Function at 0x140003ca0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x590
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14000a160]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov edi, edx
mov rbx, rcx
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
cmp qword [rcx + 0x2e0], r15
je 0x1400040c5
movaps xmm0, xmmword [str.SoftwareHewlett_PackardHP_3D_DriveGuardProtectedDisks]
movaps xmmword [rsp + 0x500], xmm0
movaps xmm1, xmmword [0x140007700]
movaps xmmword [rsp + 0x510], xmm1
movaps xmm0, xmmword [0x140007710]
movaps xmmword [rsp + 0x520], xmm0
movaps xmm1, xmmword [0x140007720]
movaps xmmword [r11 - 0x78], xmm1
movaps xmm0, xmmword [0x140007730]
movaps xmmword [r11 - 0x68], xmm0
movaps xmm1, xmmword [0x140007740]
movaps xmmword [r11 - 0x58], xmm1
movaps xmm0, xmmword [0x140007750]
movaps xmmword [r11 - 0x48], xmm0
movzx eax, word [0x140007760]
mov word [r11 - 0x38], ax
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r11 - 0xa8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400040a5
mov rcx, rbx
test edi, edi
je 0x140004043
lea rdx, str.bCurrentProtectionFlag_Enabled
call fcn.140001550
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x70]
call sub.MSVCR110.dll_memset
lea r8, [rsp + 0x70]
lea edx, [r15 + 0xa]
mov rcx, qword [rbx + 0x2e0]
call qword [sym.imp.accelerometerdll.DLL_unsigned_long_int___cdecl_GetAccelerometerProperty_void____ptr64__enum__ACCELEROMETER_PROPERTY_FLAGS__void____ptr64_]
mov r9d, dword [rsp + 0x78]
mov r8d, dword [rsp + 0x74]
lea r14d, [r9 + r8]
lea rdx, str.diskCountsEx.Protected____d___diskCountsEx.NotProtected__d_
mov rcx, rbx
call fcn.140001550
mov ebx, r15d
test r14d, r14d
je 0x1400040a5
lea rdi, [rsp + 0x82]
nop dword [rax]
cmp byte [rdi - 1], 1
jne 0x140004032
cmp byte [rdi], 0
jne 0x140004032
mov r9d, ebx
lea r8, str.Disk_d
mov edx, 8
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.MSVCR110.dll_swprintf_s]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x4f0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140004032
mov word [rsp + 0x4a0], r15w
xor eax, eax
mov qword [rsp + 0x4a2], rax
mov qword [rsp + 0x4aa], rax
mov qword [rsp + 0x4b2], rax
mov qword [rsp + 0x4ba], rax
mov qword [rsp + 0x4c2], rax
mov qword [rsp + 0x4ca], rax
mov qword [rsp + 0x4d2], rax
mov qword [rsp + 0x4da], rax
mov qword [rsp + 0x4e2], rax
mov dword [rsp + 0x4ea], eax
mov word [rsp + 0x4ee], ax
mov qword [rsp + 0x60], r15
mov esi, ebx
imul rsi, rsi, 0x3f
lea r9, [rsp + 0x97]
add r9, rsi
mov qword [rsp + 0x20], 0x27
lea r8d, [rax + 0x28]
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR110.dll_mbstowcs_s]
lea rcx, [rsp + 0x4a0]
or rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140003f30
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ModelNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov word [rsp + 0x470], r15w
xor eax, eax
mov qword [rsp + 0x472], rax
mov qword [rsp + 0x47a], rax
mov qword [rsp + 0x482], rax
mov qword [rsp + 0x48a], rax
mov dword [rsp + 0x492], eax
mov word [rsp + 0x496], ax
mov qword [rsp + 0x60], r15
lea r9, [rsp + 0x83]
add r9, rsi
mov qword [rsp + 0x20], 0x13
lea r8d, [rax + 0x14]
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR110.dll_mbstowcs_s]
lea rcx, [rsp + 0x470]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140003fe4
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x470]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SerialNumber
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r15
inc ebx
add rdi, 0x3f
cmp ebx, r14d
jb 0x140003e10
jmp 0x1400040a5
lea rdx, str.bCurrentProtectionFlag_Disabled__deleted_registry_key
call fcn.140001550
lea rdx, [rsp + 0x500]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
jne 0x1400040a5
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x500]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400040b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400040c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.140004420
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret