Function at 0x1400043f0
Capabilities:
Check for time delay via gettickcount
Print debug messages
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
add ecx, 0xffff8000
mov rbx, rdx
cmp ecx, 6
ja case.0x140004419.32773
lea rdx, [0x140000000]
mov ecx, dword [rdx + rcx*4 + 0x4674]
add rcx, rdx
jmp rcx
lea rcx, str.Enter_case_DBT_DEVICEARRIVAL:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 4], 5
jne case.0x140004419.32773
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5f
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e60
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 1
call fcn.14000e780
xor ebx, ebx
cmp dword [0x140043730], 2
jne 0x140004546
lea rax, [rsp + 0x58]
lea r9d, [rbx + 0x10]
lea rdx, str.SYSTEMCurrentControlSetControlRadioManagementSystemRadioState
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140004524
mov edx, dword [rsp + 0x50]
lea rcx, str.Successfully_get_Airplane_mode_Status_in_the_registry_and_the_value_is__d__r_n
call fcn.14000e580
cmp dword [rsp + 0x50], ebx
jne 0x140004546
cmp byte [0x140043738], 1
jne 0x140004546
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
xor edx, edx
mov byte [0x140043738], bl
call fcn.14000e580
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x140043730], ebx
xor eax, eax
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_get_Airplane_mode_Status_in_the_registry_____Error_code:_d__r_n
mov edx, eax
call fcn.14000e580
mov dword [0x140043730], ebx
xor eax, eax
add rsp, 0x40
pop rbx
ret
call fcn.140001b00
mov dword [0x140043730], ebx
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEREMOVECOMPLETE:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 4], 5
jne case.0x140004419.32773
lea rcx, str.Enter_case_if_pHdr__dbch_devicetype__DBT_DEVTYP_DEVICEINTERFACE___r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x140043728], 0
je 0x1400045eb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140043728]
cmp eax, 0x2ee0
jae 0x1400045eb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [0x140043728]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, dword [0x140043728]
lea rcx, str.Card_Drop:__d____d___d___r_n
mov edx, eax
mov r9d, ebx
call fcn.14000e580
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e61
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor ecx, ecx
call fcn.14000e780
xor eax, eax
add rsp, 0x40
pop rbx
ret
cmp dword [0x140043730], 1
je 0x1400045c5
lea rcx, str.the_condition_is_g_DeviceMode___DeviceMode_NORMAL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x140043730], 2
jmp 0x1400045c5
cmp dword [rbx + 4], 6
jne case.0x140004419.32773
or dword [0x140043734], 1
mov rcx, rbx
call fcn.140003ba0
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEQUERYREMOVE:__r_n
mov dword [0x140043730], 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEQUERYREMOVEFAILED:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEREMOVEPENDING:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret