// File: /workspace/github_c_makefile_star2_O0/Carton32[P]quectel-CM/QMIThread.c
// Function: requestRegistrationState
static int requestRegistrationState(UCHAR *pPSAttachedState) {
    PQCQMIMSG pRequest;
    PQCQMIMSG pResponse;
    PQMUX_MSG pMUXMsg;
    int err;
    PQMINAS_CURRENT_PLMN_MSG pCurrentPlmn;
    PSERVING_SYSTEM pServingSystem;
    PQMINAS_DATA_CAP pDataCap;
    USHORT MobileCountryCode = 0;
    USHORT MobileNetworkCode = 0;
    const char *pDataCapStr = "UNKNOW";

    if (s_9x07) {
        return requestRegistrationState2(pPSAttachedState);
    }

    pRequest = ComposeQMUXMsg(QMUX_TYPE_NAS, QMINAS_GET_SERVING_SYSTEM_REQ, NULL, NULL);
    err = QmiThreadSendQMI(pRequest, &pResponse);
    qmi_rsp_check_and_return();

    pCurrentPlmn = (PQMINAS_CURRENT_PLMN_MSG)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x12);
    if (pCurrentPlmn) {
        MobileCountryCode = le16_to_cpu(pCurrentPlmn->MobileCountryCode);
        MobileNetworkCode = le16_to_cpu(pCurrentPlmn->MobileNetworkCode);
    }

    *pPSAttachedState = 0;
    pServingSystem = (PSERVING_SYSTEM)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x01);
    if (pServingSystem) {
    //Packet-switched domain attach state of the mobile.
    //0x00    PS_UNKNOWN ?Unknown or not applicable
    //0x01    PS_ATTACHED ?Attached
    //0x02    PS_DETACHED ?Detached
        *pPSAttachedState = pServingSystem->RegistrationState;
        if (pServingSystem->RegistrationState == 0x01) //0x01 ?C REGISTERED ?C Registered with a network
            *pPSAttachedState  = pServingSystem->PSAttachedState;
        else {
            //MobileCountryCode = MobileNetworkCode = 0;
            *pPSAttachedState  = 0x02;
        }
    }

    pDataCap = (PQMINAS_DATA_CAP)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x11);
    if (pDataCap && pDataCap->DataCapListLen) {
        UCHAR *DataCap = &pDataCap->DataCap;
        if (pDataCap->DataCapListLen == 2) {
            if ((DataCap[0] == 0x06) && ((DataCap[1] == 0x08) || (DataCap[1] == 0x0A)))
                DataCap[0] = DataCap[1];
        }
        switch (DataCap[0]) {
             case 0x01: pDataCapStr = "GPRS"; break;
             case 0x02: pDataCapStr = "EDGE"; break;
             case 0x03: pDataCapStr = "HSDPA"; break;
             case 0x04: pDataCapStr = "HSUPA"; break;
             case 0x05: pDataCapStr = "UMTS"; break;
             case 0x06: pDataCapStr = "1XRTT"; break;
             case 0x07: pDataCapStr = "1XEVDO"; break;
             case 0x08: pDataCapStr = "1XEVDO_REVA"; break;
             case 0x09: pDataCapStr = "GPRS"; break;
             case 0x0A: pDataCapStr = "1XEVDO_REVB"; break;
             case 0x0B: pDataCapStr = "LTE"; break;
             case 0x0C: pDataCapStr = "HSDPA"; break;
             case 0x0D: pDataCapStr = "HSDPA"; break;
             default: pDataCapStr = "UNKNOW"; break;
        }
    }

    if (pServingSystem && pServingSystem->RegistrationState == 0x01 && pServingSystem->InUseRadioIF && pServingSystem->RadioIF == 0x09) {
        pDataCapStr = "TD-SCDMA";
    }

    s_is_cdma = 0;
    if (pServingSystem && pServingSystem->RegistrationState == 0x01 && pServingSystem->InUseRadioIF && (pServingSystem->RadioIF == 0x01 || pServingSystem->RadioIF == 0x02)) {
        USHORT cmda_mcc = 0, cdma_mnc = 0;
        s_is_cdma = 1;
        if(!requestGetHomeNetwork(&cmda_mcc, &cdma_mnc,NULL, NULL) && cmda_mcc) {
            quectel_convert_cdma_mcc_2_ascii_mcc(&MobileCountryCode, cmda_mcc);
            quectel_convert_cdma_mnc_2_ascii_mnc(&MobileNetworkCode, cdma_mnc);
        }
        if (1) {
            PQCQMUX_TLV pTLV = (PQCQMUX_TLV)GetTLV(&pResponse->MUXMsg.QMUXMsgHdr, 0x23);
            if (pTLV)
                s_hdr_personality = pTLV->Value;
            else
                s_hdr_personality = 0;
            if (s_hdr_personality == 2)
                pDataCapStr = "eHRPD";
        }
    }

    dbg_time("%s MCC: %d, MNC: %d, PS: %s, DataCap: %s", __func__,
        MobileCountryCode, MobileNetworkCode, (*pPSAttachedState == 1) ? "Attached" : "Detached" , pDataCapStr);

    free(pResponse);

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0xd0, %rsp
movq %rdi, -0x10(%rbp)
movw $0x0, -0x4a(%rbp)
movw $0x0, -0x4c(%rbp)
leaq 0x1e879(%rip), %rax     # 0x2dc0b
movq %rax, -0x58(%rbp)
cmpl $0x0, 0x27f63(%rip)     # 0x37300
je 0xf3b0
movq -0x10(%rbp), %rdi
callq 0x120d0
movl %eax, -0x4(%rbp)
jmp 0xf9d3
movl $0x3, %edi
movl $0x24, %esi
xorl %eax, %eax
movl %eax, %ecx
movq %rcx, %rdx
callq 0x11170
movq %rax, -0x18(%rbp)
movq -0x18(%rbp), %rdi
leaq -0x20(%rbp), %rsi
movl $0x7530, %edx           # imm = 0x7530
leaq 0x1e834(%rip), %rcx     # 0x2dc12
callq 0xc670
movl %eax, -0x2c(%rbp)
cmpl $0x0, -0x2c(%rbp)
jl 0xf3f7
cmpq $0x0, -0x20(%rbp)
jne 0xf47f
jmp 0xf3f9
movq 0x27be0(%rip), %rax     # 0x36fe0
movq (%rax), %rax
movq %rax, -0x80(%rbp)
callq 0x13930
movq -0x80(%rbp), %rdi
movq %rax, %rdx
movl -0x2c(%rbp), %r8d
leaq 0x1e543(%rip), %rsi     # 0x2d961
leaq 0x1e7ed(%rip), %rcx     # 0x2dc12
movb $0x0, %al
callq 0x52c0
leaq 0x28a35(%rip), %rax     # 0x37e68
cmpq $0x0, (%rax)
je 0xf472
leaq 0x28a28(%rip), %rax     # 0x37e68
movq (%rax), %rax
movq %rax, -0x88(%rbp)
callq 0x13930
movq -0x88(%rbp), %rdi
movq %rax, %rdx
movl -0x2c(%rbp), %r8d
leaq 0x1e4fd(%rip), %rsi     # 0x2d961
leaq 0x1e7a7(%rip), %rcx     # 0x2dc12
movb $0x0, %al
callq 0x52c0
jmp 0xf474
movl -0x2c(%rbp), %eax
movl %eax, -0x4(%rbp)
jmp 0xf9d3
movq -0x20(%rbp), %rax
addq $0x6, %rax
movq %rax, -0x28(%rbp)
movq -0x28(%rbp), %rax
movzwl 0xa(%rax), %edi
callq 0x13ed0
movzwl %ax, %eax
cmpl $0x0, %eax
jne 0xf4b9
movq -0x28(%rbp), %rax
movzwl 0xc(%rax), %edi
callq 0x13ed0
movzwl %ax, %eax
cmpl $0x0, %eax
je 0xf59a
movq -0x28(%rbp), %rax
movzwl 0xc(%rax), %edi
callq 0x13ed0
movw %ax, -0x5a(%rbp)
movq 0x27b0f(%rip), %rax     # 0x36fe0
movq (%rax), %rax
movq %rax, -0x98(%rbp)
callq 0x13930
movq %rax, -0x90(%rbp)
movq -0x28(%rbp), %rax
movzwl 0xa(%rax), %edi
callq 0x13ed0
movq -0x98(%rbp), %rdi
movq -0x90(%rbp), %rdx
movzwl %ax, %r8d
movzwl -0x5a(%rbp), %r9d
leaq 0x1e461(%rip), %rsi     # 0x2d973
leaq 0x1e6f9(%rip), %rcx     # 0x2dc12
movb $0x0, %al
callq 0x52c0
leaq 0x28941(%rip), %rax     # 0x37e68
cmpq $0x0, (%rax)
je 0xf583
leaq 0x28934(%rip), %rax     # 0x37e68
movq (%rax), %rax
movq %rax, -0xa8(%rbp)
callq 0x13930
movq %rax, -0xa0(%rbp)
movq -0x28(%rbp), %rax
movzwl 0xa(%rax), %edi
callq 0x13ed0
movq -0xa8(%rbp), %rdi
movq -0xa0(%rbp), %rdx
movzwl %ax, %r8d
movzwl -0x5a(%rbp), %r9d
leaq 0x1e3fe(%rip), %rsi     # 0x2d973
leaq 0x1e696(%rip), %rcx     # 0x2dc12
movb $0x0, %al
callq 0x52c0
jmp 0xf585
movq -0x20(%rbp), %rdi
callq 0x5040
movzwl -0x5a(%rbp), %eax
movl %eax, -0x4(%rbp)
jmp 0xf9d3
jmp 0xf59c
movq -0x20(%rbp), %rdi
addq $0x6, %rdi
addq $0x3, %rdi
movl $0x12, %esi
callq 0xc580
movq %rax, -0x38(%rbp)
cmpq $0x0, -0x38(%rbp)
je 0xf5df
movq -0x38(%rbp), %rax
movzwl 0x3(%rax), %edi
callq 0x13ed0
movw %ax, -0x4a(%rbp)
movq -0x38(%rbp), %rax
movzwl 0x5(%rax), %edi
callq 0x13ed0
movw %ax, -0x4c(%rbp)
movq -0x10(%rbp), %rax
movb $0x0, (%rax)
movq -0x20(%rbp), %rdi
addq $0x6, %rdi
addq $0x3, %rdi
movl $0x1, %esi
callq 0xc580
movq %rax, -0x40(%rbp)
cmpq $0x0, -0x40(%rbp)
je 0xf639
movq -0x40(%rbp), %rax
movb 0x3(%rax), %cl
movq -0x10(%rbp), %rax
movb %cl, (%rax)
movq -0x40(%rbp), %rax
movzbl 0x3(%rax), %eax
cmpl $0x1, %eax
jne 0xf630
movq -0x40(%rbp), %rax
movb 0x5(%rax), %cl
movq -0x10(%rbp), %rax
movb %cl, (%rax)
jmp 0xf637
movq -0x10(%rbp), %rax
movb $0x2, (%rax)
jmp 0xf639
movq -0x20(%rbp), %rdi
addq $0x6, %rdi
addq $0x3, %rdi
movl $0x11, %esi
callq 0xc580
movq %rax, -0x48(%rbp)
cmpq $0x0, -0x48(%rbp)
je 0xf7b1
movq -0x48(%rbp), %rax
movzbl 0x3(%rax), %eax
cmpl $0x0, %eax
je 0xf7b1
movq -0x48(%rbp), %rax
addq $0x4, %rax
movq %rax, -0x68(%rbp)
movq -0x48(%rbp), %rax
movzbl 0x3(%rax), %eax
cmpl $0x2, %eax
jne 0xf6bd
movq -0x68(%rbp), %rax
movzbl (%rax), %eax
cmpl $0x6, %eax
jne 0xf6bb
movq -0x68(%rbp), %rax
movzbl 0x1(%rax), %eax
cmpl $0x8, %eax
je 0xf6ae
movq -0x68(%rbp), %rax
movzbl 0x1(%rax), %eax
cmpl $0xa, %eax
jne 0xf6bb
movq -0x68(%rbp), %rax
movb 0x1(%rax), %cl
movq -0x68(%rbp), %rax
movb %cl, (%rax)
jmp 0xf6bd
movq -0x68(%rbp), %rax
movzbl (%rax), %eax
decl %eax
movl %eax, %ecx
movq %rcx, -0xb0(%rbp)
subl $0xc, %eax
ja 0xf7a4
movq -0xb0(%rbp), %rax
leaq 0x1e0f6(%rip), %rcx     # 0x2d7dc
movslq (%rcx,%rax,4), %rax
addq %rcx, %rax
jmpq *%rax
leaq 0x1e535(%rip), %rax     # 0x2dc2b
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e52a(%rip), %rax     # 0x2dc30
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e51f(%rip), %rax     # 0x2dc35
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e5b3(%rip), %rax     # 0x2dcd9
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e505(%rip), %rax     # 0x2dc3b
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4fd(%rip), %rax     # 0x2dc40
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4f6(%rip), %rax     # 0x2dc46
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4f0(%rip), %rax     # 0x2dc4d
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4c1(%rip), %rax     # 0x2dc2b
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4e2(%rip), %rax     # 0x2dc59
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4e1(%rip), %rax     # 0x2dc65
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e4a4(%rip), %rax     # 0x2dc35
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e497(%rip), %rax     # 0x2dc35
movq %rax, -0x58(%rbp)
jmp 0xf7af
leaq 0x1e460(%rip), %rax     # 0x2dc0b
movq %rax, -0x58(%rbp)
jmp 0xf7b1
cmpq $0x0, -0x40(%rbp)
je 0xf7ea
movq -0x40(%rbp), %rax
movzbl 0x3(%rax), %eax
cmpl $0x1, %eax
jne 0xf7ea
movq -0x40(%rbp), %rax
movzbl 0x7(%rax), %eax
cmpl $0x0, %eax
je 0xf7ea
movq -0x40(%rbp), %rax
movzbl 0x8(%rax), %eax
cmpl $0x9, %eax
jne 0xf7ea
leaq 0x1e483(%rip), %rax     # 0x2dc69
movq %rax, -0x58(%rbp)
movl $0x0, 0x28600(%rip)     # 0x37df4
cmpq $0x0, -0x40(%rbp)
je 0xf8e2
movq -0x40(%rbp), %rax
movzbl 0x3(%rax), %eax
cmpl $0x1, %eax
jne 0xf8e2
movq -0x40(%rbp), %rax
movzbl 0x7(%rax), %eax
cmpl $0x0, %eax
je 0xf8e2
movq -0x40(%rbp), %rax
movzbl 0x8(%rax), %eax
cmpl $0x1, %eax
je 0xf83f
movq -0x40(%rbp), %rax
movzbl 0x8(%rax), %eax
cmpl $0x2, %eax
jne 0xf8e2
movw $0x0, -0x6a(%rbp)
movw $0x0, -0x6c(%rbp)
movl $0x1, 0x2859f(%rip)     # 0x37df4
leaq -0x6a(%rbp), %rdi
leaq -0x6c(%rbp), %rsi
xorl %eax, %eax
movl %eax, %ecx
movq %rcx, %rdx
callq 0x12c80
cmpl $0x0, %eax
jne 0xf891
movzwl -0x6a(%rbp), %eax
cmpl $0x0, %eax
je 0xf891
leaq -0x4a(%rbp), %rdi
movzwl -0x6a(%rbp), %esi
callq 0x12f50
leaq -0x4c(%rbp), %rdi
movzwl -0x6c(%rbp), %esi
callq 0x13050
movq -0x20(%rbp), %rdi
addq $0x6, %rdi
addq $0x3, %rdi
movl $0x23, %esi
callq 0xc580
movq %rax, -0x78(%rbp)
cmpq $0x0, -0x78(%rbp)
je 0xf8c2
movq -0x78(%rbp), %rax
movzbl 0x3(%rax), %eax
movl %eax, 0x28538(%rip)     # 0x37df8
jmp 0xf8cc
movl $0x0, 0x2852c(%rip)     # 0x37df8
cmpl $0x2, 0x28525(%rip)     # 0x37df8
jne 0xf8e0
leaq 0x1e396(%rip), %rax     # 0x2dc72
movq %rax, -0x58(%rbp)
jmp 0xf8e2
jmp 0xf8e4
movq 0x276f5(%rip), %rax     # 0x36fe0
movq (%rax), %rax
movq %rax, -0xb8(%rbp)
callq 0x13930
movq -0xb8(%rbp), %rdi
movq %rax, %rdx
movzwl -0x4a(%rbp), %r8d
movzwl -0x4c(%rbp), %r9d
movq -0x10(%rbp), %rax
movzbl (%rax), %ecx
leaq 0x1e394(%rip), %r10     # 0x2dcb0
leaq 0x1e384(%rip), %rax     # 0x2dca7
cmpl $0x1, %ecx
cmoveq %rax, %r10
movq -0x58(%rbp), %rax
leaq 0x1e343(%rip), %rsi     # 0x2dc78
leaq 0x1e2d6(%rip), %rcx     # 0x2dc12
movq %r10, (%rsp)
movq %rax, 0x8(%rsp)
movb $0x0, %al
callq 0x52c0
leaq 0x28515(%rip), %rax     # 0x37e68
cmpq $0x0, (%rax)
je 0xf9c1
leaq 0x28508(%rip), %rax     # 0x37e68
movq (%rax), %rax
movq %rax, -0xc0(%rbp)
callq 0x13930
movq -0xc0(%rbp), %rdi
movq %rax, %rdx
movzwl -0x4a(%rbp), %r8d
movzwl -0x4c(%rbp), %r9d
movq -0x10(%rbp), %rax
movzbl (%rax), %ecx
leaq 0x1e31f(%rip), %r10     # 0x2dcb0
leaq 0x1e30f(%rip), %rax     # 0x2dca7
cmpl $0x1, %ecx
cmoveq %rax, %r10
movq -0x58(%rbp), %rax
leaq 0x1e2ce(%rip), %rsi     # 0x2dc78
leaq 0x1e261(%rip), %rcx     # 0x2dc12
movq %r10, (%rsp)
movq %rax, 0x8(%rsp)
movb $0x0, %al
callq 0x52c0
jmp 0xf9c3
movq -0x20(%rbp), %rdi
callq 0x5040
movl $0x0, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0xd0, %rsp
popq %rbp
retq
nop