Function at 0x10f17fc
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x10f1804
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x10f1dec
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
test dl, dl
je 0x10f1d55
mov eax, dword [0x111495c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3a8]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x10f189c
mov ecx, 1
mov edx, 0x10f1e0c
mov eax, ebx
call fcn.010f325c
mov eax, dword [0x111a7bc]
cmp dword [eax + 0x94], 0
je 0x10f1893
mov byte [ebp - 2], 0xeb
push 1
lea ecx, [ebp - 2]
mov eax, dword [0x111a7bc]
mov edx, dword [eax + 0x94]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
mov edx, eax
mov eax, ebx
call fcn.010ecb84
mov dl, 1
mov eax, ebx
call fcn.010ecb84
jmp 0x10f189c
xor edx, edx
mov eax, ebx
call fcn.010ecb84
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [0x111a7a0]
mov eax, dword [eax + 0x128]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
mov eax, dword [0x111495c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x10f19c2
mov ecx, 1
mov edx, 0x10f1e5c
mov eax, ebx
call fcn.010f325c
xor edx, edx
mov eax, ebx
call fcn.010ecb84
mov eax, dword [0x111a7bc]
cmp dword [eax + 0x98], 0
je 0x10f19c2
test esi, esi
jne 0x10f1920
mov ecx, 3
mov edx, 0x10f1ea4
mov eax, ebx
call fcn.010f325c
jmp 0x10f19c2
push 0x17
mov ecx, 0x1114390
mov edx, esi
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
test al, al
jne 0x10f194a
mov ecx, 3
mov edx, 0x10f1ee0
mov eax, ebx
call fcn.010f325c
jmp 0x10f19c2
mov byte [ebp - 2], 0xe9
push 1
lea ecx, [ebp - 2]
mov eax, dword [0x111a7bc]
mov edx, dword [eax + 0x98]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
mov eax, dword [0x111a7bc]
mov edx, esi
sub edx, dword [eax + 0x98]
sub edx, 5
mov dword [ebp - 8], edx
push 4
lea ecx, [ebp - 8]
mov eax, dword [0x111a7bc]
mov edx, dword [eax + 0x98]
inc edx
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
mov eax, dword [0x111a7bc]
mov eax, dword [eax + 0x98]
add eax, 5
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
lea edx, [esi + 0x12]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
mov dl, 1
mov eax, ebx
call fcn.010ecb84
mov eax, dword [0x111495c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x10f1d77
push 0x10f1f1c
lea edx, [ebp - 0x110]
mov eax, dword [0x111495c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b4]
call fcn.010a1d74
push dword [ebp - 0x110]
push 0x10f1f60
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.01007120
mov edx, dword [ebp - 0x10c]
mov ecx, 1
mov eax, ebx
call fcn.010f325c
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.010045bc
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.01013e5c
lea eax, [ebp - 0x114]
mov edx, 0x10f1f78
call fcn.01006f7c
mov eax, dword [ebp - 0x114]
call fcn.01013c9c
test al, al
jne 0x10f1a7c
mov ecx, 3
mov edx, 0x10f1f9c
mov eax, ebx
call fcn.010f325c
jmp 0x10f1d77
test esi, esi
jne 0x10f1a96
mov ecx, 3
mov edx, 0x10f1ea4
mov eax, ebx
call fcn.010f325c
jmp 0x10f1d77
mov eax, dword [0x111a7bc]
cmp dword [eax + 0x9c], 0
jne 0x10f1aba
mov ecx, 3
mov edx, 0x10f1fdc
mov eax, ebx
call fcn.010f325c
jmp 0x10f1d77
add esi, 0x100
mov byte [ebp - 2], 0x68
push 1
lea ecx, [ebp - 2]
mov edx, esi
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
push 1
lea ecx, [ebp - 2]
lea edx, [esi + 0xa]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
lea ebx, [esi + 0x17]
mov dword [ebp - 8], ebx
push 4
lea ecx, [ebp - 8]
lea edx, [esi + 1]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
mov byte [ebp - 2], 0xe8
push 1
lea ecx, [ebp - 2]
lea edx, [esi + 5]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
push 0x10f2010
push 0x10f202c
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.0100c1e8
sub eax, esi
sub eax, 0xa
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
lea edx, [esi + 6]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
push 8
mov ecx, 0x11143a8
lea edx, [esi + 0xf]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
lea edx, [ebp - 0x124]
xor eax, eax
call fcn.010045bc
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.01013e5c
lea eax, [ebp - 0x120]
mov edx, 0x10f2054
call fcn.01006f7c
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, 0
call fcn.01006dac
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x108]
call fcn.010141e4
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
push 0
call fcn.01006450
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x10f1bd4
sub eax, 4
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x108]
mov edx, ebx
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
mov byte [ebp - 2], 0
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
push 0
call fcn.01006450
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x10f1c12
sub eax, 4
mov eax, dword [eax]
push 1
lea ecx, [ebp - 2]
mov edx, ebx
add edx, eax
inc edx
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
push 0
call fcn.01006450
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x10f1c4d
sub eax, 4
mov eax, dword [eax]
push 4
mov edx, dword [0x111a7bc]
lea ecx, [edx + 0x9c]
mov edx, ebx
add edx, eax
add edx, 2
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
push 0
call fcn.01006450
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x10f1c93
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x13c]
mov eax, dword [0x111495c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b4]
call fcn.010a1d74
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
mov ecx, 0
call fcn.01006dac
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x108]
call fcn.010141e4
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
push 0
call fcn.01006450
mov eax, dword [ebp - 0x140]
test eax, eax
je 0x10f1cfc
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
lea ecx, [ebp - 0x108]
lea edx, [esi + 0x17]
add edx, dword [ebp - 8]
add edx, 2
add edx, 4
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
add ebx, dword [ebp - 8]
add ebx, 2
mov dword [ebp - 8], ebx
push 4
lea ecx, [ebp - 8]
lea edx, [esi + 0xb]
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
lea eax, [ebp - 8]
push eax
push 0x20
push 0
push esi
push 0
push 0
mov eax, dword [0x111a7a0]
mov eax, dword [eax + 0x128]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
jmp 0x10f1d77
mov eax, dword [0x111a7bc]
mov eax, dword [eax + 0x98]
test eax, eax
je 0x10f1d77
push 5
mov ecx, 0x1114390
mov edx, eax
mov eax, dword [0x111a7a0]
call fcn.0110b6e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10f1df3
lea eax, [ebp - 0x140]
call fcn.01006134
lea eax, [ebp - 0x13c]
call fcn.01006b58
lea eax, [ebp - 0x138]
mov edx, 5
call fcn.01006158
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.01006b60
lea eax, [ebp - 0x11c]
call fcn.01006134
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.01006b60
lea eax, [ebp - 0x110]
call fcn.01006b58
lea eax, [ebp - 0x10c]
call fcn.01006b58
ret