Function at 0x1badc0d31670
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get hostname
Get session user name
Read file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x258]
sub rsp, 0x350
mov qword [rax + 8], rbx
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov rax, qword gs:[0x60]
mov qword [str.____], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1badc0d316bb
mov byte [0x1badc0d53631], 1
mov ecx, 0x5ef3f83a
call fcn.1badc0d31530
mov ecx, 0xdb03c668
mov rdi, rax
call fcn.1badc0d31530
mov edx, 0x7495b3ad
mov rcx, rax
mov rbx, rax
call fcn.1badc0d31440
add rax, 0xa
mov edx, 0x69d25b0f
mov rcx, rdi
mov qword [0x1badc0d53698], rax
call fcn.1badc0d31440
mov edx, 0xe53aa252
movzx ecx, byte [rax + 4]
mov dword [0x1badc0d53664], ecx
lea rcx, [rax + 0x12]
mov qword [0x1badc0d53640], rcx
mov rcx, rdi
call fcn.1badc0d31440
mov edx, 0x8de3e01c
movzx ecx, byte [rax + 4]
add rax, 0x12
mov dword [0x1badc0d53660], ecx
mov rcx, rdi
mov qword [0x1badc0d53648], rax
call fcn.1badc0d31440
mov edx, 0x599c2421
movzx ecx, byte [rax + 4]
add rax, 0x12
mov dword [0x1badc0d536a0], ecx
mov rcx, rdi
mov qword [0x1badc0d53638], rax
call fcn.1badc0d31440
mov edx, 0x4860097d
movzx ecx, byte [rax + 4]
add rax, 0x12
mov dword [0x1badc0d53690], ecx
mov rcx, rdi
mov qword [0x1badc0d53688], rax
call fcn.1badc0d31440
mov edx, 0xf01c7323
movzx ecx, byte [rax + 4]
add rax, 0x12
mov dword [0x1badc0d53678], ecx
mov rcx, rbx
mov qword [0x1badc0d53650], rax
call fcn.1badc0d31440
add rax, 4
mov edx, 0xe50009f4
mov rcx, rbx
mov qword [0x1badc0d53668], rax
call fcn.1badc0d31440
add rax, 6
mov edx, 0x2c822198
mov rcx, rbx
mov qword [0x1badc0d53658], rax
call fcn.1badc0d31440
add rax, 7
mov edx, 0x96e0161d
mov rcx, rbx
mov qword [0x1badc0d53680], rax
call fcn.1badc0d31440
add rax, 7
mov edx, 0xc606ba60
mov rcx, rbx
mov qword [0x1badc0d53670], rax
call fcn.1badc0d31440
add rax, 7
mov edx, 0x33d350c4
mov rcx, rbx
mov qword [0x1badc0d52600], rax
call fcn.1badc0d31440
add rax, 7
mov edx, 0x6603831
mov rcx, rbx
mov qword [0x1badc0d52618], rax
call fcn.1badc0d31440
add rax, 0xf
mov qword [0x1badc0d52608], rax
mov edx, 0xe9bbad5
mov rcx, rbx
call fcn.1badc0d31440
add rax, 0x13
mov ecx, 4
mov qword [0x1badc0d536a8], rax
lea rax, [rbp + 0x10]
vpxor xmm0, xmm0, xmm0
nop dword [rax]
nop dword [rax + rax]
vmovups ymmword [rax], ymm0
vmovups ymmword [rax + 0x20], ymm0
vmovups ymmword [rax + 0x40], ymm0
vmovups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
vmovups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x1badc0d31870
xor dl, dl
lea rdi, [0x1badc0d32840]
mov ebx, 0x179
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdi]
add cl, 0x70
movzx eax, dl
mov byte [rbp + rax + 0x10], cl
cmp cl, 0xa
jne 0x1badc0d31909
lea rcx, [rbp + 0x10]
vzeroupper
call fcn.1badc0d31e0b
lea rax, [rbp + 0x10]
mov ecx, 4
vpxor xmm0, xmm0, xmm0
nop dword [rax + rax]
vmovups ymmword [rax], ymm0
vmovups ymmword [rax + 0x20], ymm0
vmovups ymmword [rax + 0x40], ymm0
vmovups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
vmovups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x1badc0d318e0
xor dl, dl
jmp 0x1badc0d3190b
inc dl
inc rdi
sub rbx, 1
jne 0x1badc0d318b0
mov ecx, 0xfffffff6
vzeroupper
call fcn.1badc0d31e25
mov ecx, 0xfffffff5
mov r15, rax
call fcn.1badc0d31e25
mov ecx, 0xfffffff5
call fcn.1badc0d31e25
mov r14, rax
mov dword [rbp + 0x278], ebx
lea rdi, [0x1badc0d329c0]
mov esi, 0x19
nop dword [rax]
movzx ecx, byte [rdi]
lea r9, [rbp + 0x278]
add cl, 0x70
mov qword [rsp + 0x20], rbx
mov byte [rbp + 0x270], cl
lea rdx, [rbp + 0x270]
mov rcx, r14
mov r8d, 1
call fcn.1badc0d31e1b
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x1badc0d31950
lea r9, [rbp - 0x60]
mov dword [rbp - 0x60], ebx
mov r8d, 0x11
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea r13, [0x1badc0d52630]
mov dword [rsp + 0x60], 0x7477d992
mov rcx, r13
mov dword [rsp + 0x64], 0x4d2644b5
lea r8, [rbp + 0x270]
mov dword [rsp + 0x68], 0x7d6dfdc4
mov edx, 0x1000
mov dword [rsp + 0x6c], 0xf5462d30
mov dword [rsp + 0x70], 0x5906106a
mov dword [rbp + 0x270], ebx
call fcn.1badc0d31e4a
test eax, eax
je 0x1badc0d31b1e
mov qword [rsp + 0x338], r12
mov r14d, ebx
mov r12d, dword [rbp + 0x270]
shr r12d, 2
test r12d, r12d
je 0x1badc0d31b16
nop word [rax + rax]
mov eax, r14d
mov r8d, dword [r13 + rax*4]
test r8d, r8d
je 0x1badc0d31b01
xor edx, edx
mov ecx, 0x410
call fcn.1badc0d31e57
mov rsi, rax
test rax, rax
je 0x1badc0d31b01
movzx eax, bx
lea rdi, [rbp + 0x10]
mov ecx, 0x104
lea r8, [rbp + 0x10]
rep stosw word [rdi], ax
mov rcx, rsi
mov r9d, 0x104
xor edx, edx
call fcn.1badc0d31e64
mov rcx, rsi
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x1badc0d31b01
lea edx, [r15 - 1]
mov edi, ebx
test edx, edx
je 0x1badc0d31aa2
lea rcx, [rbp + 0x10]
lea rcx, [rcx + rdx*2]
cmp word [rcx], 0x5c
je 0x1badc0d31ad9
sub rcx, 2
add edx, 0xffffffff
jne 0x1badc0d31a93
mov rcx, rbx
lea eax, [rdi + 1]
mov edx, eax
test eax, eax
je 0x1badc0d31ae8
movzx eax, word [rcx]
lea rdi, [0x1badc0d32040]
xor rax, 0xff
add rcx, 2
mov r8d, dword [rdi + rax*4]
xor r8d, 0xffffa8
dec rdx
call fcn.1badc0d313e0
mov edx, eax
jmp 0x1badc0d31aed
mov edi, r15d
lea rcx, [rbp + 0x10]
sub edi, edx
lea rcx, [rcx + rdx*2]
jmp 0x1badc0d31aa5
mov edx, 0xffffffff
not edx
xor cl, cl
movzx eax, cl
cmp edx, dword [rsp + rax*4 + 0x60]
je 0x1badc0d31b0f
inc cl
cmp cl, 5
jb 0x1badc0d31af1
inc r14d
cmp r14d, r12d
jb 0x1badc0d31a20
jmp 0x1badc0d31b16
or byte [0x1badc0d53630], 0x57
mov r12, qword [rsp + 0x338]
vmovdqu xmm0, xmmword [str.94d41egec_v6_z__]
mov r15, qword [rsp + 0x320]
lea rdx, [0x1badc0d536b0]
mov r14, qword [rsp + 0x328]
mov rdi, rbx
mov r13, qword [rsp + 0x330]
mov rsi, qword [rsp + 0x348]
vmovdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x32353522
mov word [rsp + 0x74], 0x5739
movzx eax, byte [rsp + rdi + 0x60]
mov byte [rbp + 0x270], al
movsx ecx, byte [rbp + 0x270]
or cl, byte [0x1badc0d53630]
mov byte [rbp + 0x270], cl
movzx eax, byte [rbp + 0x270]
xor al, 0x57
mov byte [rdi + rdx], al
inc rdi
cmp rdi, 0x16
jb 0x1badc0d31b65
mov rdi, qword [rsp + 0x340]
lea rax, [rbp + 0x278]
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], rbx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call fcn.1badc0d31e30
lea r8, [0x1badc0d536c8]
mov dword [rsp + 0x50], 0x3233383c
mov dword [rsp + 0x54], 0x57332538
movzx eax, byte [rsp + rbx + 0x50]
mov byte [rbp + 0x270], al
movsx ecx, byte [rbp + 0x270]
or cl, byte [0x1badc0d53630]
mov byte [rbp + 0x270], cl
movzx eax, byte [rbp + 0x270]
xor al, 0x57
mov byte [rbx + r8], al
inc rbx
cmp rbx, 8
jb 0x1badc0d31bf3
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x50]
mov rbx, qword [rsp + 0x360]
xor edx, edx
mov dword [rsp + 0x28], 0x11
mov r9d, 1
mov qword [rsp + 0x20], rax
call fcn.1badc0d31e3d
lea rdx, [rbp - 0x5c]
mov dword [rbp - 0x5c], 0x40
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x1badc0d31c78
mov eax, 1
add rsp, 0x350
pop rbp
ret
call section..text
cmp byte [0x1badc0d53631], 0
je 0x1badc0d31c94
mov eax, 2
add rsp, 0x350
pop rbp
ret
mov byte [rsp + 0x60], 0x39
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x61], 0x34
mov edx, 0x20
mov byte [rsp + 0x62], 0x64
mov byte [rsp + 0x63], 0x79
mov byte [rsp + 0x64], 0x79
mov byte [rsp + 0x65], 0x79
mov byte [rsp + 0x66], 0x38
mov byte [rsp + 0x67], 0x30
mov byte [rsp + 0x68], 0x7b
mov byte [rsp + 0x69], 0x77
mov byte [rsp + 0x6a], 0x3f
mov byte [rsp + 0x6b], 0x38
mov byte [rsp + 0x6c], 0x21
mov byte [rsp + 0x6d], 0x76
mov byte [rsp + 0x6e], 0x76
mov byte [rsp + 0x6f], 0x77
mov byte [rsp + 0x70], 0x1f
mov byte [rsp + 0x71], 1
mov byte [rsp + 0x72], 0x18
mov byte [rsp + 0x73], 5
mov byte [rsp + 0x74], 0x77
mov byte [rsp + 0x75], 0x12
mov byte [rsp + 0x76], 5
mov byte [rsp + 0x77], 0x77
mov byte [rsp + 0x78], 0x11
mov byte [rsp + 0x79], 0x1b
mov byte [rsp + 0x7a], 0x16
mov byte [rsp + 0x7b], 0x10
mov byte [rsp + 0x7c], 0x12
mov byte [rsp + 0x7d], 3
mov byte [rsp + 0x7e], 0x68
mov byte [rsp + 0x7f], 0x76
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor al, 0x57
mov byte [rcx - 1], al
sub rdx, 1
jne 0x1badc0d31d40
movzx eax, byte [0x1badc0d53630]
or al, 0x69
movzx ecx, al
movsx eax, byte [rbp - 0x30]
mov byte [0x1badc0d53630], cl
cmp eax, ecx
jne 0x1badc0d31da6
add cl, 0x52
mov dword [rbp + 0x270], 0x40
mov byte [0x1badc0d53630], cl
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1badc0d31da6
cmp dword [rsp + 0x60], 0x74736574
je 0x1badc0d31da6
xor byte [0x1badc0d53630], 0x44
xor eax, eax
add rsp, 0x350
pop rbp
ret