Function at 0x471cf0
Capabilities:
Disable system features via registry on windows
Hide shutdown actions via policy
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x5f6ea4]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 8]
push edi
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 1
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x471d61
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
jne 0x471da9
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x471df1
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.shutdownwithoutlogon
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
jne 0x471e39
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.NoClose
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
jne 0x471e81
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.StartMenuLogOff
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call ebx
push 0
push 1
mov dl, 1
mov ecx, str.logoff.exe
call fcn.00475aa0
push 0
push 1
mov dl, 1
mov ecx, str.shutdown.exe
call fcn.00475aa0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__H_off
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.004760a0
add esp, 0x40
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
push 0x2710
push 0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETACVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_7648efa3_dd9c_4e3e_b566_50f929386280_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_96996bc0_ad50_47ec_923b_6f41874dd9eb_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__SETDCVALUEINDEX_e9a42b02_d5df_448d_aa00_03f14749eb61_4f971e89_eebd_4455_a8de_9e59040e7347_5ca83367_6e45_459f_a27b_476b1d01c936_0
call fcn.004760a0
push 0x2710
push 0
xor edx, edx
mov ecx, str.powercfg.exe__S_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c
call fcn.004760a0
add esp, 0x40
xor edx, edx
mov ecx, str.powercfg.exe__S_e9a42b02_d5df_448d_aa00_03f14749eb61
push 0x2710
push 0
call fcn.004760a0
mov ecx, dword [esp + 0x1c]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret