Function at 0x4a1fe0
Capabilities:
Create thread
Inspect section memory permissions
Read file on windows

Disassembly:
mov eax, dword [0x7de400]
sub esp, 0xb8
mov ecx, DirectSoundCreate
push ebx
push ebp
push esi
push edi
test ecx, eax
jne 0x4a2005
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov edx, dword [esp + 0xd0]
test edx, edx
jne 0x4a201d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov eax, dword [esp + 0xcc]
test eax, eax
jl 0x4a2030
cmp eax, dword [0x7de404]
jl 0x4a203d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov esi, eax
shl esi, 4
add esi, eax
mov eax, dword [0x7de3f0]
shl esi, 2
lea edi, [esi + eax]
mov eax, dword [esi + eax + 0x40]
test ecx, eax
je 0x4a2064
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov ecx, 0x11
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.004aa950
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
jne 0x4a208a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov ecx, dword [0x7de3f0]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x20]
lea ebx, [esi + ecx + 0x3c]
push 4
push eax
push edi
mov dword [ebx], 0
call ebp
test eax, eax
je 0x4a2551
mov eax, dword [esp + 0x10]
mov ecx, 4
cmp eax, ecx
jne 0x4a2551
mov eax, dword [ebx]
add eax, ecx
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x46464952
jg 0x4a2186
je 0x4a2167
cmp eax, 0x20746d66
je 0x4a20fc
cmp eax, 0x45564157
jne 0x4a218d
jmp 0x4a21c2
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x4a2551
mov eax, dword [esp + 0x14]
mov edx, dword [ebx]
push 0
lea ecx, [eax + 4]
add edx, ecx
cmp eax, 0x12
mov dword [ebx], edx
lea edx, [esp + 0x14]
push edx
jbe 0x4a2154
lea eax, [esp + 0x28]
push 0x12
push eax
push edi
call ebp
test eax, eax
je 0x4a2551
mov ecx, dword [esp + 0x14]
push 1
add ecx, 0xffffffee
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4a21c2
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
test eax, eax
je 0x4a2551
jmp 0x4a21c2
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x4a2551
mov eax, dword [ebx]
add eax, 4
jmp 0x4a21c0
cmp eax, 0x61746164
je 0x4a21e0
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x4a2551
mov ecx, dword [esp + 0x14]
push 1
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x14]
mov eax, dword [ebx]
add edx, 4
add eax, edx
mov dword [ebx], eax
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push edi
call ebp
test eax, eax
jne 0x4a20b9
jmp 0x4a2551
mov eax, dword [0x7de3f0]
mov edx, dword [esi + eax + 0x3c]
add edx, ecx
mov dword [esi + eax + 0x3c], edx
cmp word [esp + 0x2e], cx
jne 0x4a2200
mov eax, dword [0x7de3f0]
or dword [esi + eax + 0x40], 2
cmp word [esp + 0x2e], 8
jne 0x4a2216
mov edx, dword [0x7de3f0]
mov dword [esi + edx + 0x40], 1
lea eax, [esp + 0x60]
push 0
push eax
push ecx
lea ecx, [esp + 0x28]
push ecx
push edi
call ebp
test eax, eax
je 0x4a2551
mov ebx, dword [esp + 0xd4]
mov eax, ebx
and eax, 1
mov dword [esp + 0x18], eax
je 0x4a23aa
mov edx, dword [esp + 0x28]
mov eax, 0x10624dd3
imul edx, dword [esp + 0xd8]
mul edx
shr edx, 6
test dl, 0x3f
je 0x4a2265
add edx, 0x40
and edx, 0xffffffc0
mov eax, dword [0x7de3f0]
and ebx, 2
mov ebp, dword [esp + 0xcc]
lea ecx, [esp + 0x20]
mov dword [esi + eax + 0x34], edx
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0x1ffb0
add eax, 0x181e0
or al, 8
push eax
push edx
push ecx
push ebp
call fcn.004a25f0
add esp, 0x10
test eax, eax
je 0x4a2551
mov edx, dword [0x7de3f0]
mov eax, dword [esi + edx + 0x34]
push eax
push 0
push ebp
push edi
call fcn.004a1d60
add esp, 0x10
test eax, eax
je 0x4a253e
mov ecx, dword [0x7de3f0]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [esi + ecx + 0xc], edi
mov edx, dword [0x7de3f0]
push 1
push 0
mov dword [esi + edx + 0x38], 0
call ebp
mov ecx, dword [0x7de3f0]
mov dword [esi + ecx + 0x10], eax
mov edx, dword [0x7de3f0]
mov eax, dword [esi + edx + 0x10]
test eax, eax
je 0x4a253e
push 0
push 0
push 0
push 0
call ebp
mov ecx, dword [0x7de3f0]
mov dword [esi + ecx + 0x14], eax
mov ecx, dword [0x7de3f0]
mov eax, dword [esi + ecx + 0x14]
test eax, eax
je 0x4a252a
mov eax, dword [esi + ecx]
lea ecx, [esi + ecx + 8]
push ecx
push 0x56fff8
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x4a2515
mov eax, dword [0x7de3f0]
mov edx, dword [esi + eax + 0x34]
shr edx, 1
mov dword [esp + 0x34], edx
mov ecx, dword [esi + eax + 0x10]
mov dword [esp + 0x38], ecx
mov edx, dword [esi + eax + 0x34]
sub edx, 2
mov dword [esp + 0x3c], edx
mov ecx, dword [esi + eax + 0x10]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 0xffffffff
mov edx, dword [esi + eax + 0x14]
mov dword [esp + 0x48], edx
mov eax, dword [esi + eax + 8]
lea edx, [esp + 0x34]
mov ecx, dword [eax]
push edx
push 3
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x4a2500
mov eax, dword [0x7de3f0]
lea ecx, [esi + eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x4a2400
and ebx, 2
mov ecx, dword [esp + 0x1c]
mov eax, ebx
lea edx, [esp + 0x20]
neg eax
sbb eax, eax
mov ebp, ecx
and eax, 0x1ffd0
add eax, 0x80e0
or al, 2
push eax
mov eax, dword [esp + 0xd0]
push ecx
push edx
push eax
call fcn.004a25f0
add esp, 0x10
test eax, eax
je 0x4a2551
mov ecx, dword [esp + 0xcc]
push ebp
push 0
push ecx
push edi
call fcn.004a1d60
add esp, 0x10
test eax, eax
je 0x4a253e
test ebx, ebx
je 0x4a2424
mov ecx, dword [0x7de3f0]
mov eax, dword [esi + ecx]
lea ecx, [esi + ecx + 4]
push ecx
push 0x570008
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jne 0x4a253e
mov cl, byte [esp + 0xd4]
test cl, 0x10
je 0x4a243d
mov eax, dword [0x7de3f0]
or dword [esi + eax + 0x40], 0x2000000
test cl, 0x20
je 0x4a244f
mov eax, dword [0x7de3f0]
or dword [esi + eax + 0x40], 0x4000000
test cl, 0x40
je 0x4a2461
mov eax, dword [0x7de3f0]
or dword [esi + eax + 0x40], 0x1000000
mov eax, dword [0x7de3f0]
mov ecx, dword [esi + eax + 0x40]
or ecx, 0x80010000
mov dword [esi + eax + 0x40], ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4a2489
mov eax, dword [0x7de3f0]
or dword [esi + eax + 0x40], 0x40000000
test ebx, ebx
je 0x4a249a
mov eax, dword [0x7de3f0]
or dword [esi + eax + 0x40], 0x20000000
test ecx, ecx
je 0x4a2579
mov edx, dword [0x7de3f0]
push 0xac440
push 4
mov eax, dword [esi + edx + 0xc]
push eax
call fcn.004aa9a0
mov edx, dword [esp + 0xd8]
add esp, 0xc
lea ecx, [esp + 0x64]
push ecx
push 0
push edx
push 0x4a2730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x7de3f0]
mov dword [esi + ecx + 0x30], eax
mov eax, dword [0x7de3f0]
mov ecx, dword [esi + eax + 0x30]
test ecx, ecx
jne 0x4a2585
lea edx, [esi + eax + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esp + 0x34]
test eax, eax
je 0x4a2515
lea ecx, [esp + 0x34]
push ecx
call fcn.004ab2cf
add esp, 4
mov edx, dword [0x7de3f0]
mov eax, dword [esi + edx + 0x14]
test eax, eax
je 0x4a252a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x7de3f0]
mov eax, dword [esi + eax + 0x10]
test eax, eax
je 0x4a253e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x7de3f0]
mov eax, dword [esi + ecx]
test eax, eax
je 0x4a2551
mov edx, dword [eax]
push eax
call dword [edx + 8]
test edi, edi
je 0x4a255c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x7de3f0]
mov ecx, 0x11
xor eax, eax
lea edi, [esi + edx]
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb8
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x7de3f0]
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x4c], 0x14
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov esi, dword [esi + eax]
lea eax, [esp + 0x4c]
mov edx, dword [esi]
push eax
push esi
call dword [edx + 0xc]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x68]
lea edx, [esp + 0x68]
rep stosd dword es:[edi], eax
mov eax, dword [0x7de3e4]
mov dword [esp + 0x68], 0x60
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb8
ret