; Coder : Ivan2k2
; Location : Russia,Angarsk
;
; Greetings 2 :
; - Tomasz Grysztar for FASM
; -
; - chris for 159 bytes
; - Ancient One for 104 bytes
;
; - sOUR
; - Alex-
; - LisP
;
; Tested in WiND0ZE XP SP2


imageBase = 0x10000
ShutdownPowerOff = 2
SeShutdownPrivilege = 0x13
SE_PRIVILEGE_ENABLED = 0x2
TOKEN_ADJUST_PRIVILEGES = 0x20

NtAdjustPrivilegesToken = 011
NtOpenProcessToken = 123
NtShutdownSystem = 249

use32

dosHeader:

dw 'MZ'
dw 0

ntHeader:

dd 'PE'
dw 0x14c
dw 0

entryPoint :
_12_bytes :

lea edi,[edx-9] ; 3 here is magic
mov ebx,esp ; 2
push ebx ; 1
push TOKEN_ADJUST_PRIVILEGES ; 2
push (-1) ; 2
jmp _14_bytes ; 2

dw sizeof.optionalHeader
dw 0x102

optionalHeader:

dw 0x10b

_14_bytes :

push ebx ; 1
mov al,NtOpenProcessToken ; 2
call edi ; 2
push ShutdownPowerOff ; 2
push eax ; 1
push SeShutdownPrivilege ; 2
push 1 ; 2
jmp _08_bytes_a ; 2

dd entryPoint

_08_bytes_a :

mov ebp,esp ; 2
push eax ; 1
push eax ; 1
push eax ; 1
push ebp ; 1
jmp _08_bytes_b ; 2

dd imageBase
dd 4
dd 4

_08_bytes_b :

push eax ; 1
push dword[ebx] ; 2
push ebp ; 1
mov al,NtAdjustPrivilegesToken ; 2
jmp _04_bytes ; 2

dw 3

_06_bytes : ; 5 bytes of code and 1 empty byte

leave ; 1
mov al,NtShutdownSystem ; 2
call edi ; 2

db 0 ; 1 empty byte
dd sizeof.image
dd sizeof.peHeaders

_04_bytes :

call edi ; 2
jmp _06_bytes ; 2

db 2

sizeof.optionalHeader = $-optionalHeader
sizeof.peHeaders = sizeof.optionalHeader
sizeof.image = $