Function at 0x461728
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff1e8
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
mov esi, dword [ebp + 0xc]
je 0x461743
cmp dword [ebp + 0x10], 0
jne 0x46174a
xor eax, eax
jmp 0x461a40
mov ecx, dword [ebp + 0x10]
mov edx, esi
add ecx, esi
and edx, 0xfffff000
dec ecx
and ecx, 0xfffff000
cmp edx, ecx
je 0x46179d
push esi
call sym.Cari___.exe__Findmemory
pop ecx
test eax, eax
je 0x46179d
mov edx, dword [eax]
add edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, esi
cmp edx, eax
jae 0x46179d
test byte [ebp + 0x14], 2
jne 0x461796
mov ecx, dword [ebp + 0x10]
add ecx, esi
dec ecx
push ecx
push esi
push 0x4bc483
call sym.Cari___.exe__Error
add esp, 0xc
xor eax, eax
jmp 0x461a40
xor edx, edx
mov dword [0x4d7c84], edx
cmp dword [0x4d5a5c], 3
jne 0x4617d4
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x4617d4
xor edi, edi
jmp 0x4617cc
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_SuspendThread
inc edi
add ebx, 0x66c
cmp edi, dword [0x4d7d98]
jl 0x4617bc
mov edx, dword [0x4d8134]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x4617fd
mov ecx, dword [ebp + 0x10]
add ecx, esi
cmp ecx, dword [0x4d8144]
jbe 0x4617fd
cmp esi, dword [0x4d8148]
jae 0x4617fd
call fcn.00418e24
test byte [ebp + 0x14], 1
je 0x461814
push 0
mov eax, dword [ebp + 0x10]
add eax, esi
push eax
push esi
call sym.Cari___.exe__Deletebreakpoints
add esp, 0xc
push 0
mov eax, dword [0x4d5a68]
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
push ecx
push esi
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x461931
cmp dword [0x4d5a14], 0
je 0x461931
cmp dword [0x4d5a18], 0
je 0x461931
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
xor edi, edi
lea ebx, [ebp - 0xe18]
jmp 0x4618cf
mov eax, edi
lea edx, [ebp - 0xe18]
shl eax, 3
push 0x1c
sub eax, edi
shl eax, 2
add eax, edx
push eax
mov eax, dword [0x4d5a68]
mov ecx, dword [ebp - 0xc]
push ecx
push eax
call dword [0x4d5a14]
test eax, eax
je 0x4618e1
mov edx, dword [ebx]
mov ecx, edx
add ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
add eax, esi
cmp eax, dword [ebp - 0x10]
jae 0x4618a9
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, edx
mov dword [ebx + 0xc], ecx
lea edx, [ebp - 0x14]
mov ecx, dword [0x4d5a68]
push edx
push 4
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
push edx
push ecx
call dword [0x4d5a18]
test eax, eax
je 0x4618e1
inc edi
add ebx, 0x1c
cmp edi, 0x80
jge 0x4618e1
mov eax, dword [ebp + 0x10]
add eax, esi
cmp eax, dword [ebp - 0x10]
ja 0x461861
push 0
mov eax, dword [0x4d5a68]
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
push ecx
push esi
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
dec edi
mov dword [ebp - 4], eax
mov edx, edi
shl edx, 3
sub edx, edi
test edi, edi
lea ebx, [ebp + edx*4 - 0xe18]
jl 0x461931
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebx + 0x14]
push edx
mov edx, dword [0x4d5a68]
mov ecx, dword [ebx + 0xc]
push ecx
mov eax, dword [ebx]
push eax
push edx
call dword [0x4d5a18]
dec edi
add ebx, 0xffffffe4
test edi, edi
jge 0x46190d
cmp dword [0x4d5a5c], 3
jne 0x461980
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x461980
cmp dword [ebp - 8], 0
je 0x461964
mov ecx, dword [ebp + 0x10]
add ecx, esi
cmp ecx, dword [0x4d8144]
jbe 0x461964
cmp esi, dword [0x4d8148]
jae 0x461964
call fcn.00419034
xor edi, edi
jmp 0x461978
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc edi
add ebx, 0x66c
cmp edi, dword [0x4d7d98]
jl 0x461968
cmp dword [ebp - 4], 0
jne 0x4619bc
test byte [ebp + 0x14], 2
jne 0x4619a1
mov edx, dword [ebp + 0x10]
add edx, esi
dec edx
push edx
push esi
push 0x4bc4cb
call sym.Cari___.exe__Error
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, esi
push ecx
push esi
push 0x475
call sym.Cari___.exe__Broadcast
add esp, 0xc
xor eax, eax
jmp 0x461a40
test byte [ebp + 0x14], 4
je 0x461a17
lea edx, [ebp - 0x18]
push edx
push esi
call sym.Cari___.exe__Finddecode
add esp, 8
mov ebx, eax
test eax, eax
je 0x461a06
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x10]
jbe 0x4619e3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
push eax
push 0
push ebx
call fcn.004a35a0
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, esi
push edx
push esi
push 0x474
call sym.Cari___.exe__Broadcast
add esp, 0xc
push 4
mov ecx, dword [ebp + 0x10]
add ecx, esi
push ecx
push esi
call sym.Cari___.exe__Modifyhittrace
add esp, 0xc
test byte [ebp + 0x14], 1
je 0x461a3d
push 0
push 0
call sym.Cari___.exe__Readcommand
add esp, 8
mov eax, dword [ebp + 0x10]
add eax, esi
push eax
push esi
push 0x475
call sym.Cari___.exe__Broadcast
add esp, 0xc
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret