Function at 0x140156640
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3d8]
sub rsp, 0x4d8
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov edi, 0x1e
mov esi, edx
mov rdx, qword [0x1402cb8c0]
cmp r8, rdi
mov r12, rcx
cmovae rdi, r8
mov qword [rsp + 0x40], rdi
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov r11, rax
mov qword [rsp + 0x38], rcx
mov r15d, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [r11 + 8], rax
mov word [rdi + rax], cx
test byte [0x1402c6ba0], 1
mov rbx, qword [r11 + 8]
jne 0x140156797
lock bts qword [0x1402c6ba0], 0x1f
setb al
test al, al
jne 0x14015677b
mov r9d, 4
lea r8, [rbp - 0x70]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140156713
mov rax, qword ds:[rbp - 0x70]
test ax, ax
je 0x140156713
cmp word [rbp - 0x6e], r15w
jne 0x140156713
mov word [0x1402c1518], ax
mov r9d, 4
lea r8, [rbp - 0x70]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14015674e
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x14015674e
nop word [rax + rax]
cmp word [rbp - 0x6e], r15w
jne 0x14015674e
mov word [0x1402c2118], ax
cmp word [0x1402c1518], 0x2e
je 0x14015676d
lea rdx, [0x140239898]
xor ecx, ecx
call fcn.1401f42b8
mov qword [0x1402cebd8], rax
lea rcx, [0x1402c6ba0]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x140156792
test byte [0x1402c6ba0], 1
jne 0x140156797
xor edx, edx
lea rcx, [0x1402c6ba0]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r11, qword [rsp + 0x30]
test esi, esi
je 0x140157eaf
mov qword [rsp + 0x518], r13
lea r8, [0x140000000]
mov qword [rsp + 0x4d0], r14
mov edx, 1
movaps xmmword [rsp + 0x4c0], xmm6
mov r9d, 0xa2
movsd xmm6, qword [0x140291b80]
mov r10d, 2
movaps xmmword [rsp + 0x4b0], xmm7
movsd xmm7, qword [0x140291b30]
nop word [rax + rax]
mov r14, r12
mov qword [rsp + 0x58], r12
add r12, 0x20
mov qword [rbp - 0x80], r15
dec esi
mov qword [rbp - 0x78], r12
xor r11d, r11d
mov dword [rsp + 0x6c], esi
mov r13d, dword [r14]
mov r12d, r11d
mov eax, r13d
and eax, 0x3f
cmp eax, 0xd
ja case.default.0x140156834
mov ecx, dword [r8 + rax*4 + 0x157ee4]
add rcx, r8
jmp rcx
lea rsi, [r15 + 2]
cmp rdi, rsi
jae 0x1401568ba
mov rdx, qword [0x1402cb8c0]
lea rax, ds:[rdi + rdi]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020be40
lea rcx, ds:[rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401568aa
call fcn.140142200
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r15*2]
movzx eax, word [r14 + 0x10]
mov r15, rsi
mov word [rbx], ax
add rbx, 2
mov qword [rsp + 0x38], rsi
jmp case.default.0x140156834
mov rcx, qword [r14 + 0x10]
add rcx, r15
cmp rdi, rcx
jae 0x14015695d
mov rdx, qword [0x1402cb8c0]
lea rax, ds:[rdi + rdi]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020be40
lea rcx, ds:[rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015694a
call fcn.140142200
mov rax, qword [rdi + 8]
mov rcx, r15
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov r8, qword [r14 + 0x10]
mov rcx, rbx
mov rdx, qword [r14 + 0x18]
call fcn.14020be40
mov rax, qword [r14 + 0x10]
shr rax, 1
add r15, qword [r14 + 0x10]
jmp 0x140157d23
mov rdi, qword [r14 + 0x10]
xorps xmm1, xmm1
mov rdx, rdi
mov ecx, edi
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401569b4
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x1401569b0
mov edx, ecx
shr rdx, 1
jmp 0x1401569f8
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
jne 0x1401569ea
nop dword [rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x1401569d0
sub rdx, rdi
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov r8, qword [rsp + 0x40]
lea rdi, [rdx + rdx]
lea rsi, [rdi + r15]
cmp r8, rsi
jae 0x140156a82
mov rdx, qword [0x1402cb8c0]
lea rax, [r8 + r8]
cmp rax, rsi
mov r12, rsi
cmovae r12, rax
mov qword [rsp + 0x40], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.14020be40
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156a72
call fcn.140142200
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + r15*2]
mov rdx, qword [r14 + 0x10]
mov r8, rdi
mov rcx, rbx
call fcn.14020be40
shr rdi, 1
mov r15, rsi
mov qword [rsp + 0x38], rsi
lea rbx, [rbx + rdi*2]
jmp case.default.0x140156834
cmp r13d, 3
jne 0x140156ab5
mov rsi, qword [r14 + 0x18]
mov rdi, qword [r14 + 0x10]
jmp 0x140156ac9
mov rsi, qword [r14 + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], r11b
jne 0x140156ac0
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop word [rax + rax]
test eax, eax
js case.default.0x140156834
lfence
mov edx, dword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
lea rcx, [r15 + rdx]
cmp r8, rcx
jae 0x140156b88
mov rdx, qword [0x1402cb8c0]
lea rax, [r8 + r8]
cmp rax, rcx
mov r12, rcx
cmovae r12, rax
mov qword [rsp + 0x40], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.14020be40
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156b71
call fcn.140142200
mov rax, qword [rbx + 8]
mov rcx, r15
mov edx, dword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov r9, rsi
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax + rax]
test eax, eax
js case.default.0x140156834
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
add r15, rcx
jmp 0x140157d23
mov eax, dword [r14 + 0x10]
mov r12d, eax
mov r8d, eax
shr r12d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x140156bd6
mov r8d, dword [r14 + 0x10]
mov r10d, 0xa
bt r13d, 8
jae 0x140156bf3
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x140156bf3
cmp al, 0x45
ja 0x140156bf3
mov r10d, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028c560]
mov r14d, r11d
cmovae r9, rax
lea rsi, [rbp + 0x39e]
test r8d, r8d
je 0x140156ca2
bt r13d, 0x10
jae 0x140156c80
mov edi, r11d
nop word [rax + rax]
xor edx, edx
mov eax, r8d
div r10d
inc r14d
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rsi], cx
sub rsi, 2
cmp edi, 3
jne 0x140156c68
test eax, eax
je 0x140156c6c
movzx eax, word [0x1402c2118]
mov word [rsi], ax
sub rsi, 2
inc r14d
jmp 0x140156c24
test eax, eax
jne 0x140156c30
mov rdi, qword [rsp + 0x40]
mov edx, 1
test r12d, r12d
je 0x140156cba
mov ecx, edx
jmp 0x140156cc5
xor edx, edx
mov eax, r8d
div r10d
inc r14d
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rsi], cx
sub rsi, 2
test eax, eax
jne 0x140156c80
nop
jmp 0x140156c71
mov eax, 0x30
lea rsi, [rbp + 0x39c]
mov word [rbp + 0x39e], ax
mov r14d, edx
jmp 0x140156c76
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
mov r13, qword [rsp + 0x58]
jne 0x140156cf8
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140156cf8
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x64], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp rdi, r15
jae 0x140156d83
mov rdx, qword [0x1402cb8c0]
lea rax, [rdi + rdi]
cmp rax, r15
mov rbx, r15
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov r8, rbx
mov rdx, qword [rdx + 8]
call fcn.14020be40
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156d73
call fcn.140142200
mov rax, qword [rdi + 8]
shr rbx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rbx*2]
test r12b, 1
je 0x140156d90
mov word [rbx], 0x2d
jmp 0x140156d9f
test dword [r13], 0x20000
je 0x140156da3
mov word [rbx], 0x2b
add rbx, 2
test r12b, 4
je 0x140156dc7
mov edx, dword [rsp + 0x64]
test rdx, rdx
je 0x140156dc3
mov eax, 0x30
mov rdi, rbx
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rbx, [rbx + rdx*2]
mov edi, r14d
lea rdx, [rsi + 2]
add rdi, rdi
mov rcx, rbx
mov r8, rdi
call fcn.14020be40
mov r14, qword [rsp + 0x58]
add rbx, rdi
jmp 0x140157d27
mov ecx, 0x10
mov rax, r14
mov rax, qword [rcx + rax]
mov r12, rax
mov rdi, rax
shr r12, 0x3f
neg rdi
cmovs rdi, rax
jmp 0x140156e0c
mov rdi, qword [r14 + 0x10]
mov r9d, 0xa
bt r13d, 8
jae 0x140156e2b
movzx eax, byte ds:[r14 + 0xa]
cmp al, 2
jb 0x140156e2b
cmp al, 0x45
ja 0x140156e2b
mov r9d, eax
bt r13d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028c560]
mov r14d, r11d
cmovae r10, rax
lea rsi, [rbp + 0x39e]
test rdi, rdi
je 0x140156eee
bt r13d, 0x10
jae 0x140156ec0
mov r8d, r11d
nop
xor edx, edx
mov rax, rdi
div r9
mov rax, rdi
inc r14d
mov rcx, rdx
inc r8d
xor edx, edx
div r9
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r10]
mov word [rsi], cx
sub rsi, 2
cmp r8d, 3
jne 0x140156ea8
test rdi, rdi
je 0x140156ead
movzx eax, word [0x1402c2118]
mov word [rsi], ax
sub rsi, 2
inc r14d
jmp 0x140156e5c
test rdi, rdi
jne 0x140156e60
mov edx, 1
test r12d, r12d
je 0x140156f06
mov ecx, edx
jmp 0x140156f11
xor edx, edx
mov rax, rdi
div r9
mov rax, rdi
inc r14d
mov rcx, rdx
xor edx, edx
div r9
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r10]
mov word [rsi], cx
sub rsi, 2
test rdi, rdi
jne 0x140156ec0
jmp 0x140156ead
mov eax, 0x30
lea rsi, [rbp + 0x39c]
mov word [rbp + 0x39e], ax
mov r14d, edx
jmp 0x140156eb2
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
mov r13, qword [rsp + 0x58]
jne 0x140156f44
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140156f44
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x68], eax
add ecx, eax
mov r8, qword [rsp + 0x40]
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp r8, r15
jae 0x140156fd5
mov rdx, qword [0x1402cb8c0]
lea rax, [r8 + r8]
cmp rax, r15
mov rbx, r15
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
xor edx, edx
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, qword [rax + 8]
call fcn.14020be40
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156fc5
nop
call fcn.140142200
mov rax, qword [rdi + 8]
shr rbx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rbx*2]
test r12b, 1
je 0x140156fe2
mov word [rbx], 0x2d
jmp 0x140156ff1
test dword [r13], 0x20000
je 0x140156ff5
mov word [rbx], 0x2b
add rbx, 2
test r12b, 4
je 0x140156dc7
mov edx, dword [rsp + 0x68]
jmp 0x140156dad
test r13b, 0x40
je 0x14015701d
movzx r8d, word [r14 + 4]
cmp r8d, r9d
jbe 0x140157023
mov r8d, r9d
jmp 0x140157023
mov r8d, 6
movss xmm0, dword [r14 + 0x10]
lea r9, [rbp - 0x5f]
mov edx, r13d
lea r15, [rbp - 0x5f]
call fcn.1401d5980
test al, al
jne 0x140157043
mov byte [rbp - 0x5f], r12b
jmp 0x140157097
mov rdx, qword [0x1402cebd8]
test rdx, rdx
je 0x14015707a
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test al, al
je 0x14015707a
nop dword [rax + rax]
cmp al, 0x2e
je 0x140157071
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157060
jmp 0x14015707a
movzx eax, byte [0x1402c1518]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x140157097
lea rcx, [rbp - 0x5f]
test rdx, rdx
je 0x140157092
call fcn.1401f38e4
jmp 0x140157097
call fcn.1401f3884
mov r9d, dword ds:[r14]
bt r9d, 0xf
jae 0x140157131
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x1402c1518]
test al, al
je 0x1401570d0
nop word [rax + rax]
cmp al, r8b
je 0x1401570d0
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401570c0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140157131
movzx eax, byte ds:[rcx]
test al, al
je 0x1401570f5
sub al, 0x45
test al, 0xdf
je 0x1401570f5
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401570e4
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14015710f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140157104
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140157120
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x140157140
cmp byte [rbp - 0x5f], 0x2d
jne 0x140157162
dec r14d
lea r15, [rbp - 0x5e]
xor ecx, ecx
mov r12d, 1
jmp 0x140157173
bt r9d, 0x11
mov eax, 2
mov rcx, r12
cmovb r12d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14015732e
movzx eax, byte [r15]
mov rsi, r15
sub al, 0x30
mov qword [rsp + 0x50], r15
cmp al, 0xa
jae 0x1401571ad
nop dword [rax]
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x1401571a0
mov r13d, esi
sub r13d, r15d
lea edi, [r13 + 2]
je 0x1401571c8
mov eax, 0xaaaaaaab
mul edi
mov eax, edx
shr eax, 1
dec eax
jmp 0x1401571ca
mov eax, ecx
mov r8, qword [rsp + 0x40]
lea ecx, [rax + r14]
add ecx, ecx
mov dword [rsp + 0x48], eax
test r12d, r12d
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x38]
add rcx, rax
cmp r8, rcx
jae 0x14015727a
lea rax, [r8 + r8]
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402cb8c0]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword [rsp + 0x40]
mov rbx, rax
xor edx, edx
mov qword [rax], r8
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [r8 + rcx], dx
mov r8, qword [rsp + 0x38]
mov rcx, qword [rbx + 8]
mov rdx, qword [rax + 8]
call fcn.14020be40
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157265
nop
call fcn.140142200
mov rcx, qword [rsp + 0x38]
mov rax, qword [rbx + 8]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, 1
je 0x140157298
mov word [rbx], 0x2d
jmp 0x1401572a3
test r12b, 2
je 0x1401572a7
mov word [rbx], 0x2b
add rbx, 2
test r13d, r13d
je 0x1401572f0
nop dword [rax]
movsx eax, byte [r15]
dec ecx
mov word [rbx], ax
inc r15
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x1401572ec
test ecx, ecx
je 0x1401572f0
movzx eax, word [0x1402c2118]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r15]
mov word [rbx + 2], ax
add rbx, 4
inc r15
test ecx, ecx
jne 0x1401572b0
mov r15, qword [rsp + 0x38]
test r12d, r12d
je 0x1401572fe
add r15, 2
sub r14d, r13d
mov r8, rbx
mov edx, r14d
mov rcx, rsi
mov edi, r14d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x48]
lea rbx, [rbx + r14*2]
mov r14, qword [rsp + 0x58]
add ecx, r13d
add rcx, rdi
lea r15, [r15 + rcx*2]
jmp 0x140157d27
test r12d, r12d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x14015736d
mov r13, qword [rsp + 0x58]
mov edi, r14d
movzx r8d, word [r13 + 6]
lea rax, [rdx + rdi]
cmp rax, r8
jae 0x14015736d
mov ecx, r8d
or r12d, 4
sub rcx, rdi
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x70], rax
mov r13, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rsi, [rax*2]
add rsi, r13
cmp r8, rsi
jae 0x140157402
mov rdx, qword [0x1402cb8c0]
lea rax, [r8 + r8]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020be40
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401573f2
call fcn.140142200
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r13*2]
test r12b, 1
je 0x14015740f
mov word [rbx], 0x2d
jmp 0x14015741a
test r12b, 2
je 0x14015741e
mov word [rbx], 0x2b
add rbx, 2
nop
test r12b, 4
je 0x140157445
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140157441
mov eax, 0x30
mov rdi, rbx
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rbx, [rbx + rdx*2]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea rbx, [rbx + r14*2]
mov qword [rsp + 0x38], rsi
mov r14, qword [rsp + 0x58]
mov r15, rsi
jmp case.default.0x140156834
test r13b, 0x40
je 0x14015747e
movzx r8d, word [r14 + 4]
cmp r8d, r9d
jbe 0x140157484
mov r8d, r9d
jmp 0x140157484
mov r8d, 6
movsd xmm0, qword [r14 + 0x10]
lea r9, [rbp - 0x5f]
mov edx, r13d
lea r15, [rbp - 0x5f]
call fcn.1401d5c00
test al, al
jne 0x1401574a4
mov byte [rbp - 0x5f], r12b
jmp 0x1401574f7
mov rdx, qword [0x1402cebd8]
test rdx, rdx
je 0x1401574da
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test al, al
je 0x1401574da
nop dword [rax]
cmp al, 0x2e
je 0x1401574d1
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401574c0
jmp 0x1401574da
movzx eax, byte [0x1402c1518]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x1401574f7
lea rcx, [rbp - 0x5f]
test rdx, rdx
je 0x1401574f2
call fcn.1401f38e4
jmp 0x1401574f7
call fcn.1401f3884
mov r9d, dword ds:[r14]
bt r9d, 0xf
jae 0x140157591
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x1402c1518]
test al, al
je 0x140157530
nop word [rax + rax]
cmp al, r8b
je 0x140157530
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157520
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140157591
movzx eax, byte ds:[rcx]
test al, al
je 0x140157555
sub al, 0x45
test al, 0xdf
je 0x140157555
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157544
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14015756f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140157564
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140157580
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x1401575a0
cmp byte [rbp - 0x5f], 0x2d
jne 0x1401575c2
dec r14d
lea r15, [rbp - 0x5e]
xor ecx, ecx
mov r12d, 1
jmp 0x1401575d3
bt r9d, 0x11
mov eax, 2
mov rcx, r12
cmovb r12d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x140157759
movzx eax, byte [r15]
mov rsi, r15
sub al, 0x30
mov qword [rsp + 0x50], r15
cmp al, 0xa
jae 0x14015760d
nop dword [rax]
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x140157600
mov r13d, esi
sub r13d, r15d
lea edi, [r13 + 2]
je 0x140157628
mov eax, 0xaaaaaaab
mul edi
mov eax, edx
shr eax, 1
dec eax
jmp 0x14015762a
mov eax, ecx
mov r8, qword [rsp + 0x40]
lea ecx, [rax + r14]
add ecx, ecx
mov dword [rsp + 0x48], eax
test r12d, r12d
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x38]
add rcx, rax
cmp r8, rcx
jae 0x1401576da
lea rax, [r8 + r8]
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402cb8c0]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword [rsp + 0x40]
mov rbx, rax
xor edx, edx
mov qword [rax], r8
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rcx + r8], dx
mov r8, qword [rsp + 0x38]
mov rcx, qword [rbx + 8]
mov rdx, qword [rax + 8]
call fcn.14020be40
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401576c5
nop
call fcn.140142200
mov rcx, qword [rsp + 0x38]
mov rax, qword [rbx + 8]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, 1
je 0x1401576f8
mov word [rbx], 0x2d
jmp 0x140157703
test r12b, 2
je 0x140157707
mov word [rbx], 0x2b
add rbx, 2
test r13d, r13d
je 0x1401572f0
movsx eax, byte [r15]
dec ecx
mov word [rbx], ax
inc r15
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x140157750
test ecx, ecx
je 0x1401572f0
movzx eax, word [0x1402c2118]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r15]
mov word [rbx + 2], ax
add rbx, 4
inc r15
test ecx, ecx
jne 0x140157710
jmp 0x1401572f0
test r12d, r12d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x14015779a
mov r13, qword ds:[rsp + 0x58]
mov edi, r14d
movzx r8d, word [r13 + 6]
lea rax, [rdx + rdi]
cmp rax, r8
jae 0x14015779a
mov ecx, r8d
or r12d, 4
sub rcx, rdi
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x78], rax
mov r13, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rsi, [rax*2]
add rsi, r13
cmp r8, rsi
jae 0x14015782f
mov rdx, qword [0x1402cb8c0]
lea rax, [r8 + r8]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020be40
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015781f
call fcn.140142200
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r13*2]
test r12b, 1
je 0x14015783c
mov word [rbx], 0x2d
jmp 0x14015784b
nop dword [rax]
test r12b, 2
je 0x14015784f
mov word [rbx], 0x2b
add rbx, 2
test r12b, 4
je 0x140157445
mov rdx, qword ds:[rsp + 0x78]
jmp 0x14015742b
mov rdx, qword [r14 + 0x10]
xorps xmm0, xmm0
test rdx, rdx
js 0x140157878
cvtsi2sd xmm0, rdx
jmp 0x140157890
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140157930
lea rsi, ds:[r15 + 2]
cmp rdi, rsi
jae 0x14015791a
mov rdx, qword [0x1402cb8c0]
lea rax, [rdi + rdi]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020be40
lea rcx, ds:[rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015790a
call fcn.140142200
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r15*2]
mov word [rbx], 0x30
mov r15, rsi
add rbx, 2
mov qword [rsp + 0x38], rsi
jmp case.default.0x140156834
bt r13d, 8
jae 0x14015793e
movzx eax, byte [r14 + 0xa]
jmp 0x140157944
mov eax, dword [0x1402c8240]
comisd xmm0, xmm6
jb 0x140157968
nop word [rax + rax]
cmp r12d, 7
jae 0x140157968
cmp r12d, eax
jae 0x140157968
mulsd xmm0, xmm7
inc r12d
comisd xmm0, xmm6
jae 0x140157950
test r13b, 0x40
je 0x140157975
movzx eax, word [r14 + 4]
jmp 0x140157978
mov eax, r10d
movzx r8d, ax
lea r14, [rbp - 0x5f]
cmp r8d, r9d
mov dword [rsp + 0x48], r11d
mov edx, 0x1804c
cmova r8d, r9d
lea r9, [rbp - 0x5f]
call fcn.1401d5c00
movzx r8d, word [0x1402c1518]
test al, al
jne 0x1401579ad
xor dl, dl
mov byte [rbp - 0x5f], dl
jmp 0x1401579df
cmp qword [0x1402cebd8], 0
movzx edx, byte [rbp - 0x5f]
je 0x1401579df
lea rcx, ds:[rbp - 0x5f]
test dl, dl
je 0x1401579df
movzx eax, dl
cmp al, 0x2e
je 0x1401579d8
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401579c7
jmp 0x1401579df
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x140157a04
movzx eax, dl
nop word [rax + rax]
cmp al, r8b
je 0x140157a04
movzx eax, byte ds:[rcx + 1]
inc rcx
test al, al
jne 0x1401579f0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140157a68
movzx eax, byte [rcx]
test al, al
je 0x140157a26
sub al, 0x45
test al, 0xdf
je 0x140157a26
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157a15
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140157a3f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140157a34
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140157a50
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x140157a73
nop dword [rax]
cmp dl, 0x2d
jne 0x140157a99
mov r9d, 1
lea r14, [rbp - 0x5e]
mov dword [rsp + 0x48], r9d
dec r15d
jmp 0x140157a9e
mov r9d, dword [rsp + 0x48]
movzx eax, byte [r14]
mov rsi, r14
sub al, 0x30
mov qword [rsp + 0x50], r14
cmp al, 0xa
jae 0x140157abd
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x140157ab0
mov r8d, esi
sub r8d, r14d
mov dword [rsp + 0x50], r8d
lea edi, [r8 + 2]
je 0x140157ae2
mov eax, 0xaaaaaaab
mul edi
mov r13d, edx
shr r13d, 1
dec r13d
jmp 0x140157ae7
xor eax, eax
mov r13d, eax
mov r10, qword [rsp + 0x38]
lea ecx, [r15 + r13]
add ecx, ecx
test r9d, r9d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x40]
add rcx, r10
cmp rax, rcx
jae 0x140157ba7
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402cb8c0]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword ds:[rsp + 0x38]
mov rbx, rax
mov rax, qword [rsp + 0x40]
lea rcx, [rbx + 0x10]
xor edx, edx
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov word [rcx + rax], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov rdx, qword [rax + 8]
call fcn.14020be40
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157b85
nop dword [rax]
call fcn.140142200
mov r10, qword [rsp + 0x38]
mov rax, qword [rbx + 8]
mov rcx, r10
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x48]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r8d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9d, r9d
je 0x140157bc6
mov word [rbx], 0x2d
add rbx, 2
test r8d, r8d
je 0x140157c10
nop dword [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [rbx], ax
inc r14
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x140157c0c
test ecx, ecx
je 0x140157c10
movzx eax, word [0x1402c2118]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r14]
mov word [rbx + 2], ax
add rbx, 4
inc r14
test ecx, ecx
jne 0x140157bd0
test r9d, r9d
je 0x140157c1e
add r10, 2
mov qword [rsp + 0x38], r10
sub r15d, r8d
mov rcx, rsi
mov edx, r15d
mov r8, rbx
mov edi, r15d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x50]
lea rbx, [rbx + r15*2]
mov rax, qword [rsp + 0x38]
lea r15, [0x140000000]
mov r8, qword [rsp + 0x40]
add ecx, r13d
add rcx, rdi
mov r14d, r12d
add r14, r14
lea rsi, [rax + rcx*2]
mov rcx, qword [r15 + r14*8 + 0x2c6bb0]
lea rax, [rsi + 2]
add rax, rcx
cmp r8, rax
jae 0x140157cea
mov rdx, qword [0x1402cb8c0]
lea rbx, [rcx + 2]
lea rax, [r8 + r8]
add rbx, rsi
cmp rax, rbx
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov r8, rsi
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.14020be40
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157cd7
call fcn.140142200
mov rax, qword [rdi + 8]
mov rcx, rsi
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov word [rbx], 0x20
lea rcx, [rbx + 2]
mov r8, qword [r15 + r14*8 + 0x2c6bb0]
mov rdx, qword [r15 + r14*8 + 0x2c6bb8]
call fcn.14020be40
mov rcx, qword [r15 + r14*8 + 0x2c6bb0]
mov r14, qword [rsp + 0x58]
lea rax, [rcx + 2]
shr rax, 1
lea r15, [rcx + 2]
add r15, rsi
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x38], r15
mov rdi, r15
sub rdi, qword [rbp - 0x80]
test dword [r14], 0xc0000000
je 0x140157e5d
movzx esi, word [r14 + 6]
add rsi, rsi
cmp rdi, rsi
jae 0x140157e5d
mov r12, qword [rsp + 0x40]
sub rsi, rdi
lea r13, [rsi + r15]
cmp r12, r13
jae 0x140157de0
mov rdx, qword [0x1402cb8c0]
lea rax, [r12 + r12]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x40], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov r8, r15
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [r12 + rcx], ax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov rdx, qword [r12 + 8]
call fcn.14020be40
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157dd0
call fcn.140142200
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + r15*2]
mov eax, dword [r14]
test al, al
jns 0x140157dee
movzx r12d, word [r14 + 8]
jmp 0x140157df4
mov r12d, 0x20
shr rsi, 1
test eax, eax
jns 0x140157e18
nop dword [rax + rax]
test rsi, rsi
je 0x140157e12
movzx eax, r12w
mov rdi, rbx
mov rcx, rsi
rep stosw word [rdi], ax
lea r14, [rsi + rsi]
jmp 0x140157e52
lfence
mov rax, rdi
lea r14, [rsi + rsi]
shr rax, 1
mov r15, rbx
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [r15 + r14]
call fcn.14020be40
nop dword [rax]
test rsi, rsi
je 0x140157e52
movzx eax, r12w
mov rdi, r15
mov rcx, rsi
rep stosw word [rdi], ax
add rbx, r14
mov qword [rsp + 0x38], r13
mov r15, r13
mov esi, dword [rsp + 0x6c]
lea r8, [0x140000000]
mov rdi, qword [rsp + 0x40]
mov edx, 1
mov r12, qword [rbp - 0x78]
mov r9d, 0xa2
mov r10d, 2
test esi, esi
jne 0x1401567f0
movaps xmm7, xmmword [rsp + 0x4b0]
movaps xmm6, xmmword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x518]
mov r11, qword [rsp + 0x30]
mov rcx, qword [r11 + 8]
mov qword [r11], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r11
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x4d8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret