Function at 0x140011970
Capabilities:
Print debug messages
Query or enumerate registry value
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [r11 - 0x40], rdx
mov qword [rcx + 0x28], 0xffffffffffffffff
xor ebp, ebp
mov esi, ebp
mov qword [r11 - 0x48], rbp
lea rax, [r11 - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREFaronicsInsight_WindowsTracing
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14d, [rbp + 1]
test eax, eax
jne 0x140011a55
mov dword [rsp + 0x90], ebp
mov dword [rsp + 0x94], 4
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x94]
xor r8d, r8d
lea rdx, str.Enable
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011a47
cmp dword [rsp + 0x90], r14d
cmove esi, r14d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbx + 0x110c], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0x10f8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [rbx + 0x110c], ebp
je 0x140011b77
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140012240
mov r8, rax
lea rdx, [rsp + 0x40]
call fcn.140011c10
cmp qword [rax + 0x18], 8
jb 0x140011aa0
mov rax, qword [rax]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, r14d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x28], rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140011b0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011b0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011bfa
call fcn.1400a59a4
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140011b85
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 0xfeff
mov word [rsp + 0x90], ax
mov dword [rsp + 0x94], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x94]
mov r8d, 2
lea rdx, [rsp + 0x90]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x140011b85
lea rcx, str.Faronics_Insight_Tracing_is_not_Enabled
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140011bc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140011bbb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011c00
mov rcx, r8
call fcn.1400a59a4
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a5460
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400b4704
nop
call fcn.1400b4704
int3