Function at 0x402340
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x36c
mov eax, dword [0x4310e0]
push ebx
push esi
push edi
push str.USER32
mov dword [esp + 0x378], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.EnumDisplayDevicesA
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov word [esp + 0x50], 0x9c
mov word [esp + 0x52], bx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
cmp eax, ebx
mov dword [esp + 0x48], 0x1c0000
je 0x402684
xor eax, eax
mov ecx, 0x6a
lea edi, [esp + 0xc0]
rep stosd dword es:[edi], eax
push ebx
lea ecx, [esp + 0xc4]
push ecx
push ebx
push ebx
mov dword [esp + 0xd0], 0x1a8
mov byte [esp + 0x30], al
call dword [esp + 0x20]
mov edi, eax
cmp edi, ebx
je 0x40244f
lea esp, [esp]
mov esi, dword [str.mv_video_hook_driver2]
lea ecx, [esp + 0xe4]
lea ecx, [ecx]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x402424
test dl, dl
je 0x402420
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x402424
add ecx, 2
add esi, 2
test dl, dl
jne 0x402400
xor ecx, ecx
jmp 0x402429
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x402447
push 0
lea ecx, [esp + 0xc4]
push ecx
inc ebx
push ebx
push 0
call dword [esp + 0x20]
mov edi, eax
test edi, edi
jne 0x4023f0
jmp 0x40244b
test edi, edi
jne 0x402468
mov esi, dword [esp + 0x14]
mov edx, dword [str.mv_video_hook_driver2]
push edx
push str.No__s_found._n
call fcn.0040cf8a
add esp, 8
jmp 0x402684
lea eax, [esp + 0x1e8]
push eax
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0xd0]
push eax
push ebx
push str.DevNum:_d_nName:_s_nString:_s_nID:_s_nKey:_s_n_n
call fcn.0040cf8a
lea ecx, [esp + 0x200]
push ecx
call fcn.0040ce76
lea edx, [esp + 0x204]
push str.DEVICE
push edx
call fcn.0040cdf0
xor esi, esi
add esp, 0x24
cmp eax, esi
jne 0x4024cf
push str.DEVICE0
push 0x104
lea eax, [esp + 0x270]
push eax
jmp 0x4024de
inc eax
push eax
push 0x104
lea ecx, [esp + 0x270]
push ecx
call fcn.00401cd0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [esp + 0x18]
push edx
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetServicesmv2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], esi
call edi
test eax, eax
jne 0x402540
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x26c]
push ecx
push edx
mov dword [esp + 0x1c], esi
call edi
test eax, eax
jne 0x402540
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push 4
push esi
push str.Attach.ToDesktop
push ecx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402552
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40268f
push eax
jmp 0x402689
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x1e8]
push str.SYSTEM
push ecx
call fcn.0040cdf0
add esp, 8
lea edx, [esp + 0x10]
push edx
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrent
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, eax
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4025d1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
call edi
test eax, eax
jne 0x4025d1
push 4
lea edx, [esp + 0x20]
push edx
push 4
push eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
push str.Attach.ToDesktop
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4025e3
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40268f
push eax
jmp 0x402689
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
push 0x426918
push 0x20
lea eax, [esp + 0x28]
push eax
call fcn.00401cd0
mov dword [esp + 0x88], 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, eax
test esi, esi
je 0x40263e
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov edi, eax
test edi, edi
je 0x402642
push edi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
jmp 0x402642
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_ChangeDisplaySettingsExA]
push 0
push 1
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xd4]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0xd4]
push ecx
call ebx
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40268f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x374]
call fcn.0040cdbe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret