Function at 0x100acbb9
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x14c], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], esi
mov ebx, 0xfffffff
mov dword [ebp - 0x140], edi
mov edi, dword [eax + 4]
sub eax, 4
mov esi, dword [0x1007b9bc]
mov dword [ebp - 0xe8], eax
mov eax, dword [edi]
shr eax, 1
and eax, ebx
xor edx, edx
lea ecx, [esi + eax - 1]
mov eax, ecx
div esi
mov eax, dword [0x1007b9bc]
sub ecx, edx
mov dword [ebp - 0x80], ecx
mov eax, dword [0x10012044]
mov dword [ebp - 0x84], eax
mov eax, dword [0x1007b9bc]
mov eax, dword [0x10012044]
test eax, eax
je 0x100accc4
and dword [ebp - 0x74], 0
mov eax, dword [0x10012044]
dec eax
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x100acc73
mov esi, dword [0x1012ee38]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov dword [0x1012ee38], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x100acc4c
xor edx, edx
div ecx
cmp dword [ebp - 0x84], 0
jbe 0x100accbb
mov ecx, 0xffffc390
lea esi, [edx*4 + 0x1012ee90]
mov eax, 0x3c6f
inc dword [ebp - 0x74]
lock cmpxchg dword [esi], ecx
cmp eax, 0x3c6f
je 0x100acea9
mov ecx, dword [0x10012044]
lea eax, [edx + 1]
xor edx, edx
div ecx
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x84]
jb 0x100acc80
xor eax, eax
test eax, eax
mov dword [ebp - 0x68], eax
jne 0x100acd41
call dword [sym.imp.kernel32.dll_GetLastError]
xor esi, esi
mov dword [ebp - 0x78], eax
push 0x40
push 0x1000
inc esi
push dword [ebp - 0x80]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x100acebc
push eax
call dword [sym.imp.kernel32.dll_Sleep]
cmp esi, 0x11
jb 0x100acccf
xor esi, esi
mov dword [ebp - 0x68], esi
cmp dword [0x1011fbc8], esi
ja 0x100acd0b
test esi, 3
je 0x100acd22
test esi, esi
je 0x100acd1d
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
xor esi, esi
mov dword [ebp - 0x68], esi
push dword [ebp - 0x78]
call dword [sym.imp.kernel32.dll_SetLastError]
test esi, esi
je 0x100acc1a
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x100acd41
mov byte [esi], 0
inc esi
dec eax
jne 0x100acd3a
mov eax, 0xb05aaaa
mov eax, dword [edi]
mov ecx, eax
shr eax, 1
mov esi, 0x10000000
and eax, ebx
mov ebx, eax
shr ecx, 0x1d
lea edi, [ecx + edi + 8]
lea eax, [ebx + edi]
mov dword [ebp - 0x78], eax
mov eax, dword [0x1007b9bc]
sub eax, ebx
mov dword [ebp - 0x74], edi
lea ecx, [eax + 1]
sub dword [ebp - 0x74], esi
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x5c], ecx
je 0x100acdb1
mov edx, dword [0x1012ee38]
shr dword [ebp - 0x5c], 0x10
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x1012ee38], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x5c], 0
jne 0x100acd87
xor edx, edx
div ecx
mov eax, dword [ebp - 0x68]
add eax, edx
push eax
push ebx
push dword [ebp - 0x74]
mov dword [ebp - 0x68], eax
mov eax, 0xde174eae
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x68]
add esp, 0xc
test ebx, ebx
mov dword [ebp - 0xd0], edi
mov edi, 0xfffff000
mov dword [ebp - 0xf0], ecx
mov byte [ebp - 0x55], 0
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x80], eax
je 0x100ad52a
lea eax, [ebp - 0xf0]
push eax
mov eax, 0xcb067825
mov eax, dword [ebp - 0xec]
mov ebx, dword [ebp - 0xf0]
and dword [ebp - 0x64], 0
and dword [ebp - 0x60], 0
pop ecx
mov ecx, 0xfffffff
and eax, ecx
and ebx, ecx
add ebx, esi
mov ecx, dword [0x1001256c]
mov dword [ebp - 0x5c], eax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0xf8], eax
jne 0x100acec6
xor edi, edi
cmp dword [ebp - 0x5c], edi
jbe 0x100ad132
mov esi, 0x7fffffff
mov ecx, 0x799186ea
mov edx, ecx
movzx eax, byte [edi + ebx]
add eax, ecx
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, eax
imul edx, edx, 0x6d29
rol edx, 0xa
ror eax, 0xa
xor edx, eax
add dword [ebp - 0x64], edx
inc edi
mov dword [ebp - 0x60], edx
cmp edi, dword [ebp - 0x5c]
jb 0x100ace5b
jmp 0x100ad132
mov eax, dword [0x1007b9bc]
imul eax, edx
lea eax, [eax + section..data]
jmp 0x100accbd
mov esi, eax
mov dword [ebp - 0x68], eax
jmp 0x100accfb
mov ecx, ebx
mov edx, dword [0x1000003c]
lea edx, [edx + 0x100000a0]
mov eax, dword [ebp - 0x5c]
add eax, ebx
mov dword [ebp - 0x6c], eax
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov dword [ebp - 0x7c], edx
add eax, esi
sub ecx, esi
mov esi, ecx
and esi, edi
mov edx, ecx
sub edx, esi
mov dword [ebp - 0x70], edx
mov edx, dword [ebp - 0x5c]
add ecx, edx
mov edx, ecx
and edx, edi
sub ecx, edx
mov dword [ebp - 0xe0], ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0xe4], edx
mov edi, eax
add ecx, eax
mov dword [ebp - 0xdc], ecx
cmp eax, ecx
je 0x100acf26
cmp dword [edi], esi
jae 0x100acf26
add edi, dword [edi + 4]
cmp edi, ecx
jne 0x100acf1b
and dword [ebp - 0xd4], 0
cmp edi, ecx
je 0x100acf5f
cmp dword [edi], esi
jne 0x100acf5f
mov esi, dword [edi + 4]
sub esi, 8
shr esi, 1
je 0x100acf5f
lea ecx, [edi + 8]
movzx eax, word [ecx]
and eax, 0xfff
cmp eax, dword [ebp - 0x70]
jae 0x100acf5f
inc dword [ebp - 0xd4]
inc ecx
inc ecx
cmp dword [ebp - 0xd4], esi
jne 0x100acf42
mov ecx, 0x799186ea
mov esi, 0x7fffffff
jmp 0x100acf71
mov edx, dword [ebp - 0xe4]
cmp edi, dword [ebp - 0xdc]
je 0x100ad0dd
cmp dword [edi], edx
ja 0x100ad0dd
mov eax, dword [edi + 4]
add eax, 0xfffffff8
shr eax, 1
cmp dword [ebp - 0xd4], eax
jne 0x100acfbb
add edi, dword [edi + 4]
cmp edi, dword [ebp - 0xdc]
je 0x100ad0dd
mov eax, dword [ebp - 0xe4]
cmp dword [edi], eax
ja 0x100ad0dd
and dword [ebp - 0xd4], 0
jmp 0x100acf85
mov eax, dword [ebp - 0xe4]
cmp dword [edi], eax
jne 0x100acfe1
mov eax, dword [ebp - 0xd4]
movzx eax, word [edi + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xe0]
jae 0x100ad0dd
mov edx, dword [ebp - 0xd4]
mov eax, 0xf000
inc dword [ebp - 0xd4]
test word [edi + edx*2 + 8], ax
je 0x100acf6b
movzx eax, word [edi + edx*2 + 8]
mov edx, dword [edi]
and dword [ebp - 0x5c], 0
and eax, 0xfff
lea eax, [eax + edx + 0x10000000]
mov dword [ebp - 0x70], eax
sub dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], eax
je 0x100ad075
mov edx, ecx
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax + ebx]
add eax, ecx
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, eax
imul edx, edx, 0x6d29
rol edx, 0xa
ror eax, 0xa
xor edx, eax
mov eax, edx
add dword [ebp - 0x64], eax
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], edx
cmp eax, dword [ebp - 0x70]
jb 0x100ad01f
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
xor ebx, ebx
mov edx, ecx
movzx eax, byte [ebp + ebx - 0xf4]
add eax, ecx
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, eax
imul edx, edx, 0x6d29
rol edx, 0xa
ror eax, 0xa
xor edx, eax
add dword [ebp - 0x64], edx
inc ebx
mov dword [ebp - 0x60], edx
cmp ebx, 4
jb 0x100ad085
mov ebx, dword [ebp - 0x7c]
add ebx, 4
jmp 0x100acf6b
mov eax, dword [ebp - 0x6c]
xor edi, edi
sub eax, ebx
mov dword [ebp - 0x6c], eax
je 0x100ad132
mov edx, ecx
movzx eax, byte [edi + ebx]
add eax, ecx
add dword [ebp - 0x64], eax
add eax, dword [ebp - 0x60]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, eax
imul edx, edx, 0x6d29
rol edx, 0xa
ror eax, 0xa
xor edx, eax
add dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
inc edi
cmp edi, dword [ebp - 0x6c]
jb 0x100ad0e9
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x64]
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, 0x10
jb 0x100ad136
mov eax, 0xd6d406d4
mov ecx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [0x10120760]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x108], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x138], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x110], ecx
lea ecx, [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x6c], eax
push 0x10
lea esi, [ebp - 0x138]
lea edi, [ebp - 0xc4]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x7c], 3
mov ebx, dword [ebp - 0xc0]
lea edi, [edx + esi]
rol edi, 7
xor eax, edi
lea edi, [esi + eax]
rol edi, 9
xor ecx, edi
lea edi, [ecx + eax]
rol edi, 0xd
xor edx, edi
lea edi, [ecx + edx]
ror edi, 0xe
xor esi, edi
mov edi, dword [ebp - 0xb0]
add ebx, edi
rol ebx, 7
xor dword [ebp - 0xa0], ebx
mov ebx, dword [ebp - 0xa0]
add edi, ebx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, ebx
mov ebx, dword [ebp - 0x90]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0x90]
xor dword [ebp - 0xc0], ebx
mov ebx, dword [ebp - 0xc0]
add edi, ebx
ror edi, 0xe
mov ebx, dword [ebp - 0x9c]
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0xac]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x8c], edi
mov edi, ebx
mov ebx, dword [ebp - 0x8c]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xbc], edi
mov edi, ebx
mov ebx, dword [ebp - 0xbc]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xbc]
xor dword [ebp - 0xac], ebx
mov ebx, dword [ebp - 0xac]
add edi, ebx
mov ebx, dword [ebp - 0x88]
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x98]
add edi, ebx
rol edi, 7
xor dword [ebp - 0xb8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xb8]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xa8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xa8]
xor dword [ebp - 0x98], ebx
mov ebx, dword [ebp - 0x98]
add edi, ebx
ror edi, 0xe
xor dword [ebp - 0x88], edi
mov edi, dword [ebp - 0xb8]
add edi, esi
rol edi, 7
xor dword [ebp - 0xc0], edi
mov edi, dword [ebp - 0xc0]
add edi, esi
rol edi, 9
xor dword [ebp - 0xbc], edi
mov ebx, dword [ebp - 0xbc]
mov edi, dword [ebp - 0xc0]
add ebx, edi
mov edi, dword [ebp - 0xbc]
rol ebx, 0xd
xor dword [ebp - 0xb8], ebx
mov ebx, dword [ebp - 0xb8]
add ebx, edi
mov edi, dword [ebp - 0xb0]
add edi, eax
ror ebx, 0xe
xor esi, ebx
rol edi, 7
xor dword [ebp - 0xac], edi
mov ebx, dword [ebp - 0xac]
mov edi, dword [ebp - 0xb0]
add ebx, edi
mov edi, dword [ebp - 0xac]
rol ebx, 9
xor dword [ebp - 0xa8], ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xa8]
xor eax, ebx
add edi, eax
ror edi, 0xe
mov ebx, dword [ebp - 0xa0]
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0x9c]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x98], edi
mov ebx, dword [ebp - 0x98]
mov edi, dword [ebp - 0x9c]
add ebx, edi
rol ebx, 9
xor ecx, ebx
mov edi, dword [ebp - 0x98]
add edi, ecx
rol edi, 0xd
mov ebx, dword [ebp - 0x8c]
xor dword [ebp - 0xa0], edi
mov edi, dword [ebp - 0xa0]
add edi, ecx
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x88]
add edi, ebx
rol edi, 7
xor edx, edi
mov edi, dword [ebp - 0x88]
add edi, edx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, dword [ebp - 0x90]
add edi, edx
rol edi, 0xd
xor dword [ebp - 0x8c], edi
mov ebx, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x90]
add ebx, edi
ror ebx, 0xe
xor dword [ebp - 0x88], ebx
dec dword [ebp - 0x7c]
jne 0x100ad211
mov dword [ebp - 0x94], edx
xor edx, edx
push 0x40
mov dword [ebp - 0xb4], eax
xor eax, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xc4], esi
pop ebx
mov ecx, dword [ebp + eax - 0x138]
add dword [ebp + eax - 0xc4], ecx
add eax, 4
cmp eax, ebx
jl 0x100ad483
lea edi, [ebp - 0x44]
inc dword [ebp - 0x118]
push 0x10
pop ecx
lea esi, [ebp - 0xc4]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xcc], ebx
jbe 0x100ad4ea
mov esi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
lea edi, [esi + eax]
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + edi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
mov byte [ecx + esi], al
inc edx
cmp edx, ebx
jb 0x100ad4bd
sub dword [ebp - 0xcc], ebx
add dword [ebp - 0x80], ebx
add esi, ebx
add dword [ebp - 0xd0], ebx
mov dword [ebp - 0x70], esi
jmp 0x100ad1e1
cmp dword [ebp - 0xcc], edx
jbe 0x100ad51a
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0xd0]
lea eax, [ebp - 0x44]
sub esi, eax
sub edi, eax
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + esi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
mov byte [ecx + edi], al
cmp edx, dword [ebp - 0xcc]
jb 0x100ad502
mov ebx, dword [ebp - 0xc8]
mov esi, 0x10000000
mov edi, 0xfffff000
mov eax, dword [ebp - 0x78]
mov al, byte [eax + 8]
xor al, byte [ebp - 0x55]
je 0x100ad5be
call fcn.10023238
mov edx, 0xffff
mov ebx, eax
mov eax, dword [ebp - 0xe8]
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0x100f1b6e
and ecx, 0xfffffffc
lea esi, [ecx + 0xfff]
and ebx, edi
and esi, edi
xor eax, eax
mov edi, dword [0x1012ee38]
imul edi, edi, 0x343fd
add edi, 0x269ec3
mov dword [0x1012ee38], edi
shr edi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, edi
test edx, edx
jne 0x100ad564
mov edi, 0xffff
div edi
mov dword [ebp - 0x150], ebx
inc edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x6c], 0
jmp 0x100ad5b0
mov eax, dword [ebp - 0x6c]
mov dword [ecx], eax
add ecx, 4
cmp ecx, esi
jb 0x100ad5a8
mov eax, 0x100f1b6e
jmp 0x100ad697
mov eax, dword [ebp - 0x84]
mov ecx, dword [0x1001256c]
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0xc8], eax
sub esi, ecx
mov dword [ebp - 0x78], esi
jne 0x100ad5e2
test eax, eax
je 0x100ad68a
mov ecx, dword [0x10103928]
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x74]
lea eax, [ebx + edi]
sub esi, dword [ebp - 0x84]
mov dword [ebp - 0x6c], eax
xor ebx, ebx
dec ecx
js 0x100ad626
lea eax, [ebx + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x1010392c]
and edx, 0xfffffff
cmp edi, edx
jae 0x100ad61d
lea ecx, [eax - 1]
jmp 0x100ad622
jbe 0x100ad62a
lea ebx, [eax + 1]
cmp ecx, ebx
jge 0x100ad5ff
mov edi, ebx
jmp 0x100ad682
mov edi, eax
jmp 0x100ad682
mov eax, dword [edi*4 + 0x1010392c]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x6c]
jae 0x100ad68a
lea ebx, [ecx + esi + 0x10000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x100ad672
dec ecx
je 0x100ad66a
dec ecx
jne 0x100ad67b
mov edx, dword [ebp - 0x78]
jmp 0x100ad67b
mov edx, dword [ebp - 0xc8]
jmp 0x100ad67b
mov edx, dword [ebp - 0x78]
sub edx, dword [ebp - 0xc8]
dec eax
dec eax
jne 0x100ad681
add dword [ebx], edx
inc edi
cmp edi, dword [0x10103928]
jb 0x100ad62e
mov eax, dword [0x1007b9bc]
mov eax, 0x395ff314
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x13c]
mov ebx, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x140]
mov esp, ebp
pop ebp
popfd
ret