Function at 0x4027bd
Capabilities:
Check os version
Create process on windows
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ebx
push edi
imul esi, esi, 0x36
mov eax, 0x445e36
mov dword [ebp - 8], eax
cmp esi, 0x4c
lea edi, [esi + 0x9c]
ja 0x4027ed
mov esi, 0x206
sub esi, ebx
jmp 0x40287a
cmp esi, 0x57
jne 0x4027fb
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x40287a
cmp esi, 0x1b
jb 0x402b3e
cmp esi, 0x51
ja 0x402810
mov esi, 0x96
jmp 0x40287a
cmp esi, 0x345804
jne 0x40286f
cmp ebx, 0xf826
jne 0x402829
add dword [ebp - 8], 0x168a
jmp 0x40287a
cmp ebx, 0x36
jne 0x40283c
push edi
push 0xffcba8a4
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x40287a
cmp ebx, 3
jae 0x402850
lea eax, [edi + 0x3bb]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x40287a
cmp ebx, 0x16
jae 0x402863
mov eax, edi
mov esi, 0xfffffe2b
imul eax, edi
sub esi, eax
jmp 0x40287a
cmp ebx, 6
jae 0x40287a
mov al, 4
jmp 0x402b40
cmp esi, 9
jae 0x40287a
and esi, 0xfa
xor edi, ebx
mov eax, 0xf826
and esi, 0x179
or di, 0x38e
cmp ebx, eax
jne 0x40289f
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
lea ecx, [ecx + esi + 0x2cb53]
mov dword [ebp - 0x18], ecx
mov ecx, 0x1c2
xor esi, ecx
cmp ebx, 0x2f
jne 0x4028b0
push 0x53
pop edi
jmp 0x4028c6
cmp ebx, 0x5e
jae 0x4028ba
lea esi, [ebx + 1]
jmp 0x4028c6
cmp ebx, eax
jne 0x4028c6
mov eax, 0x443e1e
mov dword [ebp - 8], eax
mov eax, edi
xor edx, edx
div esi
imul eax, eax, 0x256
cmp esi, 4
jae 0x4028e7
mov eax, esi
and eax, 0x3df
xor eax, 0xe3
or eax, esi
jmp 0x40293e
cmp esi, 0x26
je 0x40293e
cmp esi, ecx
jne 0x40293e
cmp ebx, 0xa
jb 0x402b3e
cmp ebx, 0x3c
jb 0x402b40
cmp ebx, 0x1c
jne 0x40290e
mov eax, 0x35f
jmp 0x40293e
cmp ebx, 0x63
jae 0x40291a
mov eax, 0x375
jmp 0x40293e
cmp ebx, 0xf826
jne 0x40292b
add dword [ebp - 8], 0x2212
jmp 0x40293e
cmp ebx, 0x34
ja 0x40293e
mov eax, ebx
xor edx, edx
imul eax, eax, 0x394
div ebx
mov eax, edx
mov ecx, dword [ebp - 8]
cmp ebx, 5
mov dword [ebp - 0x10], ecx
jae 0x402964
lea ecx, [ebx + 0x273]
xor edx, edx
push ecx
push 0x67
pop ecx
div ecx
mov eax, ebx
sub eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x402987
cmp ebx, 0x60
jb 0x402987
cmp ebx, 0x19
jb 0x402b40
cmp ebx, 0x62
je 0x402987
cmp ebx, 0xf826
jne 0x402987
add eax, 0xffba183e
mov dword [ebp - 8], eax
and dword [ebp - 0x1c], 0
cmp dword [ebp - 8], 0
jbe 0x402b3e
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
or word [ebp - 0x14], 0x1a8
and dword [ebp - 0xc], 3
mov edi, dword [ebp - 0x14]
cmp ebx, 0xf826
jne 0x4029e4
cmp edi, 8
jae 0x4029bd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x4029e4
cmp edi, 0xf9ae
jne 0x4029d6
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
push eax
call fcn.00401969
pop ecx
mov byte [ebp + 0xb], al
jmp 0x4029f9
cmp edi, 0x41
jne 0x4029e4
mov edi, dword [ebp - 0xc]
or edi, 0xff
cmp edi, 0xf9ae
jne 0x402a22
cmp ebx, 0x40
je 0x402a54
cmp ebx, 0xf826
jne 0x402a54
mov eax, 0xf9ae
xor edx, edx
div dword [ebp - 0xc]
xor edx, edx
mov ecx, 0x17a
div ecx
mov eax, dword [ebp - 0x10]
mov al, byte [edx + eax - 0xce]
push eax
call fcn.00401969
pop ecx
mov byte [ebp - 1], al
jmp 0x402a54
cmp edi, 0x62
je 0x402a54
cmp edi, 3
jne 0x402a36
mov edi, ebx
and edi, 0x6f3
jmp 0x402a54
cmp edi, 0x31
jae 0x402a49
push dword [ebp - 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x402a54
cmp edi, 0x1b
jne 0x402a54
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, edi
mov eax, dword [ebp - 0xc]
imul esi, esi, 0x264
xor eax, 0xd9
or esi, eax
cmp edi, 0xf9ae
jne 0x402a99
mov dl, byte [ebp + 0xb]
lea ecx, [ebx - 0x46]
and ecx, 0x1f5
mov eax, edi
or ecx, esi
sub ecx, 0x254e3f7
shl dl, cl
mov ecx, dword [ebp - 0x18]
or dl, byte [ebp - 1]
mov byte [ebp - 2], dl
xor edx, edx
div esi
mov dl, byte [ebp - 2]
mov byte [eax + ecx], dl
mov eax, edi
or al, 0x56
or esi, eax
cmp esi, 8
je 0x402af6
cmp esi, 0x254fbff
jne 0x402af1
cmp ebx, 5
jb 0x402b45
cmp ebx, 0xd
jb 0x402b21
cmp ebx, 0xf826
jne 0x402aea
cmp edi, 0x12
je 0x402b21
cmp edi, 0x20
je 0x402b49
cmp edi, 0x4c
je 0x402b2e
cmp edi, 0x41
jb 0x402b21
cmp edi, 0xf9ae
jne 0x402ae3
inc dword [ebp - 0x18]
jmp 0x402b21
cmp edi, 0xc
jbe 0x402b4d
jmp 0x402b21
cmp ebx, 0x1f
jne 0x402b21
jmp 0x402b2e
cmp esi, 0x54
je 0x402b3e
cmp esi, 0x36
jb 0x402b2e
cmp esi, 0x37
jb 0x402b2e
cmp esi, 0x1e
jae 0x402b14
or esi, 0xf6
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x402b2e
cmp esi, 0x58
jb 0x402b3e
cmp esi, 0x254fbff
jne 0x402b2e
mov eax, dword [ebp - 0x10]
lea eax, [eax + ebx - 0xf824]
mov dword [ebp - 0x10], eax
add dword [ebp - 0x1c], 2
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 8]
jb 0x4029a5
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
or al, 0xff
jmp 0x402b40
mov al, 0x20
jmp 0x402b40
mov al, 0x26
jmp 0x402b40