Function at 0x10027670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100985b8]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100985b8], eax
call fcn.100252e0
call fcn.1001e440
mov ecx, dword [0x1009d620]
test ecx, ecx
jne 0x100276b9
mov dword [0x1009cf24], 0x32
jmp 0x100276ed
cmp ecx, 1
jne 0x100276ca
mov dword [0x1009cf24], 6
jmp 0x100276ed
cmp ecx, 2
jne 0x100276db
mov dword [0x1009cf24], 5
jmp 0x100276ed
mov eax, dword [0x1009cf24]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1009cf24], eax
call fcn.10013770
test eax, eax
je 0x1002774f
push 0x75
mov dword [0x1009d8bc], 0x10013a80
call fcn.10013a80
cwde
shr eax, 0x10
test eax, eax
je 0x10027748
cmp byte [0x1009e388], 0
je 0x1002772f
cmp dword [0x1009e38c], 0
je 0x1002774f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1009e38c], eax
ja 0x1002774f
xor eax, eax
mov byte [0x1009e388], 1
cmp dword [0x1009cd30], eax
sete al
mov dword [0x1009cd30], eax
jmp 0x1002774f
mov byte [0x1009e388], 0
call fcn.1001c350
call fcn.1001c080
mov ecx, ebx
call fcn.1001c4c0
call fcn.10023770
mov ecx, ebx
call fcn.1001e0f0
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x10027822
cmp dword [0x1009cd34], 0
jne 0x100277eb
cmp dword [0x100994e0], 0
jne 0x100277eb
cmp dword [0x10098a08], 0
jne 0x100277eb
cmp dword [0x10097c84], 0
jne 0x100277eb
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002785c
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10027854
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002785c
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x10027857
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002785c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100278b7
cmp dword [0x1009d5d0], 0
jne 0x10027887
cmp dword [0x1009decc], 0
je 0x100278b7
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100278f1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x100278e5
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100278f1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10020ae0
mov ecx, ebx
call fcn.1001f6d0
mov ecx, ebx
call fcn.10020210
mov ecx, ebx
call fcn.1001fc70
call fcn.1001feb0
call fcn.1001ffb0
call fcn.10022b40
call fcn.10022ee0
call fcn.10023210
call fcn.10022a30
call fcn.10023a80
cmp dword [0x1009cd68], 0
je 0x100279e6
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100279e6
push 0x20
mov dword [0x1009d8bc], 0x10013a80
call fcn.10013a80
cwde
shr eax, 0x10
test eax, eax
je 0x100279df
cmp byte [0x1009e0e0], 0
je 0x1002799a
cmp dword [0x1009e0e4], 0
je 0x100279e6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x1009e0e4]
inc ecx
cmp ecx, eax
ja 0x100279e6
jmp 0x100279a0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x1009e0e0], 1
call edi
mov ecx, dword [0x1009d1c0]
mov dword [0x1009e0e4], eax
mov eax, dword [0x10099538]
add eax, 0x160
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10027a21
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x10027a15
mov byte [0x1009e0e0], 0
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x160
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10027a21
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023380
call fcn.10023430
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x174
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10027aca
cmp dword [0x100989d4], 1
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
mov edx, dword [ecx]
jne 0x10027a9c
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x1009d1c0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10099538]
je 0x10027a9c
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x10027aca
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x10027abe
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x10027aca
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023e90
call fcn.10020790
call fcn.100212d0
call fcn.10021210
cmp dword [0x1009d16c], 0
jle 0x10027b7b
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10027b7b
mov eax, dword [0x1009d16c]
cmp eax, 1
jne 0x10027b1a
mov dword [0x100992b4], 0x42c80000
jmp 0x10027b4b
cmp eax, 2
jne 0x10027b2b
mov dword [0x100992b4], 0x42dc0000
jmp 0x10027b4b
cmp eax, 3
jne 0x10027b3c
mov dword [0x100992b4], 0x42f00000
jmp 0x10027b4b
cmp eax, 4
jne 0x10027b4b
mov dword [0x100992b4], 0x42fa0000
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10027bb5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10027ba9
mov ecx, dword [0x1009d1c0]
mov eax, dword [0x10099538]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10027bb5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023ce0
call fcn.100200b0
call fcn.10023dd0
call fcn.100238b0
call fcn.100235a0
call fcn.10023640
call fcn.10024c30
call fcn.10024940
mov ecx, ebx
call fcn.10024cc0
call fcn.10027270
call fcn.10023fd0
call fcn.10024770
call fcn.100243e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066c19
mov esp, ebp
pop ebp
ret