Callback hell: abusing callbacks, tail-calls, and proxy frames to obfuscate the stack

Foreword Once upon a time, my friend Athanasios Tserpelis, aka trickster0, decided to give me a call with a great problem on his hands: I’m using TpAllocWork + TpPostWork to execute an arbitrary function, but I’m not fully sure how to recover the return value. Any ideas? That question reminded me of some experiments I was working on previously, but had set aside out of laziness. I deci...