Function at 0x1006412b
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push edi
pushfd
push ebp
mov ebp, esp
sub esp, 0x154
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x148], ecx
mov ecx, 0xfffffff
lea eax, [ebp + 4]
sub eax, 4
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x144], edi
mov dword [ebp - 0xec], eax
lea esi, [eax + 0xc]
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x7c], eax
mov eax, dword [eax]
shr eax, 2
and eax, ecx
and ebx, ecx
xor edx, edx
mov ecx, dword [0x1007b9bc]
mov dword [ebp - 0x74], ecx
lea ecx, [ecx + eax - 1]
mov eax, ecx
div dword [ebp - 0x74]
mov edi, 0x10000000
add ebx, edi
mov eax, dword [0x1007b9bc]
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xd4], ebx
sub ecx, edx
mov dword [ebp - 0x80], ecx
mov eax, dword [0x10012044]
mov dword [ebp - 0x88], eax
mov eax, dword [0x1007b9bc]
mov eax, dword [0x10012044]
test eax, eax
je 0x1006426a
and dword [ebp - 0x70], 0
mov eax, dword [0x10012044]
dec eax
lea ecx, [eax + 1]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x5c], ecx
je 0x1006420d
mov edx, dword [0x1012ee38]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x1012ee38], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x100641e3
xor edx, edx
div ecx
cmp dword [ebp - 0x88], 0
mov dword [ebp - 0x5c], edx
jbe 0x1006425c
mov eax, 0x3c6f
lea edx, [edx*4 + 0x1012ee90]
inc dword [ebp - 0x70]
mov ecx, 0xffffc390
lock cmpxchg dword [edx], ecx
cmp eax, 0x3c6f
je 0x10064447
mov ecx, dword [0x10012044]
mov eax, dword [ebp - 0x5c]
inc eax
xor edx, edx
div ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x5c], edx
cmp eax, dword [ebp - 0x88]
jb 0x1006421d
and dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x100642f0
call dword [sym.imp.kernel32.dll_GetLastError]
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x74], eax
inc dword [ebp - 0x5c]
push 0x40
push 0x1000
push dword [ebp - 0x80]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1006445e
push eax
call dword [sym.imp.kernel32.dll_Sleep]
cmp dword [ebp - 0x5c], 0x11
jb 0x10064277
and dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x60]
cmp dword [0x1011fbc8], eax
ja 0x100642b4
test al, 3
je 0x100642cc
test eax, eax
je 0x100642c8
push 0x8000
push 0
push dword [ebp - 0x60]
call dword [sym.imp.kernel32.dll_VirtualFree]
and dword [ebp - 0x60], 0
push dword [ebp - 0x74]
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp - 0x60], 0
je 0x100641b0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x80]
test ecx, ecx
je 0x100642f0
mov byte [eax], 0
inc eax
dec ecx
jne 0x100642e9
mov eax, 0x24854537
add dword [esi], 8
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax]
shr esi, 2
and esi, 0xfffffff
lea eax, [esi + ebx]
mov dword [ebp - 0x74], eax
mov eax, dword [0x1007b9bc]
mov dword [ebp - 0x84], ebx
sub eax, esi
sub dword [ebp - 0x84], edi
lea ecx, [eax + 1]
mov edx, ecx
mov dword [ebp - 0x7c], esi
xor eax, eax
test ecx, ecx
je 0x10064354
mov ebx, dword [0x1012ee38]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x1012ee38], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x1006432d
xor edx, edx
div ecx
mov eax, dword [ebp - 0x60]
lea ebx, [edx + eax]
push ebx
push esi
push dword [ebp - 0x84]
mov dword [ebp - 0x70], ebx
mov eax, 0xf295f404
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xd4]
add esp, 0xc
mov dword [ebp - 0x88], ebx
mov ebx, 0xfffff000
test esi, esi
mov dword [ebp - 0xf4], ecx
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x80], eax
je 0x10064aa9
lea eax, [ebp - 0xf4]
push eax
mov eax, 0x838ae4b7
mov esi, dword [0x1001256c]
mov edx, dword [ebp - 0xf0]
mov eax, 0xfffffff
and dword [ebp - 0x68], 0
and dword [ebp - 0x64], 0
and edx, eax
pop ecx
mov ecx, dword [ebp - 0xf4]
mov dword [ebp - 0x6c], edx
and ecx, eax
add ecx, edi
mov eax, edi
sub eax, esi
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0xf8], eax
jne 0x10064466
xor edi, edi
test edx, edx
jbe 0x100646ba
mov esi, 0x7fffffff
mov ecx, 0x69bf6243
mov eax, dword [ebp - 0x5c]
mov edx, ecx
movzx eax, byte [eax + edi]
add eax, ecx
add dword [ebp - 0x68], eax
add eax, dword [ebp - 0x64]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
inc edi
cmp edi, dword [ebp - 0x6c]
jb 0x10064400
jmp 0x100646ba
mov eax, dword [0x1007b9bc]
imul eax, dword [ebp - 0x5c]
lea eax, [eax + section..data]
mov dword [ebp - 0x60], eax
jmp 0x10064260
mov dword [ebp - 0x60], eax
jmp 0x100642a5
lea eax, [ecx + edx]
mov edx, dword [0x1000003c]
lea edx, [edx + 0x100000a0]
mov esi, dword [edx + 4]
sub ecx, edi
mov dword [ebp - 0xd0], eax
mov eax, dword [edx]
add eax, edi
mov edx, ecx
and edx, ebx
mov edi, ecx
sub edi, edx
mov dword [ebp - 0x78], edi
mov edi, dword [ebp - 0x6c]
add ecx, edi
mov edi, ecx
and edi, ebx
mov dword [ebp - 0xe8], edi
add esi, eax
mov ebx, eax
sub ecx, edi
cmp eax, esi
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], esi
je 0x100644c3
cmp dword [ebx], edx
jae 0x100644c3
add ebx, dword [ebx + 4]
cmp ebx, dword [ebp - 0xe0]
jne 0x100644b4
and dword [ebp - 0xd8], 0
cmp ebx, dword [ebp - 0xe0]
je 0x10064501
cmp dword [ebx], edx
jne 0x10064501
mov eax, dword [ebx + 4]
sub eax, 8
shr eax, 1
je 0x10064501
lea ecx, [ebx + 8]
movzx edx, word [ecx]
and edx, 0xfff
cmp edx, dword [ebp - 0x78]
jae 0x10064501
inc dword [ebp - 0xd8]
inc ecx
inc ecx
cmp dword [ebp - 0xd8], eax
jne 0x100644e3
mov edi, dword [ebp - 0x5c]
mov ecx, 0x69bf6243
mov esi, 0x7fffffff
cmp ebx, dword [ebp - 0xe0]
je 0x10064666
mov eax, dword [ebp - 0xe8]
cmp dword [ebx], eax
ja 0x10064666
mov eax, dword [ebx + 4]
lea edx, [eax - 8]
mov eax, dword [ebp - 0xd8]
shr edx, 1
cmp eax, edx
jne 0x10064560
add ebx, dword [ebx + 4]
cmp ebx, dword [ebp - 0xe0]
je 0x10064666
mov eax, dword [ebp - 0xe8]
cmp dword [ebx], eax
ja 0x10064666
and dword [ebp - 0xd8], 0
jmp 0x10064528
mov edx, dword [ebp - 0xe8]
cmp dword [ebx], edx
jne 0x10064580
movzx eax, word [ebx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xe4]
jae 0x10064666
mov eax, dword [ebp - 0xd8]
mov edx, 0xf000
inc dword [ebp - 0xd8]
test word [ebx + eax*2 + 8], dx
je 0x1006450e
mov edx, dword [ebx]
movzx eax, word [ebx + eax*2 + 8]
and dword [ebp - 0x5c], 0
and eax, 0xfff
lea eax, [eax + edx + 0x10000000]
mov dword [ebp - 0x6c], eax
sub dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
je 0x10064605
mov edx, ecx
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax + edi]
add eax, ecx
add dword [ebp - 0x68], eax
add eax, dword [ebp - 0x64]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x68], eax
inc dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x6c]
jb 0x100645be
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
xor edi, edi
movzx eax, byte [ebp + edi - 0xfc]
mov edx, ecx
add eax, ecx
add dword [ebp - 0x68], eax
add eax, dword [ebp - 0x64]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x68], eax
inc edi
cmp edi, 4
mov dword [ebp - 0x64], eax
jb 0x10064618
mov edi, dword [ebp - 0x78]
add edi, 4
jmp 0x1006450e
mov eax, dword [ebp - 0xd0]
xor ebx, ebx
sub eax, edi
mov dword [ebp - 0xd0], eax
je 0x100646ba
movzx eax, byte [edi + ebx]
add eax, ecx
mov edx, ecx
add dword [ebp - 0x68], eax
add eax, dword [ebp - 0x64]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x68], eax
inc ebx
mov dword [ebp - 0x64], eax
cmp ebx, dword [ebp - 0xd0]
jb 0x10064678
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x68]
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, 0x10
jb 0x100646be
mov eax, 0x6d64df9e
mov edx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x110], eax
mov eax, dword [0x10120760]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x10c], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x13c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x128], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x114], ecx
lea ecx, [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xd4]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0xd0], eax
lea esi, [ebp - 0x13c]
push 0x10
pop ecx
lea edi, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0x98]
mov esi, dword [ebp - 0xc8]
mov dword [ebp - 0x78], 2
lea edi, [edx + esi]
mov ebx, dword [ebp - 0xc4]
rol edi, 7
xor eax, edi
lea edi, [esi + eax]
rol edi, 9
xor ecx, edi
lea edi, [ecx + eax]
rol edi, 0xd
xor edx, edi
lea edi, [ecx + edx]
ror edi, 0xe
xor esi, edi
mov edi, dword [ebp - 0xb4]
add ebx, edi
rol ebx, 7
xor dword [ebp - 0xa4], ebx
mov ebx, dword [ebp - 0xa4]
add edi, ebx
rol edi, 9
xor dword [ebp - 0x94], edi
mov edi, ebx
mov ebx, dword [ebp - 0x94]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0x94]
xor dword [ebp - 0xc4], ebx
mov ebx, dword [ebp - 0xc4]
add edi, ebx
mov ebx, dword [ebp - 0xa0]
ror edi, 0xe
xor dword [ebp - 0xb4], edi
mov edi, dword [ebp - 0xb0]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x90], edi
mov edi, ebx
mov ebx, dword [ebp - 0x90]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xc0], edi
mov edi, ebx
mov ebx, dword [ebp - 0xc0]
add ebx, edi
mov edi, dword [ebp - 0xc0]
rol ebx, 0xd
xor dword [ebp - 0xb0], ebx
mov ebx, dword [ebp - 0xb0]
add edi, ebx
mov ebx, dword [ebp - 0x8c]
ror edi, 0xe
xor dword [ebp - 0xa0], edi
mov edi, dword [ebp - 0x9c]
add edi, ebx
rol edi, 7
xor dword [ebp - 0xbc], edi
mov edi, ebx
mov ebx, dword [ebp - 0xbc]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xac], edi
mov edi, ebx
mov ebx, dword [ebp - 0xac]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xac]
xor dword [ebp - 0x9c], ebx
mov ebx, dword [ebp - 0x9c]
add edi, ebx
ror edi, 0xe
xor dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0xbc]
add edi, esi
rol edi, 7
xor dword [ebp - 0xc4], edi
mov edi, dword [ebp - 0xc4]
add edi, esi
rol edi, 9
xor dword [ebp - 0xc0], edi
mov ebx, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
add ebx, edi
mov edi, dword [ebp - 0xc0]
rol ebx, 0xd
xor dword [ebp - 0xbc], ebx
mov ebx, dword [ebp - 0xbc]
add ebx, edi
mov edi, dword [ebp - 0xb4]
add edi, eax
ror ebx, 0xe
xor esi, ebx
rol edi, 7
xor dword [ebp - 0xb0], edi
mov ebx, dword [ebp - 0xb0]
mov edi, dword [ebp - 0xb4]
add ebx, edi
mov edi, dword [ebp - 0xb0]
rol ebx, 9
xor dword [ebp - 0xac], ebx
mov ebx, dword [ebp - 0xac]
add ebx, edi
mov edi, dword [ebp - 0xac]
rol ebx, 0xd
xor eax, ebx
mov ebx, dword [ebp - 0xa4]
add edi, eax
ror edi, 0xe
xor dword [ebp - 0xb4], edi
mov edi, dword [ebp - 0xa0]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x9c], edi
mov ebx, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
add ebx, edi
rol ebx, 9
mov edi, dword [ebp - 0x9c]
xor ecx, ebx
mov ebx, dword [ebp - 0x90]
add edi, ecx
rol edi, 0xd
xor dword [ebp - 0xa4], edi
mov edi, dword [ebp - 0xa4]
add edi, ecx
ror edi, 0xe
xor dword [ebp - 0xa0], edi
mov edi, dword [ebp - 0x8c]
add edi, ebx
rol edi, 7
xor edx, edi
mov edi, dword [ebp - 0x8c]
add edi, edx
rol edi, 9
xor dword [ebp - 0x94], edi
mov edi, dword [ebp - 0x94]
add edi, edx
rol edi, 0xd
xor dword [ebp - 0x90], edi
mov edi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x90]
add ebx, edi
ror ebx, 0xe
xor dword [ebp - 0x8c], ebx
dec dword [ebp - 0x78]
jne 0x1006479c
mov dword [ebp - 0x98], edx
push 0x40
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xa8], ecx
xor edx, edx
xor eax, eax
mov dword [ebp - 0xc8], esi
pop ebx
mov ecx, dword [ebp + eax - 0x13c]
add dword [ebp + eax - 0xc8], ecx
add eax, 4
cmp eax, ebx
jl 0x10064a0e
lea edi, [ebp - 0x44]
lea esi, [ebp - 0xc8]
inc dword [ebp - 0x11c]
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x60], ebx
jbe 0x10064a72
mov esi, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xd0]
lea edi, [esi + eax]
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + edi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
mov byte [ecx + esi], al
cmp edx, ebx
jb 0x10064a48
sub dword [ebp - 0x60], ebx
add dword [ebp - 0x88], ebx
add esi, ebx
add dword [ebp - 0x80], ebx
mov dword [ebp - 0x6c], esi
jmp 0x1006476c
cmp dword [ebp - 0x60], edx
jbe 0x10064a9c
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp - 0x80]
lea eax, [ebp - 0x44]
sub esi, eax
sub edi, eax
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + esi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
mov byte [ecx + edi], al
inc edx
cmp edx, dword [ebp - 0x60]
jb 0x10064a87
mov ebx, 0xfffff000
mov esi, dword [ebp - 0x7c]
mov edi, 0x10000000
mov eax, dword [ebp - 0x74]
mov al, byte [eax + 8]
xor al, byte [ebp - 0x55]
je 0x10064b4a
call fcn.1008c61a
mov edi, dword [ebp - 0xcc]
mov esi, eax
mov eax, dword [ebp - 0xec]
mov dword [eax + 8], 0x100f1b6e
and edi, 0xfffffffc
and esi, ebx
lea ecx, [edi + 0xfff]
and ecx, ebx
xor eax, eax
mov edx, 0xffff
mov ebx, dword [0x1012ee38]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x1012ee38], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x10064ae6
mov ebx, 0xffff
div ebx
mov eax, edi
mov dword [ebp - 0x154], esi
inc edx
cmp edi, ecx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0xcc], 0
jae 0x10064b40
mov edx, dword [ebp - 0xcc]
mov dword [eax], edx
add eax, 4
cmp eax, ecx
jb 0x10064b31
mov eax, 0x100f1b6e
jmp 0x10064c26
mov eax, dword [ebp - 0xd4]
sub eax, dword [ebp - 0x70]
mov ecx, dword [0x1001256c]
mov dword [ebp - 0x7c], eax
sub edi, ecx
mov dword [ebp - 0x74], edi
jne 0x10064b6b
test eax, eax
je 0x10064c19
mov ecx, dword [0x10103928]
mov edi, dword [ebp - 0x70]
sub edi, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x84]
add eax, esi
xor esi, esi
mov dword [ebp - 0xcc], eax
dec ecx
js 0x10064bb8
lea eax, [esi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x1010392c]
and edx, 0xfffffff
cmp dword [ebp - 0x84], edx
jae 0x10064baf
lea ecx, [eax - 1]
jmp 0x10064bb4
jbe 0x10064bbc
lea esi, [eax + 1]
cmp ecx, esi
jge 0x10064b8d
mov ebx, esi
jmp 0x10064c11
mov ebx, eax
jmp 0x10064c11
mov eax, dword [ebx*4 + 0x1010392c]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0xcc]
jae 0x10064c19
lea esi, [ecx + edi + 0x10000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x10064c04
dec ecx
je 0x10064bff
dec ecx
jne 0x10064c0a
mov edx, dword [ebp - 0x74]
jmp 0x10064c0a
mov edx, dword [ebp - 0x7c]
jmp 0x10064c0a
mov edx, dword [ebp - 0x74]
sub edx, dword [ebp - 0x7c]
dec eax
dec eax
jne 0x10064c10
add dword [esi], edx
inc ebx
cmp ebx, dword [0x10103928]
jb 0x10064bc0
mov eax, dword [0x1007b9bc]
mov eax, 0x911eac37
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xec]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x154]
mov edi, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x148]
mov ebx, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x140]
mov eax, dword [ebp - 0x150]
mov esp, ebp
pop ebp
popfd
ret