Function at 0x4717e0
Capabilities:
Disable system features via registry on windows
Hide shutdown actions via policy
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x5f6ea4]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 8]
push edi
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 1
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x471851
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
jne 0x471899
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4718e1
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.shutdownwithoutlogon
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
jne 0x471929
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.NoClose
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
jne 0x471971
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.StartMenuLogOff
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
push 1
mov dl, 1
mov ecx, str.logoff.exe
call fcn.00475590
push 0
push 1
mov dl, 1
mov ecx, str.shutdown.exe
call fcn.00475590
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__H_off
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.00475b90
add esp, 0x40
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
push 0x2710
push 0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
call fcn.00475b90
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__S_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c
call fcn.00475b90
add esp, 0x40
xor edx, edx
mov ecx, str.powercfg.exe__S_e9a42b02_d5df_448d_aa00_03f14749eb61
push 0x2710
push 0
call fcn.00475b90
mov ecx, dword [esp + 0x1c]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00536b66
mov esp, ebp
pop ebp
ret