You missed - but it probably wasn't obvious - the fact that it goes into a C function (which happens to have a stack frame) and returns with a simple ret buried in some inline assembler. It amazes me that this code worked at all. Taking a quick peek in the debugger (through dark glasses to avoid eye damage) shows that the top word on the stack is a value that HAPPENS to point to some innocuous code that is followed by a ret. So the stack gets unwound "correctly" even though the program counter has to travel through a black hole in the process.
This code originates from an enclave - some might say "ghetto" - in the company that no longer exists. The staff from that enclave - good, bad and ugly - have been distributed throughout the department... we scored both this project and the person who wrote this code. Ladies and gentlemen, step right up - three shies for a penny, every child wins a prize!
Well, when this plush assignment came my way, I looked at it very briefly, decided that this had "delegate" written all over it, and promptly delivered it onto someone else's desk. I get status updates every few days, detailing the buried treasure uncovered thus far.
It needs rewriting almost entirely from scratch, and it's a goal of mine to do the rewrite. However first it is necessary (IMHO :)) to generate a formal specification for the project; I'm working on that.