Function at 0x402a00
Capabilities:
Check os version
Get common file path
Shutdown system

Disassembly:
sub esp, 0xc1c
push ebx
push ebp
push esi
push edi
push 0x40
push 0x406800
push 0x4067b8
mov ebx, ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dl, byte [0x406a94]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2cd]
mov byte [esp + 0x2cc], dl
mov byte [esp + 0xc4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc5]
mov byte [esp + 0x6dc], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6dd]
mov byte [esp + 0x8e4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8e5]
mov byte [esp + 0x4d4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4d5]
push 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2d0]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x2cc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._system32USBKey32.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x6dc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x2cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x6dc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._system32YtUSBKey32.sys
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x8e4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2cc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x8e4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.infYtUSBKey.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x4d4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2cc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x4d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x406764
rep movsb byte es:[edi], byte [esi]
mov edi, str._system32driversYtUSBKey.sys
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x60]
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0
mov ecx, esi
call sub.MFC42.DLL_CWnd::EnableWindow
mov eax, dword [esp + 0x40]
mov ebp, 1
cmp eax, ebp
jne 0x402cd5
lea eax, [esp + 0x4d4]
push 0x8a
push eax
call fcn.00403660
lea ecx, [esp + 0x8ec]
push 0x89
push ecx
call fcn.00403660
push 0x8e
push 0
push str.Setup98.ex_
call fcn.00401400
add esp, 0x1c
call fcn.004016f0
call fcn.004015e0
mov eax, dword [0x406a90]
test eax, eax
jne 0x402cb6
push 0
push 0
push 0x40671c
call sub.MFC42.DLL_AfxMessageBox
push 0x406714
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowTextA
push ebp
mov ecx, esi
call sub.MFC42.DLL_CWnd::EnableWindow
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc1c
ret
call fcn.004028d0
test eax, eax
jne 0x402d0c
push eax
push eax
push 0x4066dc
call sub.MFC42.DLL_AfxMessageBox
mov edx, dword [0x406a88]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edx
call esi
mov eax, dword [0x406a84]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc1c
ret
lea ecx, [esp + 0xc4]
push 0x87
push ecx
call fcn.00403660
lea edx, [esp + 0x6e4]
push 0x81
push edx
call fcn.00403660
add esp, 0x10
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
mov ebx, eax
lea eax, [esp + 0xaec]
lea ecx, [esp + 0xc4]
push eax
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x402d94
mov eax, dword [0x406a90]
test eax, eax
jne 0x402f18
push 0
push 0
push 0x4066bc
call sub.MFC42.DLL_AfxMessageBox
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc1c
ret
call fcn.00403760
push section..data
call fcn.004031b0
add esp, 4
test eax, eax
je 0x402de1
lea edx, [esp + 0x10]
lea eax, [esp + 0xc4]
push edx
push ebp
push eax
push section..data
push 0
call dword [0x406a80]
test eax, eax
jne 0x402e56
mov eax, dword [0x406a90]
test eax, eax
jne 0x402e2e
push 0
push 0
push 0x4066a0
jmp 0x402e29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
je 0x402df9
mov eax, dword [0x406a90]
test eax, eax
jne 0x402e2e
jmp 0x402e20
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc4]
push ecx
push edx
push section..data
call fcn.00403330
add esp, 0xc
test eax, eax
jne 0x402e56
mov eax, dword [0x406a90]
test eax, eax
jne 0x402e2e
push 0
push 0
push 0x406688
call sub.MFC42.DLL_AfxMessageBox
push 0x406714
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowTextA
push ebp
mov ecx, esi
call sub.MFC42.DLL_CWnd::EnableWindow
push ebx
mov dword [0x406a8c], ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc1c
ret
push 0x406714
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetWindowTextA
push ebp
mov ecx, esi
call sub.MFC42.DLL_CWnd::EnableWindow
push ebx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402f01
push 0
push 4
push 0x406658
call sub.MFC42.DLL_AfxMessageBox
cmp eax, 6
mov esi, 2
jne 0x402eed
cmp dword [esp + 0x40], esi
jne 0x402eed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0x18]
mov dword [esp + 0x20], ebp
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 0
push 0
lea edx, [esp + 0x28]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
push 0
push edx
push 0
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc1c
ret
mov eax, dword [0x406a90]
test eax, eax
jne 0x402f18
push 0
push 0
push 0x40671c
call sub.MFC42.DLL_AfxMessageBox
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc1c
ret