Function at 0x5407f0
Capabilities:
Delete file
Hide shutdown actions via policy

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8791
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.Resetting_the_Group_Policies...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, ebx
call fcn.005494d0
push 6
mov ecx, ebx
call fcn.0055e720
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
xor edi, edi
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], edi
call fcn.005dc5e0
sub esp, 8
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push str.GroupPolicy
push dword [ebx + 0x44]
call fcn.005dc520
cmp byte [ebp + 8], 0
mov byte [ebp - 4], 2
je 0x5408aa
push 4
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call fcn.005771e0
neg eax
sbb edi, edi
neg edi
jmp 0x540927
mov dword [ebp - 0x54], 0x62439c
xor esi, esi
mov dword [ebp - 0x50], str.User
mov dword [ebp - 0x4c], str.Machine
mov dword [ebp - 0x48], str.Admconf.adm
mov dword [ebp - 0x44], str.Adminetres.adm
mov dword [ebp - 0x40], str.Adm_system.adm
mov dword [ebp - 0x3c], str.Admwmplayer.adm
mov dword [ebp - 0x38], str.Admwuau.adm
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + esi*4 - 0x54]
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
add edi, eax
cmp esi, 8
jl 0x5408e4
mov esi, dword [ebp - 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPolicies
push ecx
mov ecx, ebx
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 3
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
mov ecx, ebx
call fcn.005791b0
push 3
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov ecx, ebx
call fcn.005791b0
cmp byte [ebx + 0x48], 0
je 0x540985
push 3
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov ecx, ebx
call fcn.005791b0
movsd xmm0, qword [ebx]
comisd xmm0, xmmword [0x6edab8]
jb 0x5409d7
push 3
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NT
mov ecx, ebx
call fcn.005791b0
cmp byte [ebx + 0x48], 0
je 0x5409b5
push 3
push str.HKLMSOFTWAREWow6432NodePoliciesMicrosoftWindows_NT
mov ecx, ebx
call fcn.005791b0
push 3
push str.HKLMSOFTWAREPoliciesMicrosoftWindows
mov ecx, ebx
call fcn.005791b0
cmp byte [ebx + 0x48], 0
je 0x5409d7
push 3
push str.HKLMSOFTWAREWow6432NodePoliciesMicrosoftWindows
mov ecx, ebx
call fcn.005791b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x64df08
push ecx
mov ecx, ebx
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 1
push str.DisableFirstRunCustomize
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPolicies
push ecx
mov ecx, ebx
call fcn.0057bef0
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc200
movsd xmm0, qword [0x6edac8]
comisd xmm0, xmmword [ebx]
jbe 0x540b07
push 0
push 0
push str.Allow_Programmatic_Cut_Copy_Paste
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.ActiveDesktop
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 0
push str.NoChangingWallpaper
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Explorer
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 0x91
push str.NoDriveTypeAutoRun
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.NoViewContextMenu
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesNonEnum
lea ecx, [ebp - 0x20]
call fcn.005dc260
push 0
push 1
push str.BDEADF00_C265_11D0_BCED_00A0C90AB50F
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0x40000021
push str.6DFD7C5C_2451_11d3_A299_00C04F8EF6AF
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0x20
push str.0DF44EAA_FF21_4412_828E_260A8728E7F1
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x20]
call fcn.005dc260
push 0
push 0
push str.dontdisplaylastusername
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.shutdownwithoutlogon
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.undockwithoutlogon
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 1
push 0
push 0x62439c
push str.legalnoticecaption
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.005537f0
push 1
push 0
push 0x62439c
push str.legalnoticetext
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.005537f0
movsd xmm1, qword [ebx]
movsd xmm0, qword [0x6edab8]
comisd xmm0, xmm1
jbe 0x540c19
push 0
push 1
push str.EnableAdminTSRemote
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsInstaller
call fcn.00553890
movzx eax, al
add edi, eax
jmp 0x540ef2
comisd xmm1, xmmword [0x6edac0]
push 1
lea ecx, [ebp - 0x20]
jbe 0x540eb5
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
call fcn.005dc260
push 0
push 1
push str.NoComponents
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.NoAddingComponents
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
lea ecx, [ebp - 0x20]
call fcn.005dc260
push 0
push 0
push str.ForceActiveDesktopOn
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.NoActiveDesktopChanges
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.NoActiveDesktop
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [ebp - 0x20]
call fcn.005dc260
push 0
push 1
push str.EnableVirtualization
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.EnableInstallerDetection
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.EnableSecureUIAPaths
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.ValidateAdminCodeSignatures
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.EnableUIADesktopToggle
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.EnableCursorSuppression
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 3
push str.ConsentPromptBehaviorUser
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.FilterAdministratorToken
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.UIPIClipboardExceptionFormats
lea ecx, [ebp - 0x20]
call fcn.005da780
push 0
push 0xd
push str.CF_UNICODETEXT
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0x11
push str.CF_DIBV5
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 9
push str.CF_PALETTE
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 2
push str.CF_BITMAP
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.CF_TEXT
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 8
push str.CF_DIB
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 7
push str.CF_OEMTEXT
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.TCGSecurityActivationDisabled
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsEnhancedStorageDevices
call fcn.00553890
push 1
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsWcmSvcLocal
lea ecx, [ebp - 0x20]
call fcn.005dc260
push 0
push 0
push str.fBlockRoaming
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.fBlockNonDomain
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 0
push str.fDisablePowerManagement
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
push 0
push 1
push str.fMinimizeConnections
jmp 0x540ee4
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsCurrentVersionIdentities
call fcn.005dc260
push 1
push 0
push 0x62439c
push 0x62439c
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.005537f0
push 0
push 0
push str.Locked_Down
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call fcn.00553890
movsd xmm0, qword [ebx]
comisd xmm0, xmmword [0x6edb08]
jb 0x540fa1
push 0
push 0
push str.TCGSecurityActivationDisabled
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsEnhancedStorageDevices
call fcn.00553890
push 0
push 1
push str.EnableBackupForWin8Apps
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsSettingSync
call fcn.00553890
push 0
push 1
push str.WCMPresent
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsWcmSvcLocal
call fcn.00553890
push 0
push 0
push str.EnableBuildPreview
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesBuildAndTel
call fcn.00553890
push 0
push 3
push str.AllowTelemetry
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
call fcn.00553890
push 0
push 0
push str.NoRecentDocsHistory
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
call fcn.00553890
push 0
push 2
push str.DSCAutomationHostEnabled
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00553890
push 1
push 0
push 0x62439c
push 0x62439c
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsWorkplaceJoin
call fcn.005537f0
movsd xmm0, qword [ebx]
comisd xmm0, xmmword [0x6edab8]
jb 0x541125
push 0
push 0
push str.NC_PersonalFirewallConfig
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsNetwork_Connections
call fcn.00553890
push 0
push 0
push str.authenticodeenabled
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
call fcn.00553890
push 0
push 3
push str.ScanWithAntiVirus
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesAttachments
call fcn.00553890
push 0
push 1
push str.PromptOnSecureDesktop
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00553890
push 0
push 5
push str.ConsentPromptBehaviorAdmin
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00553890
push 0
push 1
push str.EnableLUA
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00553890
push 0
push 0
push str.scforceoption
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00553890
push 0
push 0
push str.scforceoption
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.00553890
push 0
push 1
push str.fEnableUsbBlockDeviceBySetupClass
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTTerminal_ServicesClient
call fcn.00553890
push 0
push 0x50
push str.fEnableUsbNoAckIsochWriteToDevice
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTTerminal_ServicesClient
call fcn.00553890
push 0
push 1
push str.fEnableUsbSelectDeviceByInterface
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTTerminal_ServicesClient
call fcn.00553890
push 0
push 0x3020
push str.AuthenticationCapabilities
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSvchostGPSvcGroup
call fcn.00553890
push 0
push 1
push str.CoInitializeSecurityParam
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSvchostGPSvcGroup
call fcn.00553890
push 1
push 0
push 0x62439c
push 0x62439c
push str.HKLMSOFTWAREPoliciesMicrosoftWindowsNetworkConnectivityStatusIndicator
call fcn.005537f0
push 1
push 0
push str.3376f4ce_ff8d_40a2_a80f_bb4359d1415c
push str.1000
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTTerminal_ServicesClientUsbBlockDeviceBySetupClasses
call fcn.005537f0
push 1
push 0
push str.6bdd1fc6_810f_11d0_bec7_08002be2092f
push str.1000
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTTerminal_ServicesClientUsbSelectDeviceByInterfaces
call fcn.005537f0
push 1
push 0
push str.nlhtml.dll
push str.KnownDllList
push str.HKLMSOFTWAREPoliciesMicrosoftWindows_NTWindows_File_Protection
call fcn.005537f0
push 7
push 1
push str.GPSvc
push str.GPSvcGroup
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
call fcn.005537f0
push 1
push 0
push str.Explorer.exe
push 0x6417fc
push str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.005537f0
movzx eax, al
add edi, eax
cmp byte [ebx + 0x48], 0
mov dword [ebp - 0x34], edi
je 0x541163
push 1
push 0
push str.Explorer.exe
push 0x6417fc
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.005537f0
mov edi, dword [sym.imp.USERENV.dll_RefreshPolicyEx]
push 1
push 1
call edi
push 1
push 0
call edi
test esi, esi
je 0x541185
push esi
push 1
push 6
mov ecx, ebx
call fcn.0055c520
mov edi, dword [ebp - 0x34]
mov ecx, str.Failed_to_reset_the_local_Group_Policy.
push 0
push 0
test edi, edi
mov eax, str.Successfully_reset_the_local_Group_Policy.
push 0
cmove eax, ecx
mov ecx, ebx
push eax
call fcn.0057b7e0
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
test esi, esi
je 0x5411c1
push ecx
mov ecx, esi
call fcn.00402a20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4