Function at 0x10027700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100987b0]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100987b0], eax
call fcn.1001e240
mov ecx, dword [0x1009d828]
test ecx, ecx
jne 0x10027744
mov dword [0x1009d12c], 0x32
jmp 0x10027778
cmp ecx, 1
jne 0x10027755
mov dword [0x1009d12c], 6
jmp 0x10027778
cmp ecx, 2
jne 0x10027766
mov dword [0x1009d12c], 5
jmp 0x10027778
mov eax, dword [0x1009d12c]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1009d12c], eax
call fcn.10013500
test eax, eax
je 0x100277da
push 0x75
mov dword [0x1009dac8], 0x10013810
call fcn.10013810
cwde
shr eax, 0x10
test eax, eax
je 0x100277d3
cmp byte [0x1009e5a8], 0
je 0x100277ba
cmp dword [0x1009e5ac], 0
je 0x100277da
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1009e5ac], eax
ja 0x100277da
xor eax, eax
mov byte [0x1009e5a8], 1
cmp dword [0x1009cf38], eax
sete al
mov dword [0x1009cf38], eax
jmp 0x100277da
mov byte [0x1009e5a8], 0
call fcn.1001c150
call fcn.1001be80
mov ecx, ebx
call fcn.1001c2c0
call fcn.10023560
mov ecx, ebx
call fcn.1001def0
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x100278ad
cmp dword [0x1009cf3c], 0
jne 0x10027876
cmp dword [0x100996dc], 0
jne 0x10027876
cmp dword [0x10098c00], 0
jne 0x10027876
cmp dword [0x10097e70], 0
jne 0x10027876
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100278e7
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x100278df
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100278e7
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x100278e2
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100278e7
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10027942
cmp dword [0x1009d7d8], 0
jne 0x10027912
cmp dword [0x1009e0d8], 0
je 0x10027942
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002797c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10027970
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002797c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.100208d0
mov ecx, ebx
call fcn.1001f4d0
mov ecx, ebx
call fcn.10020010
mov ecx, ebx
call fcn.1001fa70
call fcn.1001fcb0
call fcn.1001fdb0
call fcn.10022930
call fcn.10022cd0
call fcn.10023000
call fcn.10022820
call fcn.10023870
cmp dword [0x1009cf70], 0
je 0x10027a71
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10027a71
push 0x20
mov dword [0x1009dac8], 0x10013810
call fcn.10013810
cwde
shr eax, 0x10
test eax, eax
je 0x10027a6a
cmp byte [0x1009e300], 0
je 0x10027a25
cmp dword [0x1009e304], 0
je 0x10027a71
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x1009e304]
inc ecx
cmp ecx, eax
ja 0x10027a71
jmp 0x10027a2b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x1009e300], 1
call edi
mov ecx, dword [0x1009d3c8]
mov dword [0x1009e304], eax
mov eax, dword [0x10099738]
add eax, 0x160
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10027aac
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x10027aa0
mov byte [0x1009e300], 0
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x160
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10027aac
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023170
call fcn.10023220
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x174
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10027b55
cmp dword [0x10098bcc], 1
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
mov edx, dword [ecx]
jne 0x10027b27
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x1009d3c8]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10099738]
je 0x10027b27
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x10027b55
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x10027b49
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x10027b55
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023c80
call fcn.10020590
call fcn.100210c0
call fcn.10021000
cmp dword [0x1009d374], 0
jle 0x10027c06
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10027c06
mov eax, dword [0x1009d374]
cmp eax, 1
jne 0x10027ba5
mov dword [0x100994b0], 0x42c80000
jmp 0x10027bd6
cmp eax, 2
jne 0x10027bb6
mov dword [0x100994b0], 0x42dc0000
jmp 0x10027bd6
cmp eax, 3
jne 0x10027bc7
mov dword [0x100994b0], 0x42f00000
jmp 0x10027bd6
cmp eax, 4
jne 0x10027bd6
mov dword [0x100994b0], 0x42fa0000
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10027c40
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10027c34
mov ecx, dword [0x1009d3c8]
mov eax, dword [0x10099738]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10027c40
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023ad0
call fcn.1001feb0
call fcn.10023bc0
call fcn.100236a0
call fcn.10023390
call fcn.10023430
call fcn.10024a20
call fcn.10024730
mov ecx, ebx
call fcn.10024ab0
call fcn.10027300
call fcn.10023dc0
call fcn.10024560
call fcn.100241d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066b99
mov esp, ebp
pop ebp
ret