Function at 0x140004070
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x140040468]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rcx, str.Enter_function_void_OnDeviceArrival___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.140002e00
call fcn.140009fe0
xor esi, esi
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x270], si
call fcn.14001cc90
lea r8, str.SoftwareAtherosVistaAddOn
lea rcx, [rsp + 0x270]
mov edx, 0x104
call fcn.140019d1c
lea r11, [rsp + 0x38]
lea r9d, [rsi + 1]
lea rdx, [rsp + 0x270]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004172
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.IsWin7DriverOnly
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x34], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x34], 1
mov rcx, qword [rsp + 0x38]
mov ebx, esi
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140004172
lea rcx, str.This_package_is_for_Win7_driver_only__no_need_to_add_and_delete_registry__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140004177
call fcn.1400177f0
movups xmm0, xmmword [0x140037148]
lea rcx, [rsp + 0x50]
movaps xmmword [rsp + 0x50], xmm0
call fcn.1400027e0
test eax, eax
je 0x140004209
call fcn.140002a00
test eax, eax
je 0x140004209
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
mov edx, 1
call fcn.14000e580
call fcn.1400099f0
cmp eax, 0x1e
jne 0x1400041cc
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x140043324], 1
mov ecx, dword [0x140043300]
xor r9d, r9d
mov edx, 0x5e5d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
xor edx, edx
call fcn.14000e580
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], si
call fcn.14001cc90
xor ecx, ecx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14000428a
lea rdx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x60]
lea rcx, str.The_cServPath_is__s__n
call fcn.14000e580
lea rdx, str.System32
lea rcx, [rsp + 0x60]
call fcn.140019c30
test rax, rax
je 0x14000427f
lea rcx, str.This_adminservice_is_for_MSFT_WU_or_3002_Intel._n
mov edi, esi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004297
lea rcx, str.OnDeviceArrival________Error_GetModuleHandle_NULL__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [0x1400432d8], rsi
jne 0x1400042bf
lea rcx, str.Enter_condition_pSvc__RegeditCustomHandle__NULL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.140002660
cmp qword [0x1400432d8], rsi
je 0x140004392
lea rcx, str.Enter_condition_pSvc__RegeditCustomHandle___NULL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x140043734]
mov byte [rsp + 0x30], 1
and eax, 0xfffffffe
mov ebx, esi
movsxd rdi, edi
mov dword [0x140043734], eax
test al, 1
jne 0x140004392
nop dword [rax]
cmp ebx, 0xa
jge 0x140004392
lea r8, [rsp + 0x30]
mov ecx, 0xfc1e
mov edx, 1
call fcn.140018ed0
cmp eax, 2
je 0x140004344
mov dword [0x14004371c], esi
call fcn.1400099f0
cmp eax, 0xa
jne 0x140004327
call fcn.1400154b0
test rdi, rdi
je 0x140004337
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
test byte [0x140043734], 1
je 0x1400042f0
jmp 0x140004392
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11d, dword [0x14004371c]
cmp r11d, 3
jg 0x14000438c
inc r11d
lea rcx, str.::PostThreadMessage_pSvc__dwThreadID_CUSTOM_THREAD_EVENT_DEVICE_ARRIVAL__0__0___n
mov dword [0x14004371c], r11d
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x140043300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5f
call qword [sym.imp.USER32.dll_PostThreadMessageW]
jmp 0x140004392
mov dword [0x14004371c], esi
call fcn.1400099f0
cmp eax, 0x1e
jne 0x1400043b5
lea rcx, str.Set_Timethread_parameter_to_0__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x140043320], esi
mov dword [0x14004331c], esi
lea rcx, str.Leave_function_void_OnDeviceArrival___n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140019650
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret