Function at 0x4bbe84
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x37
push 0
push 0
dec ecx
jne 0x4bbe8c
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bc55e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x9d], 0
lea eax, [ebp - 0x9c]
xor ecx, ecx
mov edx, 0x9c
call fcn.00403284
mov word [ebp - 0x78], 0x9c
mov word [ebp - 0x76], 0
lea eax, [ebp - 0x9c]
push eax
push 0xffffffffffffffff
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov eax, dword [edi]
mov dword [ebp - 0x74], eax
cmp byte [esi + 0x5c], 0
je 0x4bbf3f
lea edx, [ebp - 0x178]
mov eax, dword [0x562a1c]
mov eax, dword [eax]
call fcn.00480578
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x70], eax
lea edx, [ebp - 0x178]
mov eax, dword [0x562a1c]
mov eax, dword [eax]
call fcn.00480578
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x562a1c]
mov eax, dword [eax]
call fcn.0047f61c
mov dword [ebp - 0x30], eax
mov eax, dword [0x562a1c]
mov eax, dword [eax]
call fcn.0047f610
mov dword [ebp - 0x2c], eax
jmp 0x4bbf67
xor eax, eax
mov dword [ebp - 0x70], eax
xor eax, eax
mov dword [ebp - 0x6c], eax
mov eax, dword [0x562a1c]
mov eax, dword [eax]
call fcn.0047f5ec
mov dword [ebp - 0x30], eax
mov eax, dword [0x562a1c]
mov eax, dword [eax]
call fcn.0047f5e0
mov dword [ebp - 0x2c], eax
cmp dword [edi + 0x10], 0
jne 0x4bbf7d
cmp dword [edi + 0x14], 0
jne 0x4bbf7d
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x9c], 0
lea eax, [ebp - 0x168]
xor ecx, ecx
mov edx, 0xa8
call fcn.00403284
mov dword [ebp - 0x168], 0xa8
xor eax, eax
mov dword [ebp - 0xb0], eax
mov edx, 0x4bc57c
mov eax, esi
call fcn.004bd124
push 0
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0xb0]
push eax
push 0
call sub.user32.dll_EnumDisplayDevicesA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4bc043
lea edx, [ebp - 0x180]
lea eax, [ebp - 0x144]
call fcn.0040a5a4
mov ecx, dword [ebp - 0x180]
lea eax, [ebp - 0x17c]
mov edx, 0x4bc598
call fcn.00404a1c
mov edx, dword [ebp - 0x17c]
mov eax, esi
call fcn.004bd124
mov eax, dword [edi + 8]
call fcn.00404bd0
mov edx, eax
lea eax, [ebp - 0x144]
call fcn.0040a488
test eax, eax
je 0x4bc047
inc dword [ebp - 0xb0]
push 0
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0xb0]
push eax
push 0
call sub.user32.dll_EnumDisplayDevicesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4bbfd3
cmp byte [edi + 0x19], 0
je 0x4bc058
mov byte [ebp - 0x9d], bl
jmp 0x4bc515
cmp byte [edi + 0x1a], 0
je 0x4bc071
test byte [ebp - 0xc4], 1
setne byte [ebp - 0x9d]
jmp 0x4bc515
cmp byte [edi + 0x1b], 0
je 0x4bc09d
test bl, bl
je 0x4bc092
push 0
push 0
push 0
lea eax, [esi + 0x68]
call fcn.00404c28
push eax
call sub.gdi32.dll_CreateDCA
mov dword [edi + 0x1c], eax
mov byte [ebp - 0x9d], bl
jmp 0x4bc515
test bl, bl
jne 0x4bc0dc
lea eax, [ebp - 0x184]
push eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x18c], eax
mov byte [ebp - 0x188], 0xb
lea edx, [ebp - 0x18c]
xor ecx, ecx
mov eax, 0x4bc5b8
call fcn.0040aabc
mov edx, dword [ebp - 0x184]
mov eax, esi
call fcn.004bd124
jmp 0x4bc515
mov al, byte [ebp - 0x34]
mov byte [esi + 0x31], al
mov eax, dword [ebp - 0x34]
shr eax, 3
mov byte [esi + 0x32], al
and eax, 0xff
imul dword [ebp - 0x30]
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x190]
push eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 0x1a4], 0
lea eax, [ebp - 0x164]
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 6
lea eax, [ebp - 0x144]
mov dword [ebp - 0x198], eax
mov byte [ebp - 0x194], 6
lea edx, [ebp - 0x1a8]
mov ecx, 2
mov eax, 0x4bc5dc
call fcn.0040aabc
mov edx, dword [ebp - 0x190]
mov eax, esi
call fcn.004bd124
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x198], eax
mov byte [ebp - 0x194], 0
lea edx, [ebp - 0x1a8]
mov ecx, 2
mov eax, 0x4bc61c
call fcn.0040aabc
mov edx, dword [ebp - 0x1ac]
mov eax, esi
call fcn.004bd124
lea eax, [ebp - 0x1b0]
push eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x18c], eax
mov byte [ebp - 0x188], 0
lea edx, [ebp - 0x18c]
xor ecx, ecx
mov eax, 0x4bc640
call fcn.0040aabc
mov edx, dword [ebp - 0x1b0]
mov eax, esi
call fcn.004bd124
lea eax, [ebp - 0xb4]
mov edx, 0x4bc65c
call fcn.00404798
push 0x4bc66c
push dword [edi + 4]
push 0x4bc6cc
push dword [ebp - 0xb4]
lea eax, [ebp - 0xb8]
mov edx, 4
call fcn.00404a90
lea eax, [ebp - 0x1b4]
push eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x18c], eax
mov byte [ebp - 0x188], 0xb
lea edx, [ebp - 0x18c]
xor ecx, ecx
mov eax, 0x4bc6d8
call fcn.0040aabc
mov edx, dword [ebp - 0x1b4]
mov eax, esi
call fcn.004bd124
lea eax, [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xb8]
call fcn.00404bd0
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
je 0x4bc2b2
lea eax, [ebp - 0x1b8]
push eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x18c], eax
mov byte [ebp - 0x188], 0xb
lea edx, [ebp - 0x18c]
xor ecx, ecx
mov eax, 0x4bc6f8
call fcn.0040aabc
mov edx, dword [ebp - 0x1b8]
mov eax, esi
call fcn.004bd124
jmp 0x4bc515
xor eax, eax
push ebp
push 0x4bc507
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi + 0x10], 1
jne 0x4bc34e
mov dword [ebp - 0xc0], 3
push 4
lea eax, [ebp - 0xc0]
push eax
push 4
push 0
push 0x4bc714
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4bc30c
mov edx, 0x4bc730
mov eax, esi
call fcn.004bd124
call fcn.0040411c
jmp 0x4bc515
mov dword [ebp - 0xc0], 1
push 4
lea eax, [ebp - 0xc0]
push eax
push 4
push 0
push 0x4bc744
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4bc370
mov edx, 0x4bc730
mov eax, esi
call fcn.004bd124
call fcn.0040411c
jmp 0x4bc515
push 0x4bc714
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x4bc744
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 4
lea eax, [edi + 0x10]
push eax
push 4
push 0
push 0x4bc760
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4bc3a5
mov edx, 0x4bc730
mov eax, esi
call fcn.004bd124
call fcn.0040411c
jmp 0x4bc515
mov edx, dword [edi + 4]
lea eax, [ebp - 0x9c]
call fcn.0040a434
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4bc3d7
call fcn.0040411c
jmp 0x4bc515
push 0x400001cf
push 0
push 1
call sub.user32.dll_OpenInputDesktop
mov ebx, eax
test ebx, ebx
jne 0x4bc3f5
call fcn.0040411c
jmp 0x4bc515
push ebx
call sub.user32.dll_SetThreadDesktop
cmp byte [edi + 0x18], 0
je 0x4bc422
push 0
push 1
push 0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x164]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
mov dword [ebp - 0xa8], eax
jmp 0x4bc43e
xor eax, eax
mov dword [ebp - 0xac], eax
push 0
mov eax, dword [ebp - 0xac]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x1bc]
push eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x18c], eax
mov byte [ebp - 0x188], 0
lea edx, [ebp - 0x18c]
xor ecx, ecx
mov eax, 0x4bc77c
call fcn.0040aabc
mov edx, dword [ebp - 0x1bc]
mov eax, esi
call fcn.004bd124
cmp byte [edi + 0xc], 0
je 0x4bc496
push 0
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x164]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
lea eax, [esi + 0x68]
lea edx, [ebp - 0x164]
mov ecx, 0x20
call fcn.00404980
mov eax, dword [ebp - 0xa4]
push eax
call sub.user32.dll_SetThreadDesktop
push ebx
call sub.user32.dll_CloseDesktop
push 4
lea eax, [edi + 0x14]
push eax
push 4
push 0
push 0x4bc760
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4bc4ed
mov edx, 0x4bc730
mov eax, esi
call fcn.004bd124
call fcn.0040411c
jmp 0x4bc515
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc50e
mov eax, dword [ebp - 0xbc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc565
lea eax, [ebp - 0x1bc]
mov edx, 5
call fcn.00404724
lea eax, [ebp - 0x190]
call fcn.00404700
lea eax, [ebp - 0x184]
mov edx, 3
call fcn.00404724
lea eax, [ebp - 0xb8]
mov edx, 2
call fcn.00404724
ret