Function at 0x140004770
Capabilities:
Check for time delay via gettickcount
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x40
add ecx, 0xffff8000
mov rbx, rdx
cmp ecx, 6
ja case.0x14000479d.32773
lea rdx, [0x140000000]
mov ecx, dword [rdx + rcx*4 + 0x4a10]
add rcx, rdx
jmp rcx
lea rcx, str.Enter_case_DBT_DEVICEARRIVAL:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 4], 5
jne case.0x14000479d.32773
mov ecx, dword [0x14004fb90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5f
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [0x14004fb90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e60
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 1
call fcn.14000e650
xor ebx, ebx
cmp dword [0x140051170], 2
jne 0x1400048e0
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 0x10]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SYSTEMCurrentControlSetControlRadioManagementSystemRadioState
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400048be
mov edx, dword [rsp + 0x50]
lea rcx, str.Successfully_get_Airplane_mode_Status_in_the_registry_and_the_value_is__d__r_n
call fcn.14000e530
cmp dword [rsp + 0x50], ebx
jne 0x1400048e0
cmp byte [0x1400516d4], 1
jne 0x1400048e0
xor edx, edx
mov byte [0x1400516d4], bl
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000e530
xor r8d, r8d
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [rbx + 2]
call fcn.14001a030
mov ecx, dword [0x14004fb90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [0x140051170], ebx
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_get_Airplane_mode_Status_in_the_registry_____Error_code:_d__r_n
call fcn.14000e530
xor eax, eax
mov dword [0x140051170], ebx
add rsp, 0x40
pop rbx
ret
call fcn.140001cb0
xor eax, eax
mov dword [0x140051170], ebx
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEREMOVECOMPLETE:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 4], 5
jne case.0x14000479d.32773
lea rcx, str.Enter_case_if_pHdr__dbch_devicetype__DBT_DEVTYP_DEVICEINTERFACE___r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x140051174], 0
je 0x140004985
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140051174]
cmp eax, 0x2ee0
jae 0x140004985
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [0x140051174]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, dword [0x140051174]
lea rcx, str.Card_Drop:__d____d___d___r_n
mov edx, eax
mov r9d, ebx
call fcn.14000e530
mov ecx, dword [0x14004fb90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e61
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor ecx, ecx
call fcn.14000e650
xor eax, eax
add rsp, 0x40
pop rbx
ret
cmp dword [0x140051170], 1
je 0x14000495f
lea rcx, str.the_condition_is_g_DeviceMode___DeviceMode_NORMAL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x140051170], 2
jmp 0x14000495f
cmp dword [rbx + 4], 6
jne case.0x14000479d.32773
or dword [0x1400516d8], 1
mov rcx, rbx
call fcn.1400041e0
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEQUERYREMOVE:__r_n
mov dword [0x140051170], 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEQUERYREMOVEFAILED:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEREMOVEPENDING:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret