Function at 0x40b294
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], ecx
lea eax, [ebp + 4]
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], ebx
mov ebx, 0xfffffff
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x140], edi
mov esi, dword [0x4c7398]
mov edi, dword [eax + 4]
sub eax, 4
mov dword [ebp - 0xe8], eax
mov eax, dword [edi]
shr eax, 1
and eax, ebx
lea ecx, [esi + eax - 1]
mov eax, ecx
xor edx, edx
div esi
sub ecx, edx
mov eax, dword [0x4c7398]
mov dword [ebp - 0x70], ecx
mov eax, dword [0x403ef8]
mov dword [ebp - 0x84], eax
mov eax, dword [0x4c7398]
mov eax, dword [0x403ef8]
test eax, eax
je 0x40b39d
and dword [ebp - 0x7c], 0
mov eax, dword [0x403ef8]
dec eax
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x40b34c
mov esi, dword [0x51b214]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov dword [0x51b214], esi
shr esi, 0x10
shl eax, 0x10
or eax, esi
shr edx, 0x10
jne 0x40b327
xor edx, edx
div ecx
cmp dword [ebp - 0x84], 0
jbe 0x40b394
mov ecx, 0xffffc390
mov eax, 0x3c6f
inc dword [ebp - 0x7c]
lea esi, [edx*4 + 0x529524]
lock cmpxchg dword [esi], ecx
cmp eax, 0x3c6f
je 0x40b584
lea eax, [edx + 1]
mov ecx, dword [0x403ef8]
xor edx, edx
div ecx
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x84]
jb 0x40b359
xor eax, eax
test eax, eax
mov dword [ebp - 0x68], eax
jne 0x40b41a
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x80], eax
xor esi, esi
inc esi
push 0x40
push 0x1000
push dword [ebp - 0x70]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40b597
push eax
call dword [sym.imp.kernel32.dll_Sleep]
cmp esi, 0x11
jb 0x40b3a8
xor esi, esi
mov dword [ebp - 0x68], esi
cmp dword [0x51b2c4], esi
ja 0x40b3e4
test esi, 3
je 0x40b3fb
test esi, esi
je 0x40b3f6
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
xor esi, esi
mov dword [ebp - 0x68], esi
push dword [ebp - 0x80]
call dword [sym.imp.kernel32.dll_SetLastError]
test esi, esi
je 0x40b2f5
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x40b41a
mov byte [esi], 0
inc esi
dec eax
jne 0x40b413
mov eax, 0x7551d906
mov eax, dword [edi]
mov esi, 0x400000
mov ecx, eax
shr eax, 1
and eax, ebx
mov ebx, eax
shr ecx, 0x1d
lea edi, [ecx + edi + 8]
lea eax, [ebx + edi]
mov dword [ebp - 0x80], eax
mov eax, dword [0x4c7398]
sub eax, ebx
lea ecx, [eax + 1]
mov dword [ebp - 0x7c], edi
sub dword [ebp - 0x7c], esi
mov dword [ebp - 0x84], edi
xor eax, eax
test ecx, ecx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x70], ecx
je 0x40b486
mov edx, dword [0x51b214]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x51b214], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
shr dword [ebp - 0x70], 0x10
jne 0x40b460
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
add eax, edx
push eax
push ebx
push dword [ebp - 0x7c]
mov dword [ebp - 0x68], eax
mov eax, 0xa441fe25
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x68]
add esp, 0xc
mov dword [ebp - 0xe4], edi
test ebx, ebx
mov dword [ebp - 0xf0], ecx
mov edi, 0xfffff000
mov byte [ebp - 0x55], 0
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x70], eax
je 0x40bc11
lea eax, [ebp - 0xf0]
push eax
mov eax, 0x9b4e48e
mov eax, dword [ebp - 0xec]
mov ebx, dword [ebp - 0xf0]
and dword [ebp - 0x64], 0
and dword [ebp - 0x60], 0
pop ecx
mov ecx, 0xfffffff
and eax, ecx
and ebx, ecx
mov ecx, dword [0x402600]
add ebx, esi
mov dword [ebp - 0x5c], eax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0xf8], eax
jne 0x40b5a1
and dword [ebp - 0x6c], 0
cmp dword [ebp - 0x5c], 0
jbe 0x40b819
mov edi, 0x72122ba9
mov esi, 0x7fffffff
mov ecx, 0x8dedd457
mov edx, ecx
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
add eax, edx
mov edx, ecx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x64], eax
inc dword [ebp - 0x6c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x5c]
jb 0x40b538
jmp 0x40b819
mov eax, dword [0x4c7398]
imul eax, edx
lea eax, [eax + section..data]
jmp 0x40b396
mov dword [ebp - 0x68], eax
mov esi, eax
jmp 0x40b3d4
mov edx, dword [0x40003c]
lea edx, [edx + 0x4000a0]
mov ecx, ebx
mov eax, dword [ebp - 0x5c]
add eax, ebx
mov dword [ebp - 0x78], eax
mov eax, dword [edx]
mov edx, dword [edx + 4]
add eax, esi
mov dword [ebp - 0x74], edx
sub ecx, esi
mov esi, ecx
and esi, edi
mov edx, ecx
sub edx, esi
mov dword [ebp - 0x6c], edx
mov edx, dword [ebp - 0x5c]
add ecx, edx
mov edx, ecx
and edx, edi
sub ecx, edx
mov dword [ebp - 0xdc], ecx
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0xe0], edx
add ecx, eax
mov dword [ebp - 0xd8], ecx
mov edx, eax
cmp eax, ecx
jmp 0x40b5ff
cmp dword [edx], esi
jae 0x40b607
add edx, dword [edx + 4]
cmp edx, ecx
mov dword [ebp - 0xd4], edx
jne 0x40b5f6
and dword [ebp - 0xd0], 0
cmp edx, ecx
je 0x40b644
cmp dword [edx], esi
jne 0x40b644
mov eax, dword [edx + 4]
sub eax, 8
shr eax, 1
je 0x40b644
mov ecx, dword [ebp - 0xd0]
movzx ecx, word [edx + ecx*2 + 8]
and ecx, 0xfff
cmp ecx, dword [ebp - 0x6c]
jae 0x40b644
inc dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], eax
jne 0x40b620
mov edi, 0x72122ba9
mov ecx, 0x8dedd457
mov esi, 0x7fffffff
cmp edx, dword [ebp - 0xd8]
je 0x40b7c4
mov eax, dword [ebp - 0xe0]
cmp dword [edx], eax
ja 0x40b7c4
mov edx, dword [edx + 4]
add edx, 0xfffffff8
shr edx, 1
cmp dword [ebp - 0xd0], edx
mov edx, dword [ebp - 0xd4]
jne 0x40b6af
add edx, dword [edx + 4]
cmp edx, dword [ebp - 0xd8]
mov dword [ebp - 0xd4], edx
je 0x40b7c4
mov eax, dword [ebp - 0xe0]
cmp dword [edx], eax
ja 0x40b7c4
and dword [ebp - 0xd0], 0
jmp 0x40b66d
mov eax, dword [ebp - 0xe0]
cmp dword [edx], eax
jne 0x40b6db
mov eax, dword [ebp - 0xd0]
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xdc]
jae 0x40b7c4
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd0]
inc dword [ebp - 0xd0]
test word [edx + eax*2 + 8], 0xf000
je 0x40b653
movzx eax, word [edx + eax*2 + 8]
mov edx, dword [edx]
and dword [ebp - 0x5c], 0
and eax, 0xfff
lea eax, [eax + edx + 0x400000]
mov dword [ebp - 0x6c], eax
sub dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], eax
je 0x40b75d
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax + ebx]
mov edx, ecx
sub eax, edi
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
add eax, edx
mov edx, ecx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x64], eax
inc dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x6c]
jb 0x40b716
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
xor ebx, ebx
movzx eax, byte [ebp + ebx - 0xf4]
mov edx, ecx
sub eax, edi
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
add eax, edx
mov edx, ecx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
inc ebx
cmp ebx, 4
jb 0x40b770
mov ebx, dword [ebp - 0x74]
add ebx, 4
mov edx, dword [ebp - 0xd4]
jmp 0x40b653
mov eax, dword [ebp - 0x78]
and dword [ebp - 0x5c], 0
sub eax, ebx
mov dword [ebp - 0x78], eax
je 0x40b819
mov edx, ecx
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
add eax, edx
mov edx, ecx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x64], eax
inc dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x78]
jb 0x40b7d2
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x64]
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, 0x10
jb 0x40b81d
mov eax, 0x50279886
mov ecx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [0x5294e0]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x108], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x138], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x110], ecx
lea ecx, [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x78], eax
push 0x10
pop ecx
lea esi, [ebp - 0x138]
lea edi, [ebp - 0xc4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xc4]
mov dword [ebp - 0x74], 2
lea edi, [edx + esi]
rol edi, 7
xor eax, edi
mov ebx, dword [ebp - 0xc0]
lea edi, [esi + eax]
rol edi, 9
xor ecx, edi
lea edi, [ecx + eax]
rol edi, 0xd
xor edx, edi
lea edi, [ecx + edx]
ror edi, 0xe
xor esi, edi
mov edi, dword [ebp - 0xb0]
add ebx, edi
rol ebx, 7
xor dword [ebp - 0xa0], ebx
mov ebx, dword [ebp - 0xa0]
add edi, ebx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, ebx
mov ebx, dword [ebp - 0x90]
add ebx, edi
mov edi, dword [ebp - 0x90]
rol ebx, 0xd
xor dword [ebp - 0xc0], ebx
mov ebx, dword [ebp - 0xc0]
add edi, ebx
ror edi, 0xe
mov ebx, dword [ebp - 0x9c]
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0xac]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x8c], edi
mov edi, ebx
mov ebx, dword [ebp - 0x8c]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xbc], edi
mov edi, ebx
mov ebx, dword [ebp - 0xbc]
add ebx, edi
mov edi, dword [ebp - 0xbc]
rol ebx, 0xd
xor dword [ebp - 0xac], ebx
mov ebx, dword [ebp - 0xac]
add edi, ebx
ror edi, 0xe
mov ebx, dword [ebp - 0x88]
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x98]
add edi, ebx
rol edi, 7
xor dword [ebp - 0xb8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xb8]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xa8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
mov edi, dword [ebp - 0xa8]
rol ebx, 0xd
xor dword [ebp - 0x98], ebx
mov ebx, dword [ebp - 0x98]
add edi, ebx
ror edi, 0xe
xor dword [ebp - 0x88], edi
mov edi, dword [ebp - 0xb8]
add edi, esi
rol edi, 7
xor dword [ebp - 0xc0], edi
mov edi, dword [ebp - 0xc0]
add edi, esi
rol edi, 9
xor dword [ebp - 0xbc], edi
mov ebx, dword [ebp - 0xbc]
mov edi, dword [ebp - 0xc0]
add ebx, edi
mov edi, dword [ebp - 0xbc]
rol ebx, 0xd
xor dword [ebp - 0xb8], ebx
mov ebx, dword [ebp - 0xb8]
add ebx, edi
mov edi, dword [ebp - 0xb0]
add edi, eax
ror ebx, 0xe
xor esi, ebx
rol edi, 7
xor dword [ebp - 0xac], edi
mov ebx, dword [ebp - 0xac]
mov edi, dword [ebp - 0xb0]
add ebx, edi
mov edi, dword [ebp - 0xac]
rol ebx, 9
xor dword [ebp - 0xa8], ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
mov edi, dword [ebp - 0xa8]
rol ebx, 0xd
xor eax, ebx
add edi, eax
mov ebx, dword [ebp - 0xa0]
ror edi, 0xe
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0x9c]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x98], edi
mov edi, dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x98]
add ebx, edi
rol ebx, 9
mov edi, dword [ebp - 0x98]
xor ecx, ebx
add edi, ecx
mov ebx, dword [ebp - 0x8c]
rol edi, 0xd
xor dword [ebp - 0xa0], edi
mov edi, dword [ebp - 0xa0]
add edi, ecx
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x88]
add edi, ebx
rol edi, 7
xor edx, edi
mov edi, dword [ebp - 0x88]
add edi, edx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, dword [ebp - 0x90]
add edi, edx
rol edi, 0xd
xor dword [ebp - 0x8c], edi
mov ebx, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x90]
add ebx, edi
ror ebx, 0xe
xor dword [ebp - 0x88], ebx
dec dword [ebp - 0x74]
jne 0x40b8f8
mov dword [ebp - 0x94], edx
xor edx, edx
push 0x40
mov dword [ebp - 0xb4], eax
xor eax, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xc4], esi
pop ebx
mov ecx, dword [ebp + eax - 0x138]
add dword [ebp + eax - 0xc4], ecx
add eax, 4
cmp eax, ebx
jl 0x40bb6a
lea edi, [ebp - 0x44]
lea esi, [ebp - 0xc4]
inc dword [ebp - 0x118]
cmp dword [ebp - 0xc8], ebx
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
jbe 0x40bbd1
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x78]
lea edi, [esi + eax]
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + edi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
cmp edx, ebx
mov byte [ecx + esi], al
jb 0x40bba4
sub dword [ebp - 0xc8], ebx
add dword [ebp - 0x70], ebx
add esi, ebx
add dword [ebp - 0xe4], ebx
mov dword [ebp - 0x5c], esi
jmp 0x40b8c8
cmp dword [ebp - 0xc8], edx
jbe 0x40bc01
lea eax, [ebp - 0x44]
mov edi, dword [ebp - 0x70]
mov esi, dword [ebp - 0xe4]
sub esi, eax
sub edi, eax
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + esi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
cmp edx, dword [ebp - 0xc8]
mov byte [ecx + edi], al
jb 0x40bbe9
mov edi, 0xfffff000
mov esi, 0x400000
mov ebx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x80]
mov al, byte [eax + 8]
xor al, byte [ebp - 0x55]
je 0x40bca5
call fcn.004a5a28
mov ebx, eax
mov eax, dword [ebp - 0xe8]
mov dword [eax + 8], 0x4b3c5b
mov edx, 0xffff
lea ecx, [eax + 0xc]
and ecx, 0xfffffffc
and ebx, edi
lea esi, [ecx + 0xfff]
and esi, edi
xor eax, eax
mov edi, dword [0x51b214]
imul edi, edi, 0x343fd
add edi, 0x269ec3
mov dword [0x51b214], edi
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr edx, 0x10
jne 0x40bc4b
xor edx, edx
mov edi, 0xffff
div edi
inc edx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x78], 0
jmp 0x40bc97
mov eax, dword [ebp - 0x78]
mov dword [ecx], eax
add ecx, 4
cmp ecx, esi
jb 0x40bc8f
mov eax, 0x4b3c5b
jmp 0x40bd7e
mov ecx, dword [0x402600]
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0xcc], eax
sub esi, ecx
mov dword [ebp - 0x80], esi
jne 0x40bcc9
test eax, eax
je 0x40bd71
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x7c]
mov ecx, dword [0x4bebb0]
lea eax, [ebx + edi]
sub esi, dword [ebp - 0x84]
mov dword [ebp - 0x78], eax
xor ebx, ebx
dec ecx
js 0x40bd0d
lea eax, [ebx + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4bebb4]
and edx, 0xfffffff
cmp edi, edx
jae 0x40bd04
lea ecx, [eax - 1]
jmp 0x40bd09
jbe 0x40bd11
lea ebx, [eax + 1]
cmp ecx, ebx
jge 0x40bce6
mov edi, ebx
jmp 0x40bd69
mov edi, eax
jmp 0x40bd69
mov eax, dword [edi*4 + 0x4bebb4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x78]
jae 0x40bd71
lea ebx, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x40bd59
dec ecx
je 0x40bd51
dec ecx
jne 0x40bd62
mov edx, dword [ebp - 0x80]
jmp 0x40bd62
mov edx, dword [ebp - 0xcc]
jmp 0x40bd62
mov edx, dword [ebp - 0x80]
sub edx, dword [ebp - 0xcc]
dec eax
dec eax
jne 0x40bd68
add dword [ebx], edx
inc edi
cmp edi, dword [0x4bebb0]
jb 0x40bd15
mov eax, dword [0x4c7398]
mov eax, 0x8f3c74f5
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + 8], eax
mov ebx, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x144]
mov esi, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x140]
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
mov esp, ebp
pop ebp
popfd
ret