Function at 0x402060
Capabilities:
Accept command line arguments
Check os version
Create thread
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x514
dec eax
push ebx
mov ebx, dword [esp + 0x51c]
push edi
jne 0x4022be
push str.Bluescreen_Screen_Saver
call fcn.00402950
add esp, 4
test eax, eax
jne 0x4020a5
push eax
push eax
mov eax, ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop ebx
add esp, 0x514
ret 0x10
lea ecx, [esp + 8]
push ecx
push str.SoftwareSysInternalsBlueScreen
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
mov eax, dword [esp + 8]
push edx
push 0x42bab4
push 0
push 0
push str.DoDiskWrites
push eax
mov dword [esp + 0x2c], 4
call edi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040672c
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax]
test cl, cl
je 0x40211c
mov dl, 0x70
cmp cl, 0x2f
jne 0x402114
cmp byte [eax + 1], dl
je 0x402144
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40210a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
and eax, 0xff
mov dword [0x42ba80], eax
call esi
cmp eax, 0x80000000
jb 0x40216e
mov dword [0x42ba80], 5
jmp 0x40217b
mov edx, dword [esp + 0x52c]
mov eax, dword [esp + 0x528]
mov ecx, dword [esp + 0x520]
push edx
push eax
push 1
push ecx
call fcn.00405f6f
pop edi
pop ebx
add esp, 0x514
ret 0x10
cmp dword [0x42ba80], 5
jb 0x402205
lea edx, [esp + 0x10]
push edx
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x20]
push str.ServerNt
push eax
call fcn.0040678f
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.ProductType
push ecx
mov dword [esp + 0x2c], 0x100
call edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x20]
push str.servernt
push eax
call fcn.0040bb70
add esp, 8
test eax, eax
je 0x4021fe
lea ecx, [esp + 0x20]
push str.lamnannt
push ecx
call fcn.0040bb70
add esp, 8
test eax, eax
jne 0x402205
mov byte [0x42bab8], 1
call fcn.00401e60
mov eax, dword [0x42bab4]
test eax, eax
je 0x402279
lea edx, [esp + 0x120]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.bluescrn.tmp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x20000100
push 2
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x134]
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x42ba84], eax
push 0
push 0
push 0x401fa0
call fcn.004068b5
mov eax, dword [0x42ba80]
add esp, 0xc
cmp eax, 4
pop esi
push ebx
jbe 0x40229d
call fcn.00403980
jmp 0x4022a2
call fcn.004057d0
add esp, 4
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x52c]
mov edx, dword [esp + 0x528]
mov eax, dword [esp + 0x524]
push ecx
push edx
push eax
push ebx
call fcn.00405f6f
pop edi
pop ebx
add esp, 0x514
ret 0x10