Function at 0x41ac34
Capabilities:
Check for software breakpoints
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff580
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push eax
call sym.Cari___.exe__Findmodule
pop ecx
mov ebx, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jb 0x41ac5f
or eax, 0xffffffff
jmp 0x41b44b
test ebx, ebx
je 0x41ac76
mov edx, dword [ebp + 8]
cmp edx, dword [ebx + 0xc]
jb 0x41ac76
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebx + 0x10]
cmp ecx, dword [ebp + 0xc]
jae 0x41ac7e
or eax, 0xffffffff
jmp 0x41b44b
cmp dword [ebx + 0x174], 0
jne 0x41ad2a
cmp edi, 3
je 0x41ac9a
cmp edi, 4
je 0x41ac9a
cmp edi, 5
jne 0x41aca1
xor eax, eax
jmp 0x41b44b
mov edx, dword [ebx + 0x10]
push edx
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebx + 0x174], eax
mov ecx, dword [ebx + 0x10]
push ecx
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebx + 0x178], eax
cmp dword [ebx + 0x174], 0
je 0x41acd5
cmp dword [ebx + 0x178], 0
jne 0x41ad2a
mov eax, dword [ebx + 0x10]
add eax, eax
push eax
push 0x4b2b61
call sym.Cari___.exe__Error
add esp, 8
cmp dword [ebx + 0x174], 0
je 0x41ad05
mov edx, dword [ebx + 0x174]
push edx
call sub.KERNEL32.DLL_GlobalFree
xor ecx, ecx
mov dword [ebx + 0x174], ecx
cmp dword [ebx + 0x178], 0
je 0x41ad22
mov eax, dword [ebx + 0x178]
push eax
call sub.KERNEL32.DLL_GlobalFree
xor edx, edx
mov dword [ebx + 0x178], edx
or eax, 0xffffffff
jmp 0x41b44b
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
push edx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41ad5d
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
push ecx
push 0x4b2b61
call sym.Cari___.exe__Error
add esp, 8
or eax, 0xffffffff
jmp 0x41b44b
mov edx, dword [0x4d54d8]
push edx
call sub.USER32.DLL_SetCursor
mov dword [ebp - 0x20], eax
mov ecx, dword [0x4d5a5c]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 3
jne 0x41ada9
mov esi, dword [0x4d7db0]
test esi, esi
je 0x41ada9
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x41ad9e
mov edx, dword [esi + 0xc]
push edx
call sub.KERNEL32.DLL_SuspendThread
inc dword [ebp - 4]
add esi, 0x66c
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x4d7d98]
jl 0x41ad8c
mov dword [0x4d5a5c], 1
xor edx, edx
mov eax, dword [0x4d8134]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
je 0x41adcb
call fcn.00418e24
cmp edi, 0xb
jne 0x41aefd
push 1
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
push ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x18]
push edx
call sym.Cari___.exe__Readmemory
add esp, 0x10
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
cmp eax, ecx
je 0x41adff
or eax, 0xffffffff
jmp 0x41b44b
mov esi, dword [ebp + 8]
cmp esi, dword [ebp + 0xc]
jae 0x41aecd
mov eax, dword [ebx + 0x16c]
test eax, eax
je 0x41ae4c
mov edx, esi
sub edx, dword [ebx + 0xc]
xor ecx, ecx
mov cl, byte [eax + edx]
and ecx, 0x1f
mov dword [ebp - 8], ecx
mov eax, esi
sub eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x16c]
cmp byte [edx + eax], 0
je 0x41ae4c
cmp dword [ebp - 8], 0x1d
je 0x41ae4c
cmp dword [ebp - 8], 0x1e
je 0x41ae4c
cmp dword [ebp - 8], 0x1f
jne 0x41aecd
push 0
lea ecx, [ebp - 0xa80]
push 1
push ecx
push 0
push esi
mov eax, dword [ebp + 0xc]
sub eax, esi
push eax
mov edx, dword [ebp - 0x18]
add edx, esi
sub edx, dword [ebp + 8]
push edx
call sym.Cari___.exe__Disasm
add esp, 0x1c
cmp dword [ebp - 0x448], 0
jne 0x41aecd
and dword [ebp - 0x47c], 0xf0
mov edx, dword [ebp - 0x47c]
cmp edx, 0x50
je 0x41ae94
cmp edx, 0x60
jne 0x41aea4
mov edx, dword [ebp - 0x450]
cmp edx, dword [ebp + 8]
jb 0x41aecd
cmp edx, dword [ebp + 0xc]
ja 0x41aecd
mov edx, dword [ebp - 0x47c]
cmp edx, 0x80
je 0x41aecd
cmp edx, 0xa0
je 0x41aecd
cmp edx, 0xf0
je 0x41aecd
add esi, eax
cmp esi, dword [ebp + 0xc]
jb 0x41ae0b
cmp esi, dword [ebp + 0xc]
jae 0x41aefd
push 0x2024
push 0x4b2cca
push 0x4b2b88
mov eax, dword [0x4d3b7c]
push eax
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
je 0x41aefd
or eax, 0xffffffff
jmp 0x41b44b
mov edx, 2
cmp edi, 5
je 0x41af0a
add edx, 0xfffffffe
push edx
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
push ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x18]
push edx
call sym.Cari___.exe__Readmemory
add esp, 0x10
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
cmp eax, ecx
jne 0x41b3bd
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
cmp esi, dword [ebp + 0xc]
jae 0x41b3a4
mov edx, dword [ebx + 0x174]
mov ecx, dword [ebp - 0x14]
test byte [edx + ecx], 2
je 0x41b0e3
mov eax, esi
sub eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov cl, byte [edx + eax]
cmp ecx, 0xcc
je 0x41b0e3
push 0xc
push 0
push 0
push esi
push 0
call sym.Cari___.exe__Setcpu
mov dword [ebp - 0x10], 1
mov eax, dword [ebx + 0x178]
mov edx, dword [ebp - 0x14]
add esp, 0x14
xor ecx, ecx
mov cl, byte [eax + edx]
mov eax, esi
push ecx
sub eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov cl, byte [edx + eax]
push ecx
push 0x4b243f
push 1
push esi
call sym.Cari___.exe__Addtolist
add esp, 0x14
mov eax, esi
sub eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov cl, byte [edx + eax]
mov eax, dword [ebx + 0x178]
mov edx, dword [ebp - 0x14]
cmp cl, byte [eax + edx]
jne 0x41b016
mov ecx, esi
mov eax, dword [ebp - 0x18]
sub ecx, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax + ecx]
lea ecx, [ebp - 0x120]
push edx
push 0xcc
push esi
push 0x4b2478
push ecx
call fcn.004a6c2c
add esp, 0x14
lea eax, [ebp - 0x120]
mov edx, dword [0x4d3b7c]
push 0x10
push 0x4b2ce5
push eax
push edx
call sub.USER32.DLL_MessageBoxA
jmp 0x41b0e3
cmp edi, 4
je 0x41b020
cmp edi, 5
jne 0x41b093
mov ecx, dword [ebx + 0x178]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx + eax]
mov ecx, esi
push edx
sub ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dl, byte [eax + ecx]
lea ecx, [ebp - 0x120]
push edx
push 0xcc
push esi
push 0x4b255c
push ecx
call fcn.004a6c2c
add esp, 0x18
lea eax, [ebp - 0x120]
mov edx, dword [0x4d3b7c]
push 0x13
push 0x4b2ce5
push eax
push edx
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x41b3a4
cmp dword [ebp - 4], 6
jne 0x41b0e3
mov ecx, dword [ebx + 0x174]
mov eax, dword [ebp - 0x14]
and byte [ecx + eax], 0xfd
jmp 0x41b0e3
mov edx, esi
mov ecx, dword [ebp - 0x18]
sub edx, dword [ebp + 8]
xor eax, eax
mov al, byte [ecx + edx]
push eax
xor eax, eax
mov edx, dword [ebx + 0x178]
mov ecx, dword [ebp - 0x14]
mov al, byte [edx + ecx]
lea edx, [ebp - 0x120]
push eax
push 0xcc
push esi
push 0x4b2d01
push edx
call fcn.004a6c2c
add esp, 0x18
lea ecx, [ebp - 0x120]
mov eax, dword [0x4d3b7c]
push 0x10
push 0x4b2ce5
push ecx
push eax
call sub.USER32.DLL_MessageBoxA
cmp edi, 1
je 0x41b100
cmp edi, 2
je 0x41b100
cmp edi, 7
je 0x41b100
cmp edi, 8
je 0x41b100
cmp edi, 9
jne 0x41b2a6
mov eax, dword [ebx + 0x16c]
test eax, eax
je 0x41b11d
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + edx]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
and eax, 0x1f
jmp 0x41b124
xor edx, edx
xor eax, eax
mov dword [ebp - 8], edx
cmp eax, 0x1d
je 0x41b137
cmp eax, 0x1e
je 0x41b137
cmp eax, 0x1f
jne 0x41b397
cmp edi, 2
je 0x41b146
cmp edi, 8
je 0x41b146
cmp edi, 9
jne 0x41b15a
test byte [ebp - 8], 0x60
je 0x41b397
test byte [ebp - 8], 0x80
je 0x41b397
push esi
call sym.Cari___.exe__Getbreakpointtype
test ah, 1
pop ecx
jne 0x41b1a3
mov edx, dword [ebx + 0x174]
mov ecx, dword [ebp - 0x14]
test byte [edx + ecx], 2
jne 0x41b1a3
mov eax, esi
sub eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
push dword [edx + eax]
mov ecx, dword [ebx + 0x178]
mov edx, dword [ebp - 0x14]
lea edx, [ecx + edx]
pop ecx
mov byte [edx], cl
mov edx, dword [ebp - 0x18]
mov byte [edx + eax], 0xcc
mov eax, dword [ebx + 0x174]
mov ecx, dword [ebp - 0x14]
or byte [eax + ecx], 2
cmp edi, 7
jne 0x41b1c7
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + edx]
and cl, 0xdf
or cl, 0xc0
push ecx
mov edx, dword [ebp - 0x14]
pop ecx
mov byte [eax + edx], cl
jmp 0x41b397
cmp edi, 8
jne 0x41b230
mov eax, dword [ebp - 8]
and eax, 0x60
cmp eax, 0x20
je 0x41b1f2
cmp eax, 0x60
je 0x41b1f2
mov eax, dword [ebp - 8]
and eax, 0x1f
cmp eax, 0x1e
je 0x41b1f2
mov edx, dword [ebp - 8]
and edx, 0x1f
cmp edx, 0x1f
jne 0x41b211
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + edx]
and cl, 0xdf
or cl, 0xc0
push ecx
mov edx, dword [ebp - 0x14]
pop ecx
mov byte [eax + edx], cl
jmp 0x41b397
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + edx]
or cl, 0x80
and cl, 0xbf
push ecx
mov edx, dword [ebp - 0x14]
pop ecx
mov byte [eax + edx], cl
jmp 0x41b397
cmp edi, 9
jne 0x41b294
mov eax, dword [ebp - 8]
and eax, 0x60
cmp eax, 0x20
je 0x41b256
mov eax, dword [ebp - 8]
and eax, 0x60
cmp eax, 0x40
jne 0x41b275
mov edx, dword [ebp - 8]
and edx, 0x1f
cmp edx, 0x1f
jne 0x41b275
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + edx]
and cl, 0xdf
or cl, 0xc0
push ecx
mov edx, dword [ebp - 0x14]
pop ecx
mov byte [eax + edx], cl
jmp 0x41b397
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + edx]
or cl, 0x80
and cl, 0xbf
push ecx
mov edx, dword [ebp - 0x14]
pop ecx
mov byte [eax + edx], cl
jmp 0x41b397
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
or byte [eax + edx], 0x80
jmp 0x41b397
cmp edi, 3
jne 0x41b320
mov eax, dword [ebx + 0x174]
mov ecx, dword [ebp - 0x14]
movzx eax, byte [eax + ecx]
and eax, 0x81
cmp eax, 0x81
jne 0x41b397
push esi
call sym.Cari___.exe__Getbreakpointtype
test ah, 1
pop ecx
jne 0x41b311
mov edx, dword [ebx + 0x174]
mov ecx, dword [ebp - 0x14]
test byte [edx + ecx], 2
jne 0x41b311
mov eax, esi
sub eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
push dword [edx + eax]
mov ecx, dword [ebx + 0x178]
mov edx, dword [ebp - 0x14]
lea edx, [ecx + edx]
pop ecx
mov byte [edx], cl
mov edx, dword [ebp - 0x18]
mov byte [edx + eax], 0xcc
mov eax, dword [ebx + 0x174]
mov ecx, dword [ebp - 0x14]
or byte [eax + ecx], 2
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
and byte [eax + edx], 0xfe
jmp 0x41b397
cmp edi, 4
je 0x41b32a
cmp edi, 5
jne 0x41b35f
mov ecx, dword [ebx + 0x174]
mov eax, dword [ebp - 0x14]
test byte [ecx + eax], 2
je 0x41b350
mov edx, dword [ebx + 0x178]
mov ecx, dword [ebp - 0x14]
mov al, byte [edx + ecx]
mov edx, esi
sub edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov byte [ecx + edx], al
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov byte [eax + edx], 0
jmp 0x41b397
cmp edi, 6
je 0x41b397
cmp edi, 0xa
jne 0x41b378
mov ecx, dword [ebx + 0x174]
mov eax, dword [ebp - 0x14]
and byte [ecx + eax], 0x9f
jmp 0x41b397
cmp edi, 0xb
jne 0x41b397
mov eax, dword [ebx + 0x174]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + edx]
or cl, 0x20
and cl, 0xbf
push ecx
mov edx, dword [ebp - 0x14]
pop ecx
mov byte [eax + edx], cl
inc esi
inc dword [ebp - 0x14]
cmp esi, dword [ebp + 0xc]
jb 0x41af45
push 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x18]
push edx
call sym.Cari___.exe__Writememory
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
call sub.KERNEL32.DLL_GlobalFree
cmp dword [ebp - 0x1c], 3
jne 0x41b405
mov esi, dword [0x4d7db0]
test esi, esi
je 0x41b405
cmp dword [ebp - 0xc], 0
je 0x41b3e1
call fcn.00419034
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x41b3fa
mov edx, dword [esi + 0xc]
push edx
call sub.KERNEL32.DLL_ResumeThread
inc dword [ebp - 4]
add esi, 0x66c
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x4d7d98]
jl 0x41b3e8
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
mov dword [0x4d5a5c], eax
je 0x41b440
cmp dword [0x4d5a5c], 3
jne 0x41b440
push 1
call sym.Cari___.exe__Suspendprocess
pop ecx
cmp dword [0x4de924], 0
je 0x41b432
call fcn.00497bb0
cmp dword [0x4e2f10], 0
je 0x41b440
call fcn.0049cd88
mov edx, dword [ebp - 0x20]
push edx
call sub.USER32.DLL_SetCursor
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret