Function at 0x10009a70
Capabilities:
Persist via print processors registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0
test byte [0x100131d8], 8
jne 0x10009b78
test ebx, ebx
je 0x10009b58
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10009b58
test esi, esi
je 0x10009ab4
cmp word [esi], 0
jne 0x10009c60
mov eax, dword [ebp + 0xc]
call sym._validate_envW
mov esi, eax
test eax, eax
je 0x10009b48
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [ebp - 0x14], eax
call eax
lea eax, [eax + eax + 0x92]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x10009b48
mov eax, dword [esi]
mov dword [esp + 4], str.SystemCurrentControlSetControlPrintEnvironments_sPrint_Processors_
mov dword [esp], edi
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
lea eax, [ebp - 0x10]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
test esi, esi
je 0x10009bf8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], esi
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn
mov edx, 0xffffffff
mov dword [ebp - 0x18], eax
mov eax, ebx
call sym._wine_dbgstr_wn
mov edx, 0xffffffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn
mov edx, 0xffffffff
mov edi, eax
mov eax, esi
call sym._wine_dbgstr_wn
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [esp + 0xc], str.__s___s___s___s__n
mov dword [esp + 0x18], ecx
mov dword [esp + 8], str.fpAddPrintProcessor
mov dword [esp + 4], 0x100131d8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x10009a93
mov dword [esp], ebx
mov eax, dword [ebp - 0x14]
call eax
mov dword [esp + 0x10], ebx
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], str.Driver
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetKeyValueW]
mov esi, eax
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
jne 0x10009b3f
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test byte [0x100131d8], 1
jne 0x10009c88
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7b
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn
mov dword [esp + 0xc], str.server__s_not_supported_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.fpAddPrintProcessor
mov dword [esp + 4], 0x100131d8
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x10009c69