Function at 0x100180c7
Capabilities:
Create process on windows
Encrypt data using speck
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100591e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5e8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x314], 0x2160
mov dword [ebp - 0x418], str.xznil_bzwqj_fyfb_gsnypa_vxelbqc_biazofosm_babiswqjo_xek_fgttrfhfz_dkvjtvt_ihiwwhqzo_mmmgqpcfy
cmp dword [ebp - 0x314], 0x23cd
jle 0x100181b7
and dword [ebp - 0x12c], 0
jmp 0x1001812d
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x5979
jge 0x100181b7
and dword [ebp - 0xf8], 0
jmp 0x1001814f
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x44fb
jge 0x100181b2
mov eax, dword [ebp - 0x12c]
and eax, dword [ebp - 0xf8]
cdq
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], edx
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x5bc]
call fcn.10001ade
pop ecx
pop ecx
mov dword [ebp - 0x3ac], eax
mov ecx, dword [ebp - 0x3ac]
call fcn.10013ea4
push eax
call fcn.1004041f
pop ecx
lea ecx, [ebp - 0x5bc]
call fcn.10013e9a
jmp 0x10018142
jmp 0x10018120
and dword [ebp - 4], 0
cmp dword [ebp - 0x314], 0x1e71
jge 0x100181d3
push dword [ebp - 0x418]
call fcn.1004041f
pop ecx
jmp 0x100181ef
or dword [ebp - 4], 0xffffffff
jmp 0x100181f9
mov dword [ebp - 0x310], 0x3bfa32a1
mov dword [ebp - 0x174], 0x3531
mov dword [ebp - 0x318], 0xa13b2885
mov dword [ebp - 0x98], 0
jmp 0x10018230
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1001824c
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x4e4], 0
jmp 0x10018223
mov dword [ebp - 0x60], 0
jmp 0x1001825c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 8
jle 0x100182b0
mov dword [ebp - 0x8c], 0xb96ca2cb
mov dword [ebp - 0x8c], 0xffffffe3
jmp 0x10018285
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x1b
je 0x100182ae
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x100182ac
push 0x4a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x10018278
jmp 0x10018255
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp + eax - 0x4e4]
jg 0x100182ce
mov dword [ebp - 0x398], 1
jmp 0x100182d5
and dword [ebp - 0x398], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4e4]
cmp eax, dword [ebp - 0x398]
je 0x100182f6
mov dword [ebp - 0x16c], 1
jmp 0x100182fd
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4e4]
lea eax, [ecx + eax - 0x21a3]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x534], eax
imul eax, dword [ebp - 0x60], 0
test eax, eax
je 0x10018493
mov dword [ebp - 0x17c], 0x54a
mov dword [ebp - 0x4c8], str.qkrtrogqz_hqqvrbovr_cjdcfl_rwpmkjus_nzogtwxc_qqecao_pqkf_hqkhmjlv
cmp dword [ebp - 0x17c], 0x8e1
jle 0x10018411
and dword [ebp - 0xa0], 0
jmp 0x10018387
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x1ad
jge 0x10018411
and dword [ebp - 0x100], 0
jmp 0x100183a9
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1001
jge 0x1001840c
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x100]
cdq
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
push dword [ebp - 0x434]
push dword [ebp - 0x438]
lea ecx, [ebp - 0x5d4]
call fcn.10001ade
pop ecx
pop ecx
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x420]
call fcn.10013ea4
push eax
call fcn.1004041f
pop ecx
lea ecx, [ebp - 0x5d4]
call fcn.10013e9a
jmp 0x1001839c
jmp 0x1001837a
mov byte [ebp - 0x50], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x17c], 0x4fb
jge 0x10018434
push dword [ebp - 0x4c8]
call fcn.1004041f
pop ecx
jmp 0x10018450
or dword [ebp - 4], 0xffffffff
jmp 0x1001845a
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x1001847f
push 0
push 0
push 0
push 0
push 0x13c7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x10018491
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x100184b5
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x100184b5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0xa8], 0
jmp 0x100184d8
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x100184f4
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x59c], 0
jmp 0x100184cb
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x1001851b
push 0
push 0
push 0x1606
push 0x1947
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov dword [ebp - 0x11c], 0
jmp 0x10018534
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jg 0x1001857e
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x84], 0
jmp 0x10018560
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1001857c
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x59c], 0xa9ef72d4
jmp 0x10018553
jmp 0x10018527
mov dword [ebp - 0x350], 0x3a52
mov dword [ebp - 0x3b8], str.xgl_evbfeq_zmmw_czhc_iawvtr_uyvpeq_icqdoqphv_yylzemku_btuwylaqo_uqichrdrl_mvecxrbl_muqhiutjj_ypdfyk_mzsgfyf
cmp dword [ebp - 0x350], 0x3e1b
jle 0x1001867e
and dword [ebp - 0xb8], 0
jmp 0x100185b8
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x4f37
jge 0x1001867e
and dword [ebp - 0x120], 0
jmp 0x100185de
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xf54
jge 0x10018679
and dword [ebp - 0xb0], 0
jmp 0x10018604
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x2d3c
jge 0x10018674
and dword [ebp - 0x108], 0
jmp 0x10018626
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x6f7b
jge 0x10018672
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0xb8]
xor ecx, dword [ebp - 0x120]
xor eax, ecx
cdq
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], edx
push dword [ebp - 0x440]
push dword [ebp - 0x444]
mov ecx, 0x10072098
call fcn.10013ec4
jmp 0x10018619
jmp 0x100185f7
jmp 0x100185d1
jmp 0x100185ab
mov dword [ebp - 0x28], 0xf665683c
mov dword [ebp - 0x18c], 0x8b166c19
mov dword [ebp - 0x330], 0x1f6f49c2
mov dword [ebp - 0x340], 0x8551b32e
mov dword [ebp - 0x410], 0xfffffffc
mov dword [ebp - 0x540], 1
mov dword [ebp - 0x550], 0x20410224
mov dword [ebp - 0x4ec], 0xae89405d
mov dword [ebp - 0x34], 0
jmp 0x100186db
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100186f1
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5e0], 6
jmp 0x100186d4
mov dword [ebp - 0x34], 0
jmp 0x10018701
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10018717
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1ac], 0
jmp 0x100186fa
cmp dword [ebp - 0x28], 0
jne 0x100187b0
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
cmp ecx, dword [ebp - 0x28]
jl 0x1001873d
mov dword [ebp - 0x320], 1
jmp 0x10018744
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x320]
test eax, eax
jae 0x1001875e
mov dword [ebp - 0x184], 1
jmp 0x10018765
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
sub eax, 8
cmp eax, dword [ebp - 0x28]
jl 0x1001877f
mov dword [ebp - 0x328], 1
jmp 0x10018786
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jne 0x100187b0
and dword [ebp - 0x194], 0
jmp 0x100187ba
mov dword [ebp - 0x194], 1
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x194]
jl 0x100187d1
mov dword [ebp - 0x338], 1
jmp 0x100187d8
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0xfff7
je 0x100187fa
or eax, 0xffffffff
je 0x100187fa
or eax, 0xffffffff
je 0x100187fa
mov dword [ebp - 0x19c], 1
jmp 0x10018801
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
cmp eax, dword [ebp - 0x28]
jg 0x10018824
mov dword [ebp - 0x1a4], 1
jmp 0x1001882b
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x1a4], 0xfffffff8
jae 0x10018840
mov dword [ebp - 0x348], 1
jmp 0x10018847
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp + 0x53ec8b55]
push ebp
mov ebp, esp
push ebx