Function at 0x4071f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x368
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_Activate_video_driver____n
push ebx
push 0x46f3bc
mov dword [ecx + 0x20], 1
call fcn.00405970
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x3c]
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
mov word [esp + 0x54], 0x9c
push eax
push 0xffffffffffffffff
push ebx
mov word [esp + 0x62], bx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
push str.USER32
mov dword [esp + 0x5c], 0x3c0020
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.EnumDisplayDevicesA
push esi
mov dword [esp + 0x24], esi
call edi
push str.ChangeDisplaySettingsExA
push esi
mov ebp, eax
call edi
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x407285
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x368
ret 0x14
cmp ebp, ebx
je 0x4075a3
mov ecx, 0x6a
xor eax, eax
lea edi, [esp + 0xcc]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xd0]
mov dword [esp + 0xd0], 0x1a8
push ecx
push ebx
push ebx
mov byte [esp + 0x40], al
call ebp
cmp eax, ebx
je 0x4072ec
mov edi, str.Winvnc_video_hook_driver
lea esi, [esp + 0xf0]
mov ecx, 0x19
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4072e8
lea eax, [esp + 0xcc]
inc ebx
push edx
push eax
push ebx
push edx
call ebp
test eax, eax
jne 0x4072bd
jmp 0x4072ec
test eax, eax
jne 0x407314
push str.Winvnc_video_hook_driver
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_No__s_found._n
push 0
push 0x46f3bc
call fcn.00405970
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret 0x14
xor esi, esi
xor eax, eax
mov cl, byte [eax + str.DEVICE0]
mov byte [esp + eax + 0x274], cl
inc eax
test cl, cl
jne 0x407318
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x14]
push ecx
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetServices_vncdrv
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x20], esi
call edi
test eax, eax
je 0x40736b
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_ERROR:_Can_not_acces_SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetServices_vncdrv
push esi
push 0x46f3bc
call fcn.00405970
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret 0x14
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x274]
push edx
push eax
push ecx
mov dword [esp + 0x1c], esi
call edi
test eax, eax
je 0x4073bc
lea edx, [esp + 0x274]
push edx
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_ERROR:_Can_not_acces__s
push esi
push 0x46f3bc
call fcn.00405970
mov eax, dword [esp + 0x24]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x368
ret 0x14
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x24]
push 4
push ecx
push 4
push esi
push str.Attach.ToDesktop
push edx
mov dword [esp + 0x3c], 1
call ebp
test eax, eax
je 0x40741a
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_ERROR:_Can_not_acces_Attach.ToDesktop
push esi
push 0x46f3bc
call fcn.00405970
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x368
ret 0x14
xor eax, eax
mov cl, byte [eax + str.vncdrv]
mov byte [esp + eax + 0x30], cl
inc eax
test cl, cl
jne 0x40741c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov ebx, dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edi, eax
cmp edi, esi
je 0x40746e
push 0x2000000
push esi
push esi
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
test esi, esi
je 0x40745c
push esi
call ebx
jmp 0x407472
push 0x1f4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x407472
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x58], 0x3c0020
cmp eax, 8
je 0x4074ab
cmp eax, 0x10
je 0x4074ab
cmp eax, 0x20
je 0x4074ab
push edi
call ebx
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
jmp 0x40753a
mov eax, dword [esp + 0x38c]
mov edx, dword [esp + 0x388]
mov ecx, dword [esp + 0x380]
mov dword [esp + 0xa0], eax
mov dword [esp + 0x9c], edx
mov edx, dword [esp + 0x384]
lea eax, [esp + 0x28]
mov dword [esp + 0x5c], ecx
push eax
mov dword [esp + 0x64], edx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 1
lea ecx, [esp + 0x38]
push 0
lea edx, [esp + 0xdc]
push ecx
push edx
call dword [esp + 0x2c]
push eax
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_ChangeDisplaySettingsEx_returned__i_n
push 0
push 0x46f3bc
call fcn.00405970
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
add esp, 0x10
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
push edi
call ebx
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov dword [esp + 0x20], 1
lea edx, [esp + 0x20]
mov eax, dword [esp + 0x10]
push 4
push edx
push 4
push 0
push str.Attach.ToDesktop
push eax
call ebp
test eax, eax
je 0x40758b
push str.S:UltraVNCwinvncwinvnc_videodriver.cpp_:_ERROR:_Can_not_acces_Attach.ToDesktop
push 0
push 0x46f3bc
call fcn.00405970
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x368
ret 0x14
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4075ae
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x368
ret 0x14