Function at 0x401000
Capabilities:
Check os version
Shutdown system

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xa8
mov dword [0x40d7b8], eax
push ebp
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x40d7bc], eax
mov eax, dword [esp + 0xc0]
push eax
call fcn.00401480
mov ecx, dword [0x40d7b8]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
add esp, 4
push 0x200
push 0x40e980
push 6
push ecx
call esi
mov edx, dword [0x40d7b8]
push 0x200
push 0x40dac0
push 1
push edx
call esi
mov eax, dword [0x40d7cc]
push 0x200
test eax, eax
push 0x40dcc0
jne 0x40107d
mov eax, dword [0x40d7b8]
push 2
push eax
jmp 0x401086
mov ecx, dword [0x40d7b8]
push 5
push ecx
call esi
mov eax, dword [0x40d7a8]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x4010b3
push 0x42124
push 0x40dac0
push 0x40dcc0
push 0
call edi
cmp eax, 7
je 0x4012bc
mov eax, dword [0x40d7cc]
test eax, eax
je 0x401115
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x30], 2
jne 0x401102
cmp dword [esp + 0x24], 4
jb 0x401102
call fcn.004030a0
cmp eax, 1
je 0x401102
push 0x30
push 0
push 0x40e980
push 0
call edi
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0xa8
ret 0x10
call fcn.00404ff0
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0xa8
ret 0x10
call fcn.004016c0
call fcn.00403b60
call fcn.00403930
call fcn.00403a40
call fcn.00403da0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp eax, 1
jne 0x401180
cmp ecx, 4
ja 0x40115d
jne 0x401180
test edx, edx
jbe 0x401180
mov ebp, dword [esp + 0x2c]
mov byte [0x40eb80], 3
and ebp, 0xffff
cmp ebp, 0x960
jb 0x401180
mov dword [0x40d7b4], 1
mov ebp, 1
cmp eax, ebp
jne 0x401199
cmp ecx, 4
jne 0x401199
test edx, edx
jne 0x401199
mov byte [0x40eb80], 2
cmp eax, 2
jne 0x4011ba
cmp ecx, 4
jb 0x4011aa
mov byte [0x40eb80], 1
cmp eax, 2
jne 0x4011ba
cmp ecx, 4
jbe 0x4011ba
mov dword [0x40d7b0], ebp
call fcn.004012d0
test eax, eax
je 0x4012bc
mov ecx, dword [0x40d7b8]
push 0x200
push 0x40dac0
push 3
push ecx
call esi
mov edx, dword [0x40d7b8]
push 0x200
push 0x40dcc0
push 4
push edx
call esi
mov eax, dword [0x40d7a8]
test eax, eax
jne 0x40120f
push 0x42024
push 0x40dac0
push 0x40dcc0
push 0
call edi
jmp 0x401214
mov eax, 7
cmp eax, 6
jne 0x4012bc
mov al, byte [0x40eb80]
mov esi, dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp al, 2
je 0x401230
cmp al, 3
jne 0x40123b
push 0
push 2
call esi
mov al, byte [0x40eb80]
cmp al, 1
jne 0x4012bc
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401265
mov eax, ebp
pop edi
pop esi
pop ebp
add esp, 0xa8
ret 0x10
lea ecx, [esp + 0x14]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 0
push edx
push 0
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [0x40d7b0]
push 0
test eax, eax
je 0x4012b8
push 0x12
call esi
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0xa8
ret 0x10
push 2
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xa8
ret 0x10