Function at 0x406934
Capabilities:
Check os version
Create process on windows
Get common file path
Get disk information
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00406dc9
test eax, eax
pop ecx
je 0x406dc0
push dword [ebp + 0x10]
call fcn.0040666f
xor ebx, ebx
pop ecx
cmp dword [0x411940], ebx
mov edi, 0x104
jne 0x406af7
push edi
push dword [0x411934]
push dword [0x411a0c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x411934]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x406991
cmp byte [eax + 1], cl
je 0x4069a3
cmp cl, bl
je 0x4069a3
cmp byte [eax + 1], 0x3a
jne 0x4069a3
mov byte [eax + 3], bl
mov eax, dword [0x411934]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x406af7
mov dword [ebp + 0x10], ebx
push dword [0x411930]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x411930]
call fcn.00401e24
pop ecx
push dword [ebp + 0x10]
push str._upd_d.exe
push dword [0x411930]
call fcn.00407c50
add eax, dword [0x411930]
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [0x411930]
call section..text
or esi, 0xffffffff
add esp, 0x14
cmp eax, esi
je 0x406a12
push eax
call fcn.00401225
pop ecx
mov dword [ebp + 8], esi
jmp 0x406a25
push dword [0x411930]
call fcn.0040104d
cmp eax, esi
pop ecx
mov dword [ebp + 8], eax
jne 0x406a3a
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0x3e7
jl 0x4069b6
cmp dword [ebp + 8], esi
je 0x406af7
push ebx
push dword [0x4119e0]
call section..text
pop ecx
cmp eax, esi
pop ecx
mov dword [ebp - 0x14], eax
je 0x406aee
lea eax, [ebp + 0x10]
push eax
push dword [0x40f19e]
call fcn.00401e6f
pop ecx
test eax, eax
pop ecx
je 0x406a96
push dword [0x40f19e]
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call fcn.00401077
push dword [0x40f19e]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004010cd
lea eax, [ebp + 0x10]
push eax
call fcn.00401ecf
add esp, 0x1c
push dword [ebp - 0x14]
call fcn.00401225
push dword [ebp + 8]
call fcn.00401225
push str.__S_
push dword [0x411930]
call fcn.00407ce0
push dword [0x4119e0]
push dword [0x411930]
call fcn.00407ce0
push str.___DEL
push dword [0x411930]
call fcn.00407ce0
add esp, 0x20
push dword [ebp + 0x14]
push dword [0x411930]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x406dbb
push dword [ebp + 8]
call fcn.00401225
pop ecx
mov esi, 0x94
lea eax, [ebp - 0xa8]
push esi
push ebx
push eax
call fcn.00408440
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x98], 2
sete al
cmp eax, ebx
mov dword [0x411a14], eax
je 0x406b48
cmp dword [ebp - 0xa4], 4
mov dword [0x411a10], 1
je 0x406b4e
mov dword [0x411a10], ebx
cmp dword [0x411940], ebx
je 0x406b77
push edi
push dword [0x411934]
push dword [0x411a0c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x411934]
push ebx
call fcn.00406786
pop ecx
pop ecx
call fcn.00406efc
test eax, eax
je 0x406dc0
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
push 1
mov dword [0x4119ec], eax
call edi
mov dword [0x4119e8], eax
call fcn.00407011
test eax, eax
je 0x406bb8
call fcn.00407462
call fcn.00406f64
test eax, eax
jne 0x406bc0
or eax, 0xffffffff
jmp 0x406dc2
xor eax, eax
test byte [0x4119dc], 1
je 0x406bcc
inc eax
push eax
call fcn.00403751
pop ecx
mov edi, eax
push ebx
push 0x405e60
push dword [0x411a08]
push edi
push dword [0x411a0c]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp eax, ebx
mov dword [0x411a04], eax
je 0x406d05
test byte [0x4119dc], 1
jne 0x406c54
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xca0000
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [ebp - 4]
push 4
sub eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x411a08]
call esi
push 5
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x411a04]
call esi
push 1
push dword [0x411a08]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x411a08]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ax, word [0x40f1aa]
xor ecx, ecx
cmp ax, 0xffff
mov dword [0x4119fc], ecx
je 0x406c8b
movzx ecx, ax
mov dword [0x4119fc], ecx
mov eax, ecx
push ebx
shl eax, 2
push dword [eax + 0x40f200]
push dword [eax + 0x40f1e0]
call fcn.004037f2
add esp, 0xc
cmp word [0x40f1aa], 0xffff
jne 0x406cf9
dec eax
je 0x406ccd
dec eax
je 0x406cf2
sub eax, 0x3ed
jne 0x406ce5
cmp dword [0x4119fc], ebx
jle 0x406ce5
dec dword [0x4119fc]
jmp 0x406ce5
cmp dword [0x4119fc], 6
jge 0x406cde
inc dword [0x4119fc]
jmp 0x406ce5
or dword [0x4119fc], 0xffffffff
mov ecx, dword [0x4119fc]
cmp ecx, 0xffffffff
jne 0x406c8b
jmp 0x406cf9
or dword [0x4119fc], 0xffffffff
push dword [0x411a04]
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
call fcn.0040378d
cmp dword [0x411944], ebx
pop ecx
je 0x406db1
push 0xa
call fcn.00403751
mov edi, eax
pop ecx
cmp edi, ebx
je 0x406db1
push ebx
push 0x405d5f
push dword [0x411a08]
push edi
push dword [0x411a0c]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push edi
mov esi, eax
call fcn.0040378d
xor edi, edi
pop ecx
inc edi
cmp esi, edi
jne 0x406db1
cmp dword [0x411a1c], ebx
jne 0x406db1
cmp dword [0x411a14], ebx
je 0x406da8
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x406db1
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 2
lea eax, [ebp - 0x10]
pop esi
mov dword [ebp - 0x10], edi
push ebx
push ebx
push ebx
push eax
push ebx
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
jmp 0x406dab
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call fcn.00406fd8
call fcn.004065d2
call fcn.00406e98
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10