Function at 0x65144dc0
Capabilities:
Persist via print processors registry key
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 0xc]
mov esi, dword [ecx]
mov dword [ebp - 0x1c], 0
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x2c], eax
test byte [0x65157028], 8
jne 0x65144ee0
test ebx, ebx
je 0x65144ec0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x65144ec0
test esi, esi
je 0x65144e17
cmp word [esi], 0
jne 0x65145090
mov eax, edi
call sym._validate_envW
mov esi, eax
test eax, eax
je 0x65144eaa
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [ebp - 0x30], eax
call eax
lea eax, [eax + eax + 0x92]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x65144eaa
mov eax, dword [esi]
mov dword [esp + 4], str.SystemCurrentControlSetControlPrintEnvironments_sPrint_Processors_
mov dword [esp], edi
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_wsprintfW]
lea eax, [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
test esi, esi
je 0x65145028
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], esi
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
test eax, eax
je 0x65145150
shr eax, 0x10
je 0x651450c0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x38], str._invalid_
sub esp, 8
test eax, eax
jne 0x65144f23
mov eax, dword [ebp - 0x2c]
mov edx, 0xffffffff
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x38], eax
test ebx, ebx
je 0x65145140
mov eax, ebx
shr eax, 0x10
je 0x65145120
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x34], str._invalid_
sub esp, 8
test eax, eax
jne 0x65144f64
mov edx, 0xffffffff
mov eax, ebx
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x34], eax
test edi, edi
je 0x65145170
mov eax, edi
shr eax, 0x10
je 0x65145100
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x30], str._invalid_
sub esp, 8
test eax, eax
jne 0x65144fa5
mov edx, 0xffffffff
mov eax, edi
call sym._wine_dbgstr_wn.part.0
mov dword [ebp - 0x30], eax
test esi, esi
je 0x65145160
mov eax, esi
shr eax, 0x10
je 0x651450e0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x65144fe3
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn.part.0
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___s___s___s__n
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x34]
mov dword [esp + 8], str.fpAddPrintProcessor
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x30]
mov dword [esp + 4], 0x65157028
mov dword [esp + 0x14], edx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x65144df6
mov dword [esp], ebx
mov eax, dword [ebp - 0x30]
call eax
mov dword [esp + 0x10], ebx
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], str.Driver
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetKeyValueW]
mov esi, eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
jne 0x65144ea1
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
test byte [0x65157028], 1
jne 0x65145180
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7b
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
movzx eax, word [ebp - 0x2c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [ebp - 0x38], eax
jmp 0x65144f23
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x65144fe3
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [ebp - 0x30], eax
jmp 0x65144fa5
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf.constprop.0_1
mov dword [ebp - 0x34], eax
jmp 0x65144f64
mov dword [ebp - 0x34], str._null_
jmp 0x65144f64
mov dword [ebp - 0x38], str._null_
jmp 0x65144f23
mov eax, str._null_
jmp 0x65144fe3
mov dword [ebp - 0x30], str._null_
jmp 0x65144fa5
mov eax, esi
shr eax, 0x10
je 0x651451e0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x651451b2
mov edx, 0xffffffff
mov eax, esi
call sym._wine_dbgstr_wn.part.0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.server__s_not_supported_n
mov dword [esp + 8], str.fpAddPrintProcessor
mov dword [esp + 4], 0x65157028
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_1
jmp 0x6514509d
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x651451b2