Function at 0x102ee91
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x84], ecx
lea eax, [ebp + 4]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x94], ebx
mov ebx, 0xfffffff
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x88], edi
mov esi, dword [eax + 4]
mov edi, dword [0x1116588]
sub eax, 4
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 4]
and eax, ebx
xor edx, edx
lea ecx, [edi + eax - 1]
mov eax, ecx
div edi
sub ecx, edx
mov eax, dword [0x1116588]
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1011bb0]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x1116588]
mov eax, dword [0x1011bb0]
test eax, eax
je 0x102ef8c
and dword [ebp - 0x28], 0
mov eax, dword [0x1011bb0]
dec eax
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x102ef44
mov edi, dword [0x12d47a4]
imul edi, edi, 0x343fd
add edi, 0x269ec3
mov dword [0x12d47a4], edi
shr edi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, edi
test edx, edx
jne 0x102ef1d
xor edx, edx
div ecx
cmp dword [ebp - 0x4c], 0
jbe 0x102ef86
mov eax, 0xcb65
inc dword [ebp - 0x28]
lea edi, [edx*4 + 0x12d4c14]
mov ecx, 0xffff349a
lock cmpxchg dword [edi], ecx
cmp eax, 0xcb65
je 0x102f10e
mov ecx, dword [0x1011bb0]
lea eax, [edx + 1]
xor edx, edx
div ecx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x4c]
jb 0x102ef4e
xor edi, edi
test edi, edi
jne 0x102f005
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x44], eax
push 0x40
inc edi
push 0x1000
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x102f121
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0x11
jb 0x102ef97
xor edi, edi
cmp dword [0x12ef80c], edi
ja 0x102efd0
test edi, 3
je 0x102efe4
test edi, edi
je 0x102efe2
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor edi, edi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x102eeee
mov eax, edi
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x102f005
mov byte [eax], 0
inc eax
dec ecx
jne 0x102effe
mov eax, 0xa35f645c
mov ecx, dword [esi + 4]
mov eax, dword [esi]
and eax, 7
and ecx, ebx
lea eax, [eax + esi + 8]
lea edx, [ecx + eax]
mov dword [ebp - 0x40], eax
sub dword [ebp - 0x40], 0x1000000
mov dword [ebp - 0x4c], eax
mov eax, dword [0x1116588]
sub eax, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x44], edx
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x102f067
mov esi, dword [0x12d47a4]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov dword [0x12d47a4], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x102f040
xor edx, edx
div ecx
lea eax, [edx + edi]
push eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x40]
mov eax, 0xde2d2d7e
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0xd], 0
mov eax, 0xa7bf2390
mov ecx, dword [0x11e47bc]
mov eax, 0x1000000
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
and esi, 0xfffffff
and edi, ebx
mov ebx, edi
add esp, 0x10
add esi, eax
sub eax, ecx
mov dword [ebp - 0x30], eax
jne 0x102f128
xor edx, edx
test ebx, ebx
jbe 0x102f317
mov edi, 0x3d5e919b
movzx eax, byte [edx + esi]
add eax, edi
add dword [ebp - 0x1c], eax
add eax, dword [ebp - 0x18]
imul eax, eax, 0x3d5e919b
ror eax, 0x13
imul eax, eax, 0x3d5e919b
ror eax, 0x13
mov ecx, eax
imul eax, eax, 0x5653
rol eax, 0xb
ror ecx, 0xb
xor eax, ecx
add dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
inc edx
cmp edx, ebx
jb 0x102f0d0
jmp 0x102f317
mov eax, dword [0x1116588]
imul eax, edx
lea edi, [eax + section..data]
jmp 0x102ef88
mov edi, eax
jmp 0x102efc0
mov edx, dword [0x100003c]
lea edx, [edx + 0x10000a0]
lea eax, [esi + ebx]
mov dword [ebp - 0x34], eax
mov ecx, esi
mov eax, dword [edx]
mov edi, 0x1000000
mov edx, dword [edx + 4]
mov dword [ebp - 0x24], edx
add eax, edi
sub ecx, edi
mov edi, ecx
mov edx, ecx
add ecx, ebx
mov ebx, ecx
and ebx, 0xfffff000
sub ecx, ebx
mov dword [ebp - 0x70], ecx
and edi, 0xfffff000
mov ecx, dword [ebp - 0x24]
sub edx, edi
mov dword [ebp - 0x20], edx
mov edx, eax
add ecx, eax
cmp eax, ecx
mov dword [ebp - 0x6c], ecx
je 0x102f184
cmp dword [edx], edi
jae 0x102f184
add edx, dword [edx + 4]
cmp edx, ecx
jne 0x102f179
and dword [ebp - 0x64], 0
cmp edx, ecx
je 0x102f1b5
cmp dword [edx], edi
jne 0x102f1b5
mov eax, dword [edx + 4]
sub eax, 8
shr eax, 1
je 0x102f1b5
lea ecx, [edx + 8]
movzx edi, word [ecx]
and edi, 0xfff
cmp edi, dword [ebp - 0x20]
jae 0x102f1b5
inc dword [ebp - 0x64]
inc ecx
inc ecx
cmp dword [ebp - 0x64], eax
jne 0x102f19d
mov edi, 0x3d5e919b
cmp edx, dword [ebp - 0x6c]
je 0x102f2d5
cmp dword [edx], ebx
ja 0x102f2d5
mov eax, dword [edx + 4]
lea ecx, [eax - 8]
mov eax, dword [ebp - 0x64]
shr ecx, 1
cmp eax, ecx
jne 0x102f1f4
add edx, dword [edx + 4]
cmp edx, dword [ebp - 0x6c]
je 0x102f2d5
cmp dword [edx], ebx
ja 0x102f2d5
and dword [ebp - 0x64], 0
jmp 0x102f1cb
cmp dword [edx], ebx
jne 0x102f20b
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0x70]
jae 0x102f2d5
mov ecx, 0xf000
mov eax, dword [ebp - 0x64]
inc dword [ebp - 0x64]
test word [edx + eax*2 + 8], cx
je 0x102f1ba
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
mov ecx, dword [edx]
lea ecx, [eax + ecx + 0x1000000]
xor eax, eax
mov dword [ebp - 0x2c], ecx
sub dword [ebp - 0x2c], esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
je 0x102f282
movzx eax, byte [eax + esi]
add eax, edi
add dword [ebp - 0x1c], eax
add eax, dword [ebp - 0x18]
imul eax, eax, 0x3d5e919b
ror eax, 0x13
imul eax, eax, 0x3d5e919b
ror eax, 0x13
mov ecx, eax
imul ecx, ecx, 0x5653
rol ecx, 0xb
ror eax, 0xb
xor ecx, eax
mov eax, ecx
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x2c]
jb 0x102f240
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
sub eax, dword [ebp - 0x30]
xor ecx, ecx
mov dword [ebp - 0x78], eax
movzx eax, byte [ebp + ecx - 0x78]
add eax, edi
add dword [ebp - 0x1c], eax
add eax, dword [ebp - 0x18]
imul eax, eax, 0x3d5e919b
ror eax, 0x13
imul eax, eax, 0x3d5e919b
ror eax, 0x13
mov esi, eax
imul eax, eax, 0x5653
rol eax, 0xb
ror esi, 0xb
xor eax, esi
add dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
inc ecx
cmp ecx, 4
jb 0x102f28f
mov esi, dword [ebp - 0x3c]
add esi, 4
jmp 0x102f1ba
xor edx, edx
mov ebx, dword [ebp - 0x34]
sub ebx, esi
je 0x102f317
movzx eax, byte [edx + esi]
add eax, edi
add dword [ebp - 0x1c], eax
add eax, dword [ebp - 0x18]
imul eax, eax, 0x3d5e919b
ror eax, 0x13
imul eax, eax, 0x3d5e919b
ror eax, 0x13
mov ecx, eax
imul eax, eax, 0x5653
rol eax, 0xb
ror ecx, 0xb
xor eax, ecx
add dword [ebp - 0x1c], eax
inc edx
cmp edx, ebx
mov dword [ebp - 0x18], eax
jb 0x102f2de
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x1c]
mov byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 8
jb 0x102f319
mov eax, 0xc165ba0d
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x5c]
and eax, 7
mov dword [ebp - 0x24], eax
je 0x102f4ed
mov edi, dword [ebp - 0x40]
and dword [ebp - 0x30], 0
not edi
and dword [ebp - 0x50], 0
and dword [ebp - 0x14], 0
test eax, eax
jle 0x102f387
push 0x38
pop edx
movzx ebx, byte [esi]
cmp dword [ebp - 0x14], 4
jge 0x102f374
lea ecx, [edx - 0x20]
shl ebx, cl
or dword [ebp - 0x50], ebx
jmp 0x102f37b
mov ecx, edx
shl ebx, cl
or dword [ebp - 0x30], ebx
inc esi
inc dword [ebp - 0x14]
sub edx, 8
cmp dword [ebp - 0x14], eax
jl 0x102f361
movzx ecx, word [ebp - 6]
movzx ebx, word [ebp - 8]
movzx edx, word [ebp - 0xc]
mov eax, dword [ebp - 0x40]
sub eax, ecx
sub eax, dword [ebp - 0xc]
xor edi, eax
mov eax, edi
mov dword [ebp - 0x48], edx
xor edx, edi
imul edx, ebx
ror eax, 0xe
xor eax, edx
xor eax, dword [ebp - 0x40]
mov ebx, eax
xor ecx, eax
movzx edx, word [ebp - 0xa]
imul ecx, edx
ror ebx, 0xb
sub ecx, ebx
xor edi, ecx
mov ebx, dword [ebp - 0x48]
mov ecx, edi
mov dword [ebp - 0x3c], edx
mov edx, edi
sub ecx, dword [ebp - 8]
ror ecx, 0xb
imul ebx, ecx
rol edx, 3
add edx, ebx
xor eax, edx
movzx ecx, word [ebp - 8]
mov ebx, ecx
xor ebx, eax
movzx ecx, word [ebp - 6]
imul ebx, ecx
mov ecx, dword [ebp - 0x3c]
mov edx, eax
ror edx, 1
add edx, ebx
mov ebx, ecx
xor edi, edx
xor ebx, edi
movzx edx, word [ebp - 8]
imul ebx, edx
mov edx, edi
shr edx, 0xa
add ebx, edx
mov edx, dword [ebp - 8]
xor eax, ebx
sub edx, eax
mov ebx, eax
rol edx, 0xc
imul ecx, edx
ror ebx, 0x10
add ebx, ecx
xor edi, ebx
mov ebx, dword [ebp - 0x48]
mov ecx, dword [ebp - 8]
xor ecx, edi
ror ecx, 8
imul ebx, ecx
mov edx, edi
mov ecx, dword [ebp - 0x48]
ror edx, 0x10
add edx, ebx
xor eax, edx
mov edx, ecx
xor edx, eax
movzx ebx, word [ebp - 6]
rol edx, 3
mov dword [ebp - 0x14], ebx
imul ebx, edx
mov edx, eax
shr edx, 0xc
add ebx, edx
movzx edx, word [ebp - 8]
mov dword [ebp - 0x2c], edx
xor edi, ebx
mov ebx, edi
ror ebx, 3
sub ebx, edx
mov edx, dword [ebp - 8]
imul ebx, dword [ebp - 0x14]
xor edx, dword [ebp - 0xc]
and dword [ebp - 0x14], 0
xor edx, edi
xor eax, ebx
xor edx, eax
mov edi, edx
sub edi, dword [ebp - 0x2c]
rol edi, 5
imul ecx, edi
mov edi, edx
xor edx, dword [ebp - 0x30]
shr edi, 0xa
xor ecx, edi
xor ecx, dword [ebp - 0x50]
mov edi, dword [ebp - 0x24]
xor eax, ecx
test edi, edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], edx
jle 0x102f4c5
mov ebx, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x14], 4
jge 0x102f4b1
rol dword [ebp - 0x54], 8
mov cl, byte [ebp - 0x54]
mov byte [ebx], cl
jmp 0x102f4ba
rol dword [ebp - 0x34], 8
mov cl, byte [ebp - 0x34]
mov byte [ebx], cl
xor byte [ebp - 0xd], cl
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x102f49a
add edi, 0xfffffffc
test edi, edi
jle 0x102f4da
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr edx, cl
shl edx, cl
jmp 0x102f4fc
xor edx, edx
test edi, edi
jge 0x102f4fc
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
jmp 0x102f4fc
xor edx, edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
not eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov edi, dword [ebp - 0x5c]
shr edi, 3
test edi, edi
jbe 0x102f6d7
movzx ecx, word [ebp - 0xa]
mov dword [ebp - 0x3c], ecx
movzx ecx, word [ebp - 6]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x58], ecx
movzx ecx, word [ebp - 8]
mov dword [ebp - 0x20], ecx
neg dword [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
movzx ecx, word [ebp - 0xc]
mov dword [ebp - 0x48], ecx
movzx edi, byte [esi + 1]
movzx ecx, byte [esi]
shl ecx, 8
or ecx, edi
shl ecx, 8
movzx ebx, byte [esi + 5]
movzx edi, byte [esi + 2]
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 3]
or ecx, edi
movzx edi, byte [esi + 4]
shl edi, 8
or edi, ebx
xor eax, ecx
movzx ebx, byte [esi + 6]
shl edi, 8
or edi, ebx
movzx ebx, byte [esi + 7]
mov dword [ebp - 0x54], ecx
mov ecx, eax
shl edi, 8
or edi, ebx
mov dword [ebp - 0x34], edi
sub ecx, dword [ebp - 0x14]
add esi, 8
sub ecx, dword [ebp - 0xc]
xor ecx, edi
mov edi, dword [ebp - 0x48]
xor edx, ecx
xor edi, edx
imul edi, dword [ebp - 0x2c]
mov ecx, edx
ror ecx, 0xe
xor ecx, edi
mov edi, dword [ebp - 0x14]
xor eax, ecx
xor edi, eax
imul edi, dword [ebp - 0x3c]
mov ecx, eax
ror ecx, 0xb
sub edi, ecx
xor edx, edi
mov ebx, edx
mov ecx, edx
sub ecx, dword [ebp - 8]
ror ecx, 0xb
movzx edi, word [ebp - 0xc]
imul edi, ecx
movzx ecx, word [ebp - 8]
rol ebx, 3
add ebx, edi
xor eax, ebx
xor ecx, eax
mov edi, eax
mov ebx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x14]
ror edi, 1
add edi, ecx
movzx ecx, word [ebp - 8]
xor edx, edi
mov edi, dword [ebp - 0x3c]
xor edi, edx
imul edi, ecx
mov ecx, edx
shr ecx, 0xa
add edi, ecx
xor eax, edi
mov edi, eax
mov ecx, dword [ebp - 8]
sub ecx, eax
rol ecx, 0xc
imul ebx, ecx
mov ecx, dword [ebp - 8]
ror edi, 0x10
add edi, ebx
xor edx, edi
mov ebx, edx
movzx edi, word [ebp - 0xc]
xor ecx, edx
ror ecx, 8
ror ebx, 0x10
imul edi, ecx
add ebx, edi
xor eax, ebx
movzx edi, word [ebp - 0xc]
mov ecx, edi
xor ecx, eax
mov ebx, dword [ebp - 0x14]
rol ecx, 3
imul ebx, ecx
mov ecx, eax
shr ecx, 0xc
add ebx, ecx
movzx ecx, word [ebp - 8]
xor edx, ebx
mov ebx, edx
ror ebx, 3
sub ebx, ecx
imul ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x58]
xor ecx, edx
xor eax, ebx
xor ecx, eax
mov edx, ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x48], edi
add ecx, edx
rol ecx, 5
imul edi, ecx
mov ecx, edx
xor edx, dword [ebp - 0x30]
shr ecx, 0xa
xor edi, ecx
mov cl, byte [ebp - 0xd]
xor edi, dword [ebp - 0x50]
xor eax, edi
xor cl, al
xor cl, dl
mov edi, dword [ebp - 0x38]
mov byte [edi + 3], al
ror eax, 8
mov byte [edi + 7], dl
xor cl, al
mov byte [edi + 2], al
ror edx, 8
mov byte [edi + 6], dl
xor cl, dl
ror eax, 8
xor cl, al
mov byte [edi + 1], al
ror edx, 8
xor cl, dl
ror eax, 8
mov byte [edi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x54]
mov byte [edi], al
mov byte [edi + 4], dl
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x34]
add edi, 8
dec dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
ror eax, 8
ror edx, 8
mov dword [ebp - 0x38], edi
jne 0x102f538
movzx ecx, byte [ebp - 0xd]
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax + 8]
sub ecx, eax
je 0x102f775
call fcn.01244f80
mov edi, eax
mov edx, 0xfffff000
mov eax, dword [ebp - 0x60]
mov dword [eax + 8], 0x10d8814
lea ecx, [eax + 0xc]
and ecx, 0xfffffffc
and edi, edx
lea esi, [ecx + 0xfff]
and esi, edx
mov edx, 0xffff
xor eax, eax
mov ebx, dword [0x12d47a4]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x12d47a4], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x102f717
mov ebx, 0xffff
div ebx
mov eax, ecx
inc edx
cmp ecx, esi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x58], 0
jae 0x102f76b
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
add eax, 4
cmp eax, esi
jb 0x102f75f
mov eax, 0x10d8814
jmp 0x102f846
mov ecx, 0x1000000
mov eax, dword [ebp - 0x4c]
mov edx, dword [0x11e47bc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
sub ecx, edx
mov dword [ebp - 0x44], ecx
jne 0x102f798
test eax, eax
je 0x102f839
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [0x11efd70]
sub esi, dword [ebp - 0x4c]
add eax, ebx
mov dword [ebp - 0x58], eax
xor edi, edi
dec ecx
js 0x102f7db
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x11efd74]
and edx, 0xfffffff
cmp ebx, edx
jae 0x102f7d2
lea ecx, [eax - 1]
jmp 0x102f7d7
jbe 0x102f7df
lea edi, [eax + 1]
cmp ecx, edi
jge 0x102f7b4
mov ebx, edi
jmp 0x102f831
mov ebx, eax
jmp 0x102f831
mov eax, dword [ebx*4 + 0x11efd74]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x58]
jae 0x102f839
lea edi, [ecx + esi + 0x1000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x102f824
dec ecx
je 0x102f81f
dec ecx
jne 0x102f82a
mov edx, dword [ebp - 0x44]
jmp 0x102f82a
mov edx, dword [ebp - 0x24]
jmp 0x102f82a
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x24]
dec eax
dec eax
jne 0x102f830
add dword [edi], edx
inc ebx
cmp ebx, dword [0x11efd70]
jb 0x102f7e3
mov eax, dword [0x1116588]
mov eax, 0xeedf8074
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x98]
mov ebx, dword [ebp - 0x94]
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x8c]
mov esp, ebp
pop ebp
popfd
ret