SSCTL_SSR_EVENT_BEFORE_SHUTDOWN
.ssr_event = SSCTL_SSR_EVENT_BEFORE_SHUTDOWN
sysmon->state = SSCTL_SSR_EVENT_BEFORE_SHUTDOWN;
[SSCTL_SSR_EVENT_BEFORE_SHUTDOWN] = "before_shutdown",