcn.14003a1a8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], r15d
jl 0x14003ad76
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400bbf1c
test rax, rax
je 0x14003ad76
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14003ad73
jmp 0x14003ad76
mov ecx, 0x80070057
call fcn.14000187c
int3
mov r13d, r12d
mov r8d, dword [0x1401a3d80]
imul r8d, r8d
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x14003adcf
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x14003adcf
mov r13d, r12d
or ebx, 0xffffffff
cmp qword [0x14019ed48], 0xffffffff80000002
je 0x14003ae39
test r13d, r13d
je 0x14003ae62
call fcn.14003a338
test al, al
je 0x14003ae39
cmp byte [0x1401a3ea4], r15b
jne 0x14003ae39
lea rdx, str.Software_
lea rcx, [rsp + 0x70]
call fcn.1400020f8
nop
mov rdx, rax
lea rcx, [0x1401a5970]
call fcn.1400021c4
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003ae4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003ae4c
lea rdx, [0x1401a4eb0]
lea rcx, [0x1401a5970]
call fcn.1400021c4
lea rdx, [rsp + 0x60]
lea rcx, [0x1401a5980]
call fcn.1400021c4
jmp 0x14003af21
call fcn.14003a3b0
test al, al
jne 0x14003ae84
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401a5980]
call fcn.14000e4ec
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp - 0x80]
call fcn.1400020f8
nop
mov rdx, rax
lea rcx, [0x1401a5970]
call fcn.1400021c4
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003aec3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x11
jne 0x14003af21
mov r9d, r15d
lea r10, [rbp + 0xa0]
mov r11d, r8d
lea ecx, [r8 + r9]
mov eax, r11d
cdq
idiv ecx
mov dword [r10], edx
add r9d, r12d
sub r11d, r12d
lea r10, [r10 + 4]
movsxd rax, r9d
cmp rax, 0x44
jb 0x14003af01
mov rcx, qword [0x1401a5970]
cmp dword [rcx - 0x10], r15d
jl 0x14003af62
lea rdx, str.windows_ie_ac_001
call fcn.1400bbf1c
test rax, rax
je 0x14003af62
sub rax, qword [0x1401a5970]
sar rax, 1
test eax, eax
jle 0x14003af62
lea rdx, [0x1401a4eb0]
lea rcx, [0x1401a5968]
call fcn.1400021c4
jmp 0x14003afda
call fcn.14003a338
test al, al
je 0x14003af9b
cmp byte [0x1401a3ea4], r15b
jne 0x14003af9b
lea rdx, str.Software_
lea rcx, [rbp - 0x68]
call fcn.1400020f8
nop
mov rdx, rax
lea rcx, [0x1401a5968]
call fcn.1400021c4
nop
mov rdx, qword [rbp - 0x68]
jmp 0x14003afc0
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp - 0x78]
call fcn.1400020f8
nop
mov rdx, rax
lea rcx, [0x1401a5968]
call fcn.1400021c4
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003afda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x14019ed48], 0xffffffff80000002
je 0x14003b06c
cmp byte [0x14019ec12], r15b
je 0x14003b06c
lea rcx, [rbp - 0x70]
call fcn.14003a260
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401a5970]
call fcn.14000e4ec
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b030
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x60]
call fcn.14003a260
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401a5968]
call fcn.14000e4ec
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b06c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x14019ed48]
lea rcx, [0x1401a5970]
call fcn.14003b134
mov rdx, qword [0x14019ed48]
lea rcx, [0x1401a5968]
call fcn.14003b134
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b0b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b0d3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
test sil, sil
je 0x14003b0ee
lea rdx, [0x1401a5968]
call fcn.140002cf8
jmp 0x14003b0fa
lea rdx, [0x1401a5970]
call fcn.140002cf8
mov dword [rsp + 0x68], r12d
mov rax, rbx
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret