Function at 0x406350
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x24]
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
mov word [esp + 0x48], 0x94
push eax
push 0xffffffffffffffff
push ebx
mov word [esp + 0x56], bx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
push str.User32.DLL
mov dword [esp + 0x50], 0x1c0000
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x18], esi
je 0x406578
push str.EnumDisplayDevicesA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
cmp edx, ebx
mov dword [esp + 0x20], edx
jne 0x4063ce
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x254
ret
mov ecx, 0x2a
xor eax, eax
lea edi, [esp + 0xb8]
push ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xbc]
mov dword [esp + 0xbc], 0xa8
push ecx
push ebx
push ebx
mov byte [esp + 0x34], bl
xor edi, edi
call edx
mov ebp, eax
cmp ebp, ebx
je 0x406458
mov esi, dword [str.Mirage_Driver]
lea ecx, [esp + 0xdc]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x406433
cmp dl, bl
je 0x40642f
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x406433
add ecx, 2
add esi, 2
cmp dl, bl
jne 0x40640f
xor ecx, ecx
jmp 0x406438
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
je 0x406454
lea ecx, [esp + 0xb8]
inc edi
push ebx
push ecx
push edi
push ebx
call dword [esp + 0x30]
mov ebp, eax
cmp ebp, ebx
jne 0x406402
jmp 0x406458
cmp ebp, ebx
jne 0x40647f
mov edx, dword [str.Mirage_Driver]
push edx
push str.D:_vncwinvncVideoDriver.cpp:_tNo__s_found._n
push ebx
push 0x44b018
call fcn.004024a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
lea eax, [esp + 0xdc]
lea ecx, [esp + 0xbc]
push eax
push ecx
push edi
push str.D:_vncwinvncVideoDriver.cpp:_tDevNum:_d_nName:_s_nString:_s_n_n
push 9
push 0x44b018
call fcn.004024a0
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xa8]
push edx
push eax
push ecx
push str.D:_vncwinvncVideoDriver.cpp:_tSreen_Settings_i__i__i_n
push 9
push 0x44b018
call fcn.004024a0
mov edi, str.DEVICE0
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x160]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x14], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x14]
push ecx
push str.SYSTEMCurrentControlSetHardware_ProfilesCurrentSystemCurrentControlSetServicesdfmirage
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
je 0x40651c
push str.D:_vncwinvncVideoDriver.cpp:_tCant_access_registry._n
jmp 0x40656a
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x160]
push edx
push eax
push ecx
mov dword [esp + 0x1c], ebx
call esi
test eax, eax
je 0x40653f
push str.D:_vncwinvncVideoDriver.cpp:_tCant_access_DEVICE_hardware_profiles_key._n
jmp 0x40656a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push 4
push edx
push 4
push ebx
push str.Attach.ToDesktop
push eax
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x406585
push str.D:_vncwinvncVideoDriver.cpp:_tCant_set_Attach.ToDesktop_to_0x1_n
push ebx
push 0x44b018
call fcn.004024a0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x254
ret
mov edi, str.dfmirage
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov ebp, dword [sym.imp.USER32.dll_SetThreadDesktop]
mov esi, eax
cmp esi, ebx
je 0x4065dc
push 0x2000000
push ebx
push ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov edi, eax
cmp edi, ebx
je 0x4065e0
push edi
call ebp
jmp 0x4065e0
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x8c], 0x18
jne 0x4065f5
mov dword [esp + 0x8c], 0x10
push ebx
push 1
lea ecx, [esp + 0x2c]
push ebx
lea edx, [esp + 0xc8]
push ecx
push edx
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExA]
push esi
call ebp
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x254
ret