Function at 0x406650
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x24]
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov word [esp + 0x48], 0x94
push eax
push 0xffffffffffffffff
push ebx
mov word [esp + 0x56], bx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.EnumDisplayDevicesA
push str.USER32
mov dword [esp + 0x54], 0x1c0000
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.User32.DLL
call esi
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x1c], esi
je 0x406922
push str.EnumDisplayDevicesA
push esi
call edi
mov ebp, eax
cmp ebp, ebx
jne 0x4066db
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov ecx, 0x2a
xor eax, eax
lea edi, [esp + 0xb8]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xbc]
mov dword [esp + 0xbc], 0xa8
push ecx
push ebx
push ebx
mov byte [esp + 0x34], bl
mov dword [esp + 0x28], ebx
call ebp
mov edi, eax
cmp edi, ebx
je 0x40676d
mov esi, dword [str.Mirage_Driver]
lea ecx, [esp + 0xdc]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x406742
cmp dl, bl
je 0x40673e
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x406742
add ecx, 2
add esi, 2
cmp dl, bl
jne 0x40671e
xor ecx, ecx
jmp 0x406747
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
je 0x406769
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xb8]
inc eax
push ebx
push ecx
push eax
push ebx
mov dword [esp + 0x28], eax
call ebp
mov edi, eax
cmp edi, ebx
jne 0x406711
jmp 0x40676d
cmp edi, ebx
jne 0x406792
mov edx, dword [str.Mirage_Driver]
push edx
push str.D:_vncwinvncVideoDriver.cpp:_tNo__s_found._n
push ebx
push 0x44b018
call fcn.004024a0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov edi, str.DEVICE0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x160]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x14]
push ecx
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetServicesdfmirage
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
je 0x4067f8
push str.D:_vncwinvncVideoDriver.cpp:_tCant_access_registry._n
push ebx
push 0x44b018
call fcn.004024a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x160]
push edx
push eax
push ecx
mov dword [esp + 0x1c], ebx
call esi
test eax, eax
je 0x406832
push str.D:_vncwinvncVideoDriver.cpp:_tCant_access_DEVICE_hardware_profiles_key._n
push ebx
push 0x44b018
call fcn.004024a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push 4
push edx
push 4
push ebx
push str.Attach.ToDesktop
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x406872
push str.D:_vncwinvncVideoDriver.cpp:_tCant_set_Attach.ToDesktop_to_0x1_n
push ebx
push 0x44b018
call fcn.004024a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov edi, str.dfmirage
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov ebp, dword [sym.imp.USER32.dll_SetThreadDesktop]
mov esi, eax
cmp esi, ebx
je 0x4068c9
push 0x2000000
push ebx
push ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov edi, eax
cmp edi, ebx
je 0x4068cd
push edi
call ebp
jmp 0x4068cd
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x8c], 0x18
jne 0x4068e2
mov dword [esp + 0x8c], 0x10
push ebx
push 1
lea ecx, [esp + 0x2c]
push ebx
lea edx, [esp + 0xc8]
push ecx
push edx
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExA]
push esi
call ebp
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret