Function at 0x4a3310
Capabilities:
Create thread
Inspect section memory permissions
Read file on windows

Disassembly:
mov eax, dword [0x7dc838]
sub esp, 0xb8
mov ecx, DirectSoundCreate
push ebx
push ebp
push esi
push edi
test ecx, eax
jne 0x4a3335
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov edx, dword [esp + 0xd0]
test edx, edx
jne 0x4a334d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov eax, dword [esp + 0xcc]
test eax, eax
jl 0x4a3360
cmp eax, dword [0x7dc83c]
jl 0x4a336d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov esi, eax
shl esi, 4
add esi, eax
mov eax, dword [0x7dc828]
shl esi, 2
lea edi, [esi + eax]
mov eax, dword [esi + eax + 0x40]
test ecx, eax
je 0x4a3394
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov ecx, 0x11
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.004a5e20
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
jne 0x4a33ba
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov ecx, dword [0x7dc828]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x20]
lea ebx, [esi + ecx + 0x3c]
push 4
push eax
push edi
mov dword [ebx], 0
call ebp
test eax, eax
je 0x4a3881
mov eax, dword [esp + 0x10]
mov ecx, 4
cmp eax, ecx
jne 0x4a3881
mov eax, dword [ebx]
add eax, ecx
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x46464952
jg 0x4a34b6
je 0x4a3497
cmp eax, 0x20746d66
je 0x4a342c
cmp eax, 0x45564157
jne 0x4a34bd
jmp 0x4a34f2
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x4a3881
mov eax, dword [esp + 0x14]
mov edx, dword [ebx]
push 0
lea ecx, [eax + 4]
add edx, ecx
cmp eax, 0x12
mov dword [ebx], edx
lea edx, [esp + 0x14]
push edx
jbe 0x4a3484
lea eax, [esp + 0x28]
push 0x12
push eax
push edi
call ebp
test eax, eax
je 0x4a3881
mov ecx, dword [esp + 0x14]
push 1
add ecx, 0xffffffee
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4a34f2
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
test eax, eax
je 0x4a3881
jmp 0x4a34f2
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x4a3881
mov eax, dword [ebx]
add eax, 4
jmp 0x4a34f0
cmp eax, 0x61746164
je 0x4a3510
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x4a3881
mov ecx, dword [esp + 0x14]
push 1
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x14]
mov eax, dword [ebx]
add edx, 4
add eax, edx
mov dword [ebx], eax
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push edi
call ebp
test eax, eax
jne 0x4a33e9
jmp 0x4a3881
mov eax, dword [0x7dc828]
mov edx, dword [esi + eax + 0x3c]
add edx, ecx
mov dword [esi + eax + 0x3c], edx
cmp word [esp + 0x2e], cx
jne 0x4a3530
mov eax, dword [0x7dc828]
or dword [esi + eax + 0x40], 2
cmp word [esp + 0x2e], 8
jne 0x4a3546
mov edx, dword [0x7dc828]
mov dword [esi + edx + 0x40], 1
lea eax, [esp + 0x60]
push 0
push eax
push ecx
lea ecx, [esp + 0x28]
push ecx
push edi
call ebp
test eax, eax
je 0x4a3881
mov ebx, dword [esp + 0xd4]
mov eax, ebx
and eax, 1
mov dword [esp + 0x18], eax
je 0x4a36da
mov edx, dword [esp + 0x28]
mov eax, 0x10624dd3
imul edx, dword [esp + 0xd8]
mul edx
shr edx, 6
test dl, 0x3f
je 0x4a3595
add edx, 0x40
and edx, 0xffffffc0
mov eax, dword [0x7dc828]
and ebx, 2
mov ebp, dword [esp + 0xcc]
lea ecx, [esp + 0x20]
mov dword [esi + eax + 0x34], edx
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0x1ffb0
add eax, 0x181e0
or al, 8
push eax
push edx
push ecx
push ebp
call fcn.004a3920
add esp, 0x10
test eax, eax
je 0x4a3881
mov edx, dword [0x7dc828]
mov eax, dword [esi + edx + 0x34]
push eax
push 0
push ebp
push edi
call fcn.004a3090
add esp, 0x10
test eax, eax
je 0x4a386e
mov ecx, dword [0x7dc828]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [esi + ecx + 0xc], edi
mov edx, dword [0x7dc828]
push 1
push 0
mov dword [esi + edx + 0x38], 0
call ebp
mov ecx, dword [0x7dc828]
mov dword [esi + ecx + 0x10], eax
mov edx, dword [0x7dc828]
mov eax, dword [esi + edx + 0x10]
test eax, eax
je 0x4a386e
push 0
push 0
push 0
push 0
call ebp
mov ecx, dword [0x7dc828]
mov dword [esi + ecx + 0x14], eax
mov ecx, dword [0x7dc828]
mov eax, dword [esi + ecx + 0x14]
test eax, eax
je 0x4a385a
mov eax, dword [esi + ecx]
lea ecx, [esi + ecx + 8]
push ecx
push 0x56ff80
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x4a3845
mov eax, dword [0x7dc828]
mov edx, dword [esi + eax + 0x34]
shr edx, 1
mov dword [esp + 0x34], edx
mov ecx, dword [esi + eax + 0x10]
mov dword [esp + 0x38], ecx
mov edx, dword [esi + eax + 0x34]
sub edx, 2
mov dword [esp + 0x3c], edx
mov ecx, dword [esi + eax + 0x10]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 0xffffffff
mov edx, dword [esi + eax + 0x14]
mov dword [esp + 0x48], edx
mov eax, dword [esi + eax + 8]
lea edx, [esp + 0x34]
mov ecx, dword [eax]
push edx
push 3
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4a3830
mov eax, dword [0x7dc828]
lea ecx, [esi + eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x4a3730
and ebx, 2
mov ecx, dword [esp + 0x1c]
mov eax, ebx
lea edx, [esp + 0x20]
neg eax
sbb eax, eax
mov ebp, ecx
and eax, 0x1ffd0
add eax, 0x80e0
or al, 2
push eax
mov eax, dword [esp + 0xd0]
push ecx
push edx
push eax
call fcn.004a3920
add esp, 0x10
test eax, eax
je 0x4a3881
mov ecx, dword [esp + 0xcc]
push ebp
push 0
push ecx
push edi
call fcn.004a3090
add esp, 0x10
test eax, eax
je 0x4a386e
test ebx, ebx
je 0x4a3754
mov ecx, dword [0x7dc828]
mov eax, dword [esi + ecx]
lea ecx, [esi + ecx + 4]
push ecx
push 0x56ff90
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x4a386e
mov cl, byte [esp + 0xd4]
test cl, 0x10
je 0x4a376d
mov eax, dword [0x7dc828]
or dword [esi + eax + 0x40], 0x2000000
test cl, 0x20
je 0x4a377f
mov eax, dword [0x7dc828]
or dword [esi + eax + 0x40], 0x4000000
test cl, 0x40
je 0x4a3791
mov eax, dword [0x7dc828]
or dword [esi + eax + 0x40], 0x1000000
mov eax, dword [0x7dc828]
mov ecx, dword [esi + eax + 0x40]
or ecx, 0x80010000
mov dword [esi + eax + 0x40], ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4a37b9
mov eax, dword [0x7dc828]
or dword [esi + eax + 0x40], 0x40000000
test ebx, ebx
je 0x4a37ca
mov eax, dword [0x7dc828]
or dword [esi + eax + 0x40], 0x20000000
test ecx, ecx
je 0x4a38a9
mov edx, dword [0x7dc828]
push 0xac440
push 4
mov eax, dword [esi + edx + 0xc]
push eax
call fcn.004a5e70
mov edx, dword [esp + 0xd8]
add esp, 0xc
lea ecx, [esp + 0x64]
push ecx
push 0
push edx
push 0x4a3a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x7dc828]
mov dword [esi + ecx + 0x30], eax
mov eax, dword [0x7dc828]
mov ecx, dword [esi + eax + 0x30]
test ecx, ecx
jne 0x4a38b5
lea edx, [esi + eax + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esp + 0x34]
test eax, eax
je 0x4a3845
lea ecx, [esp + 0x34]
push ecx
call fcn.004ac931
add esp, 4
mov edx, dword [0x7dc828]
mov eax, dword [esi + edx + 0x14]
test eax, eax
je 0x4a385a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x7dc828]
mov eax, dword [esi + eax + 0x10]
test eax, eax
je 0x4a386e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x7dc828]
mov eax, dword [esi + ecx]
test eax, eax
je 0x4a3881
mov edx, dword [eax]
push eax
call dword [edx + 8]
test edi, edi
je 0x4a388c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x7dc828]
mov ecx, 0x11
xor eax, eax
lea edi, [esi + edx]
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb8
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x7dc828]
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x4c], 0x14
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov esi, dword [esi + eax]
lea eax, [esp + 0x4c]
mov edx, dword [esi]
push eax
push esi
call dword [edx + 0xc]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x68]
lea edx, [esp + 0x68]
rep stosd dword es:[edi], eax
mov eax, dword [0x7dc81c]
mov dword [esp + 0x68], 0x60
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb8
ret