Function at 0x140005210
Capabilities:
Check for time delay via gettickcount
Print debug messages
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
add ecx, 0xffff8000
mov rbx, rdx
cmp ecx, 6
ja case.0x140005239.32773
lea rdx, [0x140000000]
mov ecx, dword [rdx + rcx*4 + 0x5494]
add rcx, rdx
jmp rcx
lea rcx, str.Enter_case_DBT_DEVICEARRIVAL:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 4], 5
jne case.0x140005239.32773
mov ecx, dword [0x140045ce0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5f
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, dword [0x140045ce0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e60
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 1
call fcn.14000f180
xor ebx, ebx
cmp dword [0x14004611c], 2
jne 0x140005365
lea rax, [rsp + 0x58]
lea r9d, [rbx + 0x10]
lea rdx, str.SYSTEMCurrentControlSetControlRadioManagementSystemRadioState
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140005343
mov edx, dword [rsp + 0x50]
lea rcx, str.Successfully_get_Airplane_mode_Status_in_the_registry_and_the_value_is__d__r_n
call fcn.14000f070
cmp dword [rsp + 0x50], ebx
jne 0x140005365
cmp byte [0x1400460ee], 1
jne 0x140005365
lea rcx, str.Enter_Function_DisableRadioHandler__n_n
mov byte [0x1400460ee], bl
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x140045ce0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x14004611c], ebx
xor eax, eax
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_get_Airplane_mode_Status_in_the_registry_____Error_code:_d__r_n
mov edx, eax
call fcn.14000f070
mov dword [0x14004611c], ebx
xor eax, eax
add rsp, 0x40
pop rbx
ret
call fcn.140002a40
mov dword [0x14004611c], ebx
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEREMOVECOMPLETE:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rbx + 4], 5
jne case.0x140005239.32773
lea rcx, str.Enter_case_if_pHdr__dbch_devicetype__DBT_DEVTYP_DEVICEINTERFACE___r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x140046118], 0
je 0x14000540a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x140046118]
cmp eax, 0x2ee0
jae 0x14000540a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [0x140046118]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, dword [0x140046118]
lea rcx, str.Card_Drop:__d____d___d___r_n
mov edx, eax
mov r9d, ebx
call fcn.14000f070
mov ecx, dword [0x140045ce0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e61
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor ecx, ecx
call fcn.14000f180
xor eax, eax
add rsp, 0x40
pop rbx
ret
cmp dword [0x14004611c], 1
je 0x1400053e4
lea rcx, str.the_condition_is_g_DeviceMode___DeviceMode_NORMAL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x14004611c], 2
jmp 0x1400053e4
cmp dword [rbx + 4], 6
jne case.0x140005239.32773
or dword [0x140046120], 1
mov rcx, rbx
call fcn.140004a30
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEQUERYREMOVE:__r_n
mov dword [0x14004611c], 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEQUERYREMOVEFAILED:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea rcx, str.Enter_case_DBT_DEVICEREMOVEPENDING:__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x40
pop rbx
ret