Function at 0x27012ed8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
jne 0x27012ef3
push 0x57
pop eax
jmp 0x27013132
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x270c48e0], eax
je 0x27012f0a
mov eax, 0x10dd
jmp 0x27013132
mov eax, dword [0x270c48e4]
cmp eax, ebx
jne 0x27013132
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x27012f22
push 6
jmp 0x27012eed
mov eax, dword [ecx]
cmp eax, ebx
jne 0x27012f3b
push 6
pop eax
mov dword [0x270c48e4], eax
mov dword [0x270c48e8], ecx
jmp 0x27013132
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
call fcn.27012359
mov esi, eax
mov eax, dword [ebp + 0xc]
call fcn.27012359
mov dword [ebp + 0xc], eax
cmp eax, esi
jne 0x27012f6a
cmp dword [0x270c48d8], ebx
jne 0x27013128
jmp 0x27013105
call fcn.27014f7c
mov dword [esp + 0x18], eax
cmp eax, ebx
jne 0x27012f7f
push 8
pop ebx
jmp 0x27013105
mov eax, esi
call fcn.2701280b
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp ecx, ebx
je 0x27012f77
lea edi, [ecx + 0x38]
mov dword [esp + 0x28], edi
xor eax, eax
stosd dword es:[edi], eax
mov dword [esp + 0xc], ecx
add ecx, 0x1e
and dword [esp + 0x14], ebx
stosd dword es:[edi], eax
mov edi, esi
mov dword [esp + 0x2c], ecx
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0
push edi
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x34], edi
call sym.SocksCapExDLL32.dll_Ordinal_273
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x20]
mov ebx, edi
add eax, edi
add dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
add eax, ecx
mov cl, byte [esp + 0xc]
sub cl, byte [esp + 0x10]
sub ebx, esi
shl cl, 3
mov dl, bl
and dl, 7
xor cl, dl
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 8
mov byte [eax], cl
jae 0x2701301a
mov ecx, dword [esp + 0x20]
call fcn.27012481
test eax, eax
jne 0x2701301a
cmp ebx, 5
jb 0x27012fac
mov eax, dword [esp + 0xc]
cmp ebx, 5
jae 0x27013046
mov eax, edi
call fcn.270124da
test eax, eax
je 0x27013039
add edi, eax
mov ebx, edi
sub ebx, esi
cmp ebx, 5
jb 0x27013023
cmp ebx, 5
jb 0x270130f9
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x14], 8
ja 0x270130f9
mov edi, dword [esp + 0x2c]
cmp eax, edi
jbe 0x2701305a
int3
mov ecx, dword [esp + 0x10]
sub al, cl
push ebx
mov byte [ecx + 0x36], bl
add ecx, 0x20
push esi
push ecx
mov byte [edi], al
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp ebx, 0x19
jbe 0x2701307f
push 6
jmp 0x27012f79
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x44], eax
movzx eax, byte [edi]
add eax, edx
lea ecx, [ebx + esi]
mov dword [edx + 0x40], ecx
lea edx, [eax + 5]
mov byte [eax], 0xe9
inc eax
sub ecx, edx
mov dword [eax], ecx
lea ecx, [eax + 4]
mov eax, edi
call fcn.27012337
and dword [esp + 0x24], 0
lea eax, [esp + 0x24]
push eax
push 0x40
push ebx
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x270130c9
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x27013105
mov eax, dword [esp + 0x18]
and dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], esi
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x14], ecx
mov ecx, dword [0x270c48f0]
mov dword [eax], ecx
mov dword [0x270c48f0], eax
xor eax, eax
jmp 0x27013132
cmp dword [0x270c48d8], 0
push 9
pop ebx
jne 0x2701310b
mov dword [0x270c48e4], ebx
mov edi, dword [esp + 0x10]
test edi, edi
je 0x27013118
call fcn.270128f5
cmp dword [esp + 0x18], 0
je 0x27013128
lea esi, [esp + 0x18]
call fcn.27014f00
mov eax, dword [ebp + 8]
mov dword [0x270c48e8], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8