Function at 0x402fa0
Capabilities:
Persist via screensaver registry key
Set registry value

Disassembly:
mov eax, 0x2420
call fcn.00462300
push ebx
push ebp
push esi
mov ebp, ecx
lea eax, [esp + 0x120]
push edi
mov edi, dword [esp + 0x2434]
lea ecx, [esp + 0x32c]
push eax
push ecx
push edi
mov ecx, ebp
mov dword [esp + 0x28], ebp
call fcn.00402ce0
lea esi, [esp + 0x124]
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403004
test cl, cl
je 0x403000
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403004
add eax, 2
add esi, 2
test cl, cl
jne 0x402fdc
xor eax, eax
jmp 0x403009
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40331f
push 0x475540
push edi
call fcn.00462171
mov edi, eax
add esp, 8
test edi, edi
jne 0x403035
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2420
ret 4
lea eax, [esp + 0x124]
push 0x47553c
push eax
call fcn.00462171
add esp, 8
mov ebx, eax
test ebx, ebx
push edi
jne 0x403069
call fcn.00461f17
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2420
ret 4
push 0x2000
lea ecx, [esp + 0x438]
push 1
push ecx
call fcn.0046148b
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x4030c0
push ebx
push esi
lea edx, [esp + 0x438]
push 1
push edx
call fcn.00461573
add esp, 0x10
cmp eax, esi
push edi
jne 0x40312e
push 0x2000
lea eax, [esp + 0x438]
push 1
push eax
call fcn.0046148b
mov esi, eax
add esp, 0x10
test esi, esi
ja 0x403086
push edi
call fcn.00461f17
push ebx
call fcn.00461f17
mov al, byte [0x4750a1]
add esp, 8
test al, al
je 0x40331f
lea ecx, [esp + 0x32c]
push 0x4751fc
push ecx
lea edx, [esp + 0x28]
push str._s_s.scr
push edx
call fcn.0046120f
add esp, 0x10
lea esi, [esp + 0x20]
lea eax, [esp + 0x124]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40314c
test cl, cl
je 0x40312a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40314c
add eax, 2
add esi, 2
test cl, cl
jne 0x403106
xor eax, eax
jmp 0x403151
call fcn.00461f17
push ebx
call fcn.00461f17
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2420
ret 4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403169
lea eax, [esp + 0x20]
lea ecx, [esp + 0x124]
push eax
push ecx
mov ecx, ebp
call fcn.00403330
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor edi, edi
mov dword [esp + 0x18], edi
test edi, edi
jne 0x403191
lea edx, [esp + 0x10]
push edx
push str.Control_PanelDesktop
jmp 0x40319b
lea eax, [esp + 0x10]
push eax
push str.SoftwarePoliciesMicrosoftWindowsControl_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403283
lea ecx, [esp + 0x228]
push 0x104
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x4031d4
call ebx
test eax, eax
jne 0x40323b
test edi, edi
jne 0x4031f5
lea eax, [esp + 0x228]
push str.System.ini
push eax
push str.SCRNSAVE.EXE
push str.boot
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edi, [esp + 0x228]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x22c]
push ecx
push 1
push eax
push str.SCRNSAVE.EXE
push edx
call esi
test eax, eax
jne 0x40323b
push 2
push 0x4754b4
push 1
push eax
mov eax, dword [esp + 0x20]
push str.ScreenSaveActive
push eax
call esi
test eax, eax
je 0x403274
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x400
call ebx
push eax
push 0
push 0x1300
call ebp
mov edx, dword [esp + 0x14]
push 0x40
push str.Error
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x18]
inc edi
cmp edi, 2
mov dword [esp + 0x18], edi
jl 0x403181
lea edx, [esp + 0x32c]
push 0x4751fc
push edx
lea eax, [esp + 0x28]
push str._s_s.exe
push eax
call fcn.0046120f
add esp, 0x10
lea esi, [esp + 0x20]
lea eax, [esp + 0x124]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4032e3
test cl, cl
je 0x4032df
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4032e3
add eax, 2
add esi, 2
test cl, cl
jne 0x4032bb
xor eax, eax
jmp 0x4032e8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403318
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x124]
push eax
push ecx
mov ecx, esi
call fcn.00403330
lea edx, [esp + 0x32c]
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, esi
call fcn.00402e60
mov byte [0x4750a1], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2420
ret 4