Function at 0x1400116d1
Capabilities:
Check if file exists
Create process on windows
Execute command
Get file attributes
Set current directory

Disassembly:
jmp 0x14001e7e0
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030018]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x1400370f7]
call fcn.1400119e2
lea rdx, str.https:__drive.google.com_u_2_uc_id1oNbgkcNHC82pNJALAq4f4V4f09p64KJyexportdownloadconfirmtuuidb6e15e88_1333_4cc0_8ce5_2521506251faatAB6BwCD6SQJvF9ZxECrBrk9ovxoD:1697079503271
lea rcx, [rbp + 8]
call fcn.140011343
nop
lea rdx, str.FTKImager.zip
lea rcx, [rbp + 0x48]
call fcn.140011343
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.140011604
movzx eax, al
test eax, eax
je 0x14001e9ee
lea rcx, [rbp + 0x48]
call fcn.14001134d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001e9c9
lea r8, [rbp + 0x48]
lea rdx, str.powershell__Command__Expand_Archive__Path_
lea rcx, [rbp + 0x1e8]
call fcn.140011a96
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x240], rax
lea r8, str.__DestinationPath_.__Force_
mov rdx, qword [rbp + 0x240]
lea rcx, [rbp + 0x88]
call fcn.1400115dc
nop
lea rcx, [rbp + 0x1e8]
call fcn.1400118ac
lea rcx, [rbp + 0x88]
call fcn.14001134d
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__wsystem]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jne 0x14001e997
lea rdx, str.Extracted_the_contents_to_the_current_directory_using_PowerShells_Expand_Archive_cmdlet__may_not_work_for_RAR_files_.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001150f
lea rdx, [0x1400114bf]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.FTK_Imager
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x14001e944
lea rdx, str.Failed_to_set_the_current_working_directory_to_the_FTK_Imager_folder.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001150f
lea rdx, [0x1400114bf]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.FTK_Imager.exe
lea rcx, [rbp + 0xe8]
call fcn.140011343
lea rcx, [rbp + 0xe8]
call fcn.14001134d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0xe8]
call fcn.1400118ac
jmp 0x14001e9bb
lea rdx, str.Extraction_may_not_work_as_expected_for_RAR_files_using_native_PowerShell_cmdlets.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001150f
lea rdx, [0x1400114bf]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x88]
call fcn.1400118ac
jmp 0x14001e9ec
lea rdx, str.Downloaded_file_not_found.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001150f
lea rdx, [0x1400114bf]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14001ea11
lea rdx, str.Failed_to_download_the_file.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001150f
lea rdx, [0x1400114bf]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0x224], 0
lea rcx, [rbp + 0x48]
call fcn.1400118ac
nop
lea rcx, [rbp + 8]
call fcn.1400118ac
mov eax, dword [rbp + 0x224]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140029d20]
call fcn.140011857
mov eax, edi
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.1400114b5
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret