Zenwsreg.dll is called by Workstation Manager's Scheduler when one of the following events occurs:
Workstation startup
User login
User logout
Registration service shutdown
When one of the above events is detected, the sequence of file calls is as follows:
Windows 98: wm95.exe > wm98sast.exe > zenwsreg.dll.
Windows 2000/XP: wm.exe > wmrundll.exe > zenwsreg.dll.