Function at 0x4013e8
Capabilities:
Check os version
Shutdown system
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x310
push ebx
xor ebx, ebx
cmp byte [ebp + 0x78], bl
je 0x40148d
cmp byte [ebp + 0x78], 0x41
jl 0x40140f
cmp byte [ebp + 0x78], 0x5a
jg 0x40140f
add byte [ebp + 0x78], 0x20
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push ebx
mov esi, str.AxifeFMPlayerWndClass
push esi
call edi
mov dword [ebp + 0x6c], eax
movsx eax, byte [ebp + 0x78]
cmp eax, 0x35
mov dword [ebp + 0x64], eax
jg 0x40165e
cmp eax, 0x35
je 0x4015d3
sub eax, 0x31
je 0x401493
dec eax
je 0x401453
dec eax
je 0x401493
dec eax
je 0x4015f3
jmp 0x401680
push 0xa
push ebx
push dword [ebp + 0x7c]
call fcn.0040223a
add esp, 0xc
push 0x12
mov dword [ebp], eax
pop ecx
xor eax, eax
lea edi, [ebp + 0xc]
mov dword [ebp - 4], 0x58
mov dword [ebp + 4], 1
mov dword [ebp + 8], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret
cmp dword [ebp + 0x6c], ebx
je 0x40148b
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x723
push dword [ebp + 0x6c]
mov dword [ebp + 0x78], 0x65
call edi
test eax, eax
je 0x4014bc
mov dword [ebp + 0x78], 0x66
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x40
push dword [ebp + 0x7c]
lea eax, [ebp - 0x80]
push eax
call esi
push ebx
push ebx
push 0x646
push dword [ebp + 0x6c]
call edi
cmp eax, ebx
mov dword [ebp + 0x64], eax
je 0x401576
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x750
push dword [ebp + 0x6c]
call edi
test eax, eax
jne 0x40150c
mov byte [ebp - 0x180], bl
push 0x43
pop ecx
xor eax, eax
mov dword [ebp - 0x2a0], 0x202d20
lea edi, [ebp - 0x29c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x29d]
push eax
lea eax, [ebp - 0x180]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.FMAux.dll_FMAuxStation]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x80]
push eax
call edi
push 0x40
pop ecx
sub ecx, eax
push ecx
lea ecx, [ebp - 0x2a0]
push ecx
lea eax, [ebp + eax - 0x80]
push eax
call esi
lea eax, [ebp - 0x80]
push eax
call edi
cmp eax, 0x3f
jne 0x401576
push 0x40559c
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x6c]
push 0x8000
push 0x10
push 0x10
xor edi, edi
inc edi
push edi
push dword [ebp + 0x78]
mov dword [ebp - 4], 0x58
push dword [0x40748c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], 7
mov dword [ebp + 0xc], 0x500
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov dword [ebp + 0x10], eax
pop ecx
xor eax, eax
lea edi, [ebp + 0x14]
rep stosd dword es:[edi], eax
push 0x40
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x14]
push eax
call esi
lea eax, [ebp - 4]
push eax
push ebx
jmp 0x401485
lea eax, [ebp + 0x6c]
push eax
push str.HideWarnings
push str.FMLog
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.FMIni.dll_FMIniGetDword]
cmp dword [ebp + 0x6c], ebx
jne 0x40148b
cmp byte [ebp + 0x78], 0x34
mov eax, str.MutexFMAuxDlgError
je 0x401603
mov eax, str.MutexFMAuxDlgWarning
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
je 0x40161f
cmp eax, 0xb7
je 0x40164a
push str.riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebp + 0x64]
mov edi, eax
push 0x401141
push ebx
push 0x66
push dword [0x40748c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
je 0x40148b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40148b
sub eax, 0x36
je 0x4018e2
dec eax
je 0x401883
sub eax, 0x3a
je 0x40186e
sub eax, 6
je 0x4017dc
cmp dword [ebp + 0x6c], ebx
jne 0x4016bc
push ebx
push ebx
push ebx
push str.FMEngine.exe
call fcn.004048b4
add esp, 0x10
mov dword [ebp + 0x78], ebx
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x6c], eax
jne 0x4016bc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 0x78]
cmp dword [ebp + 0x78], 0x1f4
jb 0x401698
jmp 0x40148b
mov eax, dword [ebp + 0x64]
sub eax, 0x66
je 0x4017ca
sub eax, 7
je 0x4017c5
dec eax
je 0x401798
sub eax, 4
je 0x40178e
dec eax
je 0x40178a
dec eax
dec eax
je 0x401775
dec eax
jne 0x40148b
mov edi, dword [ebp + 0x7c]
mov al, byte [edi]
cmp al, 0x2b
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x40171a
cmp al, 0x2d
je 0x40171a
push edi
call fcn.004013c0
pop ecx
mov ecx, eax
shl ecx, 0x10
or eax, ecx
jmp 0x401764
push ebx
push ebx
push 0x67f
push dword [ebp + 0x6c]
call esi
movzx ecx, ax
shr eax, 0x10
cmp ecx, eax
jae 0x401736
mov edx, ecx
mov ecx, eax
jmp 0x401738
mov edx, eax
cmp edx, 5
jae 0x401741
xor edx, edx
jmp 0x401744
sub edx, 5
cmp ecx, 0x5f
jb 0x40174e
push 0x64
pop ecx
jmp 0x401751
add ecx, 5
cmp byte [edi], 0x2b
jne 0x40175d
mov eax, ecx
shl eax, 0x10
jmp 0x401716
mov eax, edx
shl eax, 0x10
or eax, edx
push ebx
push eax
push 0x684
push dword [ebp + 0x6c]
call esi
jmp 0x40148b
push ebx
push ebx
push 0x67a
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40148b
push ebx
push ebx
jmp 0x401791
push ebx
push 1
push 0x722
jmp 0x40177c
mov ecx, dword [ebp + 0x7c]
mov al, byte [ecx]
cmp al, 0x2b
push ebx
jne 0x4017aa
push ebx
push 0x753
jmp 0x40177c
cmp al, 0x2d
jne 0x4017b6
push ebx
push 0x754
jmp 0x40177c
push ecx
call fcn.004013c0
pop ecx
push eax
push 0x757
jmp 0x40177c
push ebx
push 1
jmp 0x401777
push ebx
push dword [ebp + 0x7c]
call dword [sym.imp.FMAux.dll_FMAuxText2Freq]
push eax
push 0x647
jmp 0x40177c
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edi, edi
push 2
inc edi
pop esi
cmp dword [ebp - 0x30], esi
mov dword [ebp + 0x64], edi
jne 0x40185f
cmp dword [ebp - 0x3c], 4
je 0x401808
mov dword [ebp + 0x64], 8
lea eax, [ebp + 0x68]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x40185f
lea eax, [ebp + 0x78]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40185f
mov eax, dword [ebp + 0x68]
push ebx
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x6c]
push ebx
push ebx
mov dword [ebp + 0x5c], eax
lea eax, [ebp + 0x54]
push eax
push ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x60], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40148b
cmp dword [ebp + 0x6c], ebx
je 0x40148b
push ebx
push ebx
push 0x600
jmp 0x40177c
mov edi, dword [ebp + 0x7c]
jmp 0x40188d
cmp al, 0x20
je 0x401893
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x401888
cmp byte [edi], bl
jne 0x40189a
push ebx
jmp 0x4018f6
inc edi
mov cl, byte [edi]
mov eax, edi
jmp 0x4018a9
cmp cl, 0x20
je 0x4018ad
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x4018a1
cmp byte [eax], bl
push ebx
je 0x4018f6
inc eax
push ebx
push eax
call fcn.0040223a
add esp, 0xc
push eax
push ebx
push ebx
push edi
call fcn.0040223a
add esp, 0xc
push eax
push ebx
push ebx
push dword [ebp + 0x7c]
call fcn.0040223a
add esp, 0xc
push eax
call fcn.00401106
add esp, 0xc
jmp 0x4018f5
push ebx
push ebx
push dword [ebp + 0x7c]
call fcn.0040223a
push eax
call fcn.00401b3c
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]