Function at 0x65143920
Capabilities:
Delete registry key
Persist via print monitors registry key
Query or enumerate registry value
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov esi, dword [ecx + 8]
test byte [0x65157028], 8
jne 0x65143a58
test ebx, ebx
je 0x65143961
cmp word [ebx], 0x5c
je 0x651439a0
mov ebx, dword [esi]
test ebx, ebx
je 0x65143c48
cmp word [ebx], 0
jne 0x651439e0
test byte [0x65157028], 4
jne 0x65143bc0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor ebx, ebx
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
cmp word [ebx + 2], 0x5c
jne 0x65143961
xor edx, edx
mov eax, ebx
call sym._copy_servername_from_name.part.0
test eax, eax
je 0x65143961
test byte [0x65157028], 1
jne 0x65143d10
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 5
lea esp, [ebp - 0x10]
xor ebx, ebx
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, dword [esi + 4]
call sym._validate_envW
test eax, eax
je 0x65143d00
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x65143f08
cmp word [ebx], 0
jne 0x65143c60
test byte [0x65157028], 4
je 0x6514397e
mov eax, ebx
shr eax, 0x10
je 0x65143f90
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65143f20
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
jmp 0x65143f20
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x65143de0
mov eax, ecx
shr eax, 0x10
je 0x65143c28
mov dword [esp + 4], 0xffffffff
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x34], str._invalid_
sub esp, 8
test eax, eax
jne 0x65143aa2
mov ecx, dword [ebp - 0x2c]
mov edx, 0xffffffff
mov eax, ecx
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x34], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x65143dd0
mov eax, ecx
shr eax, 0x10
je 0x65143db0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x30], str._invalid_
sub esp, 8
test eax, eax
jne 0x65143aec
mov ecx, dword [ebp - 0x2c]
mov edx, 0xffffffff
mov eax, ecx
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x30], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x65143e00
mov eax, ecx
shr eax, 0x10
je 0x65143d90
mov dword [esp + 4], 0xffffffff
mov dword [esp], ecx
mov dword [ebp - 0x38], ecx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x2c], str._invalid_
sub esp, 8
test eax, eax
jne 0x65143b35
mov ecx, dword [ebp - 0x38]
mov edx, 0xffffffff
mov eax, ecx
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x65143df0
mov eax, ebx
shr eax, 0x10
je 0x65143d78
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65143b73
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0xc], str.__s___ld___p_:__s__s__s_n
mov dword [esp + 0x1c], edx
mov dword [esp + 8], str.fpAddMonitor
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65143957
mov eax, ebx
shr eax, 0x10
je 0x65143f50
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65143bf6
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.pName_not_valid_:__s_n
mov dword [esp + 8], str.fpAddMonitor
mov dword [esp + 4], 0x65157028
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x6514397e
movzx ecx, cx
mov dword [esp], str._04x
mov dword [esp + 4], ecx
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [ebp - 0x34], eax
jmp 0x65143aa2
test byte [0x65157028], 4
je 0x6514397e
mov eax, str._null_
jmp 0x65143bf6
lea eax, [ebp - 0x28]
mov dword [esp + 4], str.SystemCurrentControlSetControlPrintMonitors_
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x65143e10
test byte [0x65157028], 2
je 0x65143d00
mov eax, str.SystemCurrentControlSetControlPrintMonitors_
mov edi, eax
shr edi, 0x10
je 0x65144003
mov dword [esp + 4], 0xffffffff
mov dword [esp], str.SystemCurrentControlSetControlPrintMonitors_
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65143cd4
mov edx, 0xffffffff
mov eax, str.SystemCurrentControlSetControlPrintMonitors_
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unable_to_create_key__s_n
mov dword [esp + 8], str.fpAddMonitor
mov dword [esp + 4], 0x65157028
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_1
lea esi, [esi]
xor ebx, ebx
jmp 0x6514398d
mov eax, ebx
shr eax, 0x10
je 0x65143f70
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65143d46
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.server__s_not_supported_n
mov dword [esp + 8], str.fpAddMonitor
mov dword [esp + 4], 0x65157028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x651439c1
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65143b73
movzx ecx, cx
mov dword [esp], str._04x
mov dword [esp + 4], ecx
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [ebp - 0x2c], eax
jmp 0x65143b35
movzx ecx, cx
mov dword [esp], str._04x
mov dword [esp + 4], ecx
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [ebp - 0x30], eax
jmp 0x65143aec
mov dword [ebp - 0x30], str._null_
jmp 0x65143aec
mov dword [ebp - 0x34], str._null_
jmp 0x65143aa2
mov eax, str._null_
jmp 0x65143b73
mov dword [ebp - 0x2c], str._null_
jmp 0x65143b35
lea eax, [ebp - 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x20007
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 0x24
test eax, eax
jne 0x65143ef3
cmp dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
je 0x65143fa8
mov eax, dword [esi + 8]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 8]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Driver
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, dword [esi + 8]
sub esp, 0x18
test eax, eax
mov eax, dword [esi]
sete bl
call sym._monitor_load
test eax, eax
je 0x6514401b
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 0x24]
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x6514398d
test byte [0x65157028], 4
je 0x6514397e
mov eax, str._null_
lea esi, [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.pDLLName_not_valid_:__s_n
mov dword [esp + 8], str.fpAddMonitor
mov dword [esp + 4], 0x65157028
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x6514397e
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65143bf6
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65143d46
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65143f20
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Driver
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x65143e7a
test byte [0x65157028], 8
jne 0x65144037
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xbbe
jmp 0x65143ee2
movzx eax, ax
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65143cd4
mov eax, dword [esi]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
sub esp, 8
jmp 0x65143ee2
mov esi, dword [esi]
test esi, esi
je 0x651440a7
mov eax, esi
shr eax, 0x10
je 0x65144092
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push edx
push edx
test eax, eax
jne 0x651440ae
or edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.monitor__s_already_exists_n
mov dword [esp + 8], str.fpAddMonitor
mov dword [esp + 4], 0x65157028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65143ff1
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65144065
mov eax, str._null_
jmp 0x65144065
mov eax, str._invalid_
jmp 0x65144065