Function at 0x140011810
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get common file path
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13a0]
mov eax, 0x14a0
call fcn.140007d80
sub rsp, rax
lea rcx, [rbp + 0x182]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x180], bx
call fcn.1400033f0
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call fcn.1400033f0
lea rcx, [rbp + 0x391]
xor edx, edx
mov r8d, 0xffd
mov dword [rbp + 0x13e0], ebx
mov byte [rbp + 0x390], bl
call fcn.1400033f0
mov eax, 0x40
mov dword [rsp + 0x68], 0xf7a4a6
movdqa xmm0, xmmword [0x14001f370]
movdqa xmm1, xmmword [0x14001f360]
mov ecx, eax
lea r15, [0x140000000]
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm1
nop word [rax + rax]
dec rcx
mov byte [rcx + r15 + 0x48a30], bl
jne 0x1400118c0
mov rcx, rax
dec rcx
mov byte [rcx + r15 + 0x489f0], bl
jne 0x1400118d0
mov rcx, rax
dec rcx
mov byte [rcx + r15 + 0x489b0], bl
jne 0x1400118e0
mov rcx, rax
dec rcx
mov byte [rcx + r15 + 0x48970], bl
jne 0x1400118f0
nop dword [rax]
dec rax
mov byte [rax + r15 + 0x48930], bl
jne 0x140011900
mov eax, pe_nt_image_headers64
lea r12, [0x140048830]
nop dword [rax]
dec rax
mov byte [rax + r12], bl
jne 0x140011920
mov eax, pe_nt_image_headers64
lea r13, [0x140048730]
dec rax
mov byte [rax + r13], bl
jne 0x140011935
mov eax, pe_nt_image_headers64
lea rcx, [0x140048630]
nop word [rax + rax]
dec rax
mov byte [rax + rcx], bl
jne 0x140011950
mov eax, pe_nt_image_headers64
lea rcx, [0x140048530]
dec rax
mov byte [rax + rcx], bl
jne 0x140011964
mov eax, pe_nt_image_headers64
lea rcx, [0x140048430]
dec rax
mov byte [rax + rcx], bl
jne 0x140011978
mov eax, pe_nt_image_headers64
lea rcx, [0x140048330]
nop dword [rax]
dec rax
mov byte [rax + rcx], bl
jne 0x140011990
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
mov dword [0x140045194], ebx
mov dword [0x140045088], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r9, [0x1400237b8]
lea r8, [rsp + 0x70]
lea rdx, str._s_s
lea rcx, [rbp + 0x180]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edi, 3
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x180]
lea r8d, [rdi + 4]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400124ae
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x1498], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r9, [rbp + 0x13e0]
lea rdx, [rbp + 0x390]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0x68]
movdqu xmm0, xmmword [rsp + 0x48]
movdqu xmm1, xmmword [rsp + 0x58]
pxor xmm0, xmmword [0x14001f380]
pxor xmm1, xmmword [0x14001f380]
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm1
nop dword [rax]
xor byte [rax], 0xc2
lea rax, [rax + 1]
dec rdi
jne 0x140011a80
lea r9d, [rdi + 0x18]
lea rcx, [rbp + 0x13f8]
xor r8d, r8d
xor edx, edx
mov dword [rbp + 0x13e8], esi
mov qword [rbp + 0x13f8], rbx
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x13f0], rbx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140011b9c
mov rcx, qword [rbp + 0x13f8]
lea rax, [rbp + 0x13f0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140011b8d
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rbp + 0x13f0]
lea rdx, [rsp + 0x48]
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140011b80
mov r8, qword [rbp + 0x13f0]
mov rcx, qword [rbp + 0x13f8]
lea rax, [rsp + 0x40]
lea r9d, [rdi + 1]
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140011b80
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x13e8]
lea r8d, [rdi + 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x390]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x13f0]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x13f8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x24
dec rax
mov byte [rsp + rax + 0x48], bl
jne 0x140011ba1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, str.ip_inf
lea rcx, [rbp + 0x390]
mov rdx, rdi
mov qword [0x140048a30], rbx
mov qword [0x140048a38], rbx
mov qword [0x140048a40], rbx
mov qword [0x140048a48], rbx
mov qword [0x140048a50], rbx
mov qword [0x140048a58], rbx
mov qword [0x140048a60], rbx
mov qword [0x140048a68], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140011c4f
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rax], bl
jne 0x140011c10
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011c55
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15 + 0x48a30], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x40
jg 0x140011c4f
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011c30
jmp 0x140011c55
mov byte [0x140048a30], bl
lea rdi, str.ip_inf2
lea rcx, [rbp + 0x390]
mov qword [0x1400489f0], rbx
mov rdx, rdi
mov qword [0x1400489f8], rbx
mov qword [0x140048a00], rbx
mov qword [0x140048a08], rbx
mov qword [0x140048a10], rbx
mov qword [0x140048a18], rbx
mov qword [0x140048a20], rbx
mov qword [0x140048a28], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140011cef
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x140011cb0
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011cf5
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15 + 0x489f0], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x40
jg 0x140011cef
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011cd0
jmp 0x140011cf5
mov byte [0x1400489f0], bl
lea rdi, str.timecb
lea rcx, [rbp + 0x390]
mov qword [0x1400482f0], rbx
mov rdx, rdi
mov qword [0x1400482f8], rbx
mov qword [0x140048300], rbx
mov qword [0x140048308], rbx
mov qword [0x140048310], rbx
mov qword [0x140048318], rbx
mov qword [0x140048320], rbx
mov qword [0x140048328], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rdx, rax
test rax, rax
jne 0x140011d5b
mov byte [0x1400482f0], bl
lea rcx, [0x1400482f0]
jmp 0x140011db8
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x140011d60
sub rax, rdi
lea rcx, [0x1400482f0]
add rdx, rax
movzx r8d, byte [rdx]
cmp r8b, 0xa
je 0x140011da4
mov rax, rbx
mov byte [rax + rcx], r8b
inc rax
lea rdx, [rdx + 1]
cmp rax, 0x40
jg 0x140011d9e
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140011d81
jmp 0x140011da4
mov byte [0x1400482f0], bl
cmp byte [0x1400482f0], 0x20
jne 0x140011db8
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140011db0
movzx r8d, byte [rcx]
inc rcx
lea eax, [r8 - 0x2b]
mov r9d, r8d
test eax, 0xfffffffd
jne 0x140011dd4
movzx r8d, byte [rcx]
inc rcx
mov edx, ebx
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x140011df2
lea edx, [rdx + rdx*4]
inc rcx
lea edx, [rdx - 0x18]
lea edx, [r8 + rdx*2]
movzx r8d, byte [rcx - 1]
jmp 0x140011dd6
cmp r9d, 0x2d
jne 0x140011dfa
neg edx
mov dword [0x140045194], edx
lea rdi, str.ipcb1
lea rcx, [rbp + 0x390]
mov rdx, rdi
mov qword [0x1400489b0], rbx
mov qword [0x1400489b8], rbx
mov qword [0x1400489c0], rbx
mov qword [0x1400489c8], rbx
mov qword [0x1400489d0], rbx
mov qword [0x1400489d8], rbx
mov qword [0x1400489e0], rbx
mov qword [0x1400489e8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140011e9f
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140011e60
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011ea5
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15 + 0x489b0], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x40
jg 0x140011e9f
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011e80
jmp 0x140011ea5
mov byte [0x1400489b0], bl
lea rdi, str.ipcb2
lea rcx, [rbp + 0x390]
mov qword [0x140048970], rbx
mov rdx, rdi
mov qword [0x140048978], rbx
mov qword [0x140048980], rbx
mov qword [0x140048988], rbx
mov qword [0x140048990], rbx
mov qword [0x140048998], rbx
mov qword [0x1400489a0], rbx
mov qword [0x1400489a8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140011f3f
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x140011f00
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011f45
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15 + 0x48970], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x40
jg 0x140011f3f
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011f20
jmp 0x140011f45
mov byte [0x140048970], bl
lea rdi, str.ipcb3
lea rcx, [rbp + 0x390]
mov qword [0x140048930], rbx
mov rdx, rdi
mov qword [0x140048938], rbx
mov qword [0x140048940], rbx
mov qword [0x140048948], rbx
mov qword [0x140048950], rbx
mov qword [0x140048958], rbx
mov qword [0x140048960], rbx
mov qword [0x140048968], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140011fdf
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x140011fa0
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011fe5
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15 + 0x48930], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x40
jg 0x140011fdf
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011fc0
jmp 0x140011fe5
mov byte [0x140048930], bl
lea rdi, str.timeup
lea rcx, [rbp + 0x390]
mov qword [0x1400482b0], rbx
mov rdx, rdi
mov qword [0x1400482b8], rbx
mov qword [0x1400482c0], rbx
mov qword [0x1400482c8], rbx
mov qword [0x1400482d0], rbx
mov qword [0x1400482d8], rbx
mov qword [0x1400482e0], rbx
mov qword [0x1400482e8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rdx, rax
test rax, rax
jne 0x14001204b
mov byte [0x1400482b0], bl
lea rcx, [0x1400482b0]
jmp 0x1400120a8
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x140012050
sub rax, rdi
lea rcx, [0x1400482b0]
add rdx, rax
movzx r8d, byte [rdx]
cmp r8b, 0xa
je 0x140012094
mov rax, rbx
mov byte [rax + rcx], r8b
inc rax
lea rdx, [rdx + 1]
cmp rax, 0x40
jg 0x14001208e
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140012071
jmp 0x140012094
mov byte [0x1400482b0], bl
cmp byte [0x1400482b0], 0x20
jne 0x1400120a8
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400120a0
movzx r8d, byte [rcx]
inc rcx
lea eax, [r8 - 0x2b]
mov r9d, r8d
test eax, 0xfffffffd
jne 0x1400120c4
movzx r8d, byte [rcx]
inc rcx
mov edx, ebx
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x1400120e2
lea edx, [rdx + rdx*4]
inc rcx
lea edx, [rdx - 0x18]
lea edx, [r8 + rdx*2]
movzx r8d, byte [rcx - 1]
jmp 0x1400120c6
cmp r9d, 0x2d
jne 0x1400120ea
neg edx
mov edi, 4
mov dword [0x140045088], edx
mov rax, r12
mov ecx, edi
nop word [rax + rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140012100
lea rsi, str.dnup1
lea rcx, [rbp + 0x390]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001218d
mov rax, rsi
nop word [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140012150
sub rax, rsi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140012193
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r12], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x14001218d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140012170
jmp 0x140012193
mov byte [0x140048830], bl
mov rax, r13
mov rcx, rdi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x1400121a0
lea rcx, [rbp + 0x390]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001221d
mov rax, rsi
inc rax
cmp byte [rax], bl
jne 0x1400121e3
sub rax, rsi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140012223
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r13], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x14001221d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140012200
jmp 0x140012223
mov byte [0x140048730], bl
lea r15, [0x140048630]
mov rcx, rdi
mov rax, r15
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140012230
lea rcx, [rbp + 0x390]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x1400122ad
mov rax, rsi
inc rax
cmp byte [rax], bl
jne 0x140012273
sub rax, rsi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x1400122b3
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x1400122ad
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140012290
jmp 0x1400122b3
mov byte [0x140048630], bl
lea r15, [0x140048530]
mov rcx, rdi
mov rax, r15
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x1400122c0
lea rsi, str.dne1
lea rcx, [rbp + 0x390]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001234d
mov rax, rsi
nop word [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140012310
sub rax, rsi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140012353
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x14001234d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140012330
jmp 0x140012353
mov byte [0x140048530], bl
lea r15, [0x140048430]
mov rcx, rdi
mov rax, r15
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140012360
lea rcx, [rbp + 0x390]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x1400123dd
mov rax, rsi
inc rax
cmp byte [rax], bl
jne 0x1400123a3
sub rax, rsi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x1400123e3
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r15], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x1400123dd
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x1400123c0
jmp 0x1400123e3
mov byte [0x140048430], bl
lea r15, [0x140048330]
mov rax, r15
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rdi
jne 0x1400123f0
lea rcx, [rbp + 0x390]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x140012435
mov byte [0x140048330], bl
jmp 0x140012475
mov rcx, rsi
inc rcx
cmp byte [rcx], bl
jne 0x140012438
sub rcx, rsi
add rax, rcx
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x140012475
nop dword [rax]
mov byte [rbx + r15], cl
inc rbx
lea rax, [rax + 1]
cmp rbx, 0x100
jg 0x14001246e
movzx ecx, byte [rax]
cmp cl, 0xa
jne 0x140012450
jmp 0x140012475
mov byte [0x140048330], 0
mov rsi, qword [rsp + 0x1498]
mov ecx, 0x208
dec rcx
mov byte [rsp + rcx + 0x70], 0
jne 0x140012482
mov ecx, 0xffe
dec rcx
mov byte [rbp + rcx + 0x390], 0
jne 0x140012491
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400124ba
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x14a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret