Function at 0x1400010e0
Capabilities:
Create thread
Read file on windows
Terminate process

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, str.TLS___Thread_Local_Storage_n
call fcn.140001010
mov ebx, 1
nop dword [rax]
mov r8d, ebx
lea rcx, [0x140001070]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
movsxd rcx, eax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc ebx
cmp ebx, 2
jle 0x140001110
mov qword [rsp + 0x490], rdi
lea rcx, str.____TLS_Checks_OK._n
mov qword [rsp + 0x460], r15
call fcn.140001010
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x400
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
test rbx, rbx
je 0x1400013fe
lea rcx, str.Win32_API_Hook___CreateFile_ReadFile__README.txt__n
call fcn.140001010
xor r15d, r15d
lea rcx, str.README.txt
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400011d5
lea rcx, str.Cannot_open_file_for_reading__n
call fcn.140001010
lea ecx, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001236
mov r8d, 0xf
lea rdx, str.El_Psy_Kongroo.
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000122a
lea rcx, str.____Invalid_README.txt_content__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.____README.txt_content_OK._n
call fcn.140001010
mov qword [rsp + 0x480], rbp
lea rcx, str.PE_Modification___Sections_n
mov qword [rsp + 0x468], r14
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
movzx r14d, word [rcx + rax + 6]
lea rbp, [rcx + rax]
test r14d, r14d
je 0x1400012c3
mov qword [rsp + 0x488], rsi
lea rdi, [rbp + 0x108]
mov esi, r14d
lea rbx, [rbp + 0x11c]
nop word [rax + rax]
mov eax, dword [rbx - 4]
lea rcx, str._s_tVA0x_x_RawPtr0x_x_RawSize0x_x_n
mov r9d, dword [rbx]
mov rdx, rdi
mov r8d, dword [rbx - 8]
mov dword [rsp + 0x20], eax
call fcn.140001010
add rdi, 0x28
lea rbx, [rbx + 0x28]
sub rsi, 1
jne 0x140001290
mov rsi, qword [rsp + 0x488]
lea rcx, str.Misc___Overlay_n
call fcn.140001010
lea eax, [r14 - 1]
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
lea rax, [rax + rax*4]
mov edi, dword [rbp + rax*8 + 0x11c]
add edi, dword [rbp + rax*8 + 0x118]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x400
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r14, qword [rsp + 0x468]
mov rbp, qword [rsp + 0x480]
test eax, eax
je 0x1400013f2
lea rdx, [rsp + 0x50]
lea rcx, str.Name_t_s_n
call fcn.140001010
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001374
lea rcx, str.Cannot_open_file_for_reading__n
jmp 0x1400013f9
movzx edx, di
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x1400013fe
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400013fe
mov r8d, 0xf
lea rdx, str.El_Psy_Kongroo.
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400013df
lea rcx, str.____Invalid_Overlay_content__n
call fcn.140001010
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [rsp + 0x50]
lea rcx, str.____Overlay_content_OK.__s_n
call fcn.140001010
jmp 0x1400013fe
lea rcx, str.Cannot_acquire_filename_for_self__n
call fcn.140001010
mov r15, qword [rsp + 0x460]
xor eax, eax
mov rdi, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001440
add rsp, 0x470
pop rbx
ret