Function at 0x4034c0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file size
Get graphical window text
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov edi, eax
call dbg.DoCloseFile
test eax, eax
jne 0x4034e8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x403810
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov edx, eax
cmp eax, 0xffffffff
je 0x403840
lea eax, [eax + 2]
mov dword [ebp - 0x34], edx
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x38], eax
call eax
mov edx, dword [ebp - 0x34]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x30], eax
je 0x403840
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x30]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
mov dword [esp], ebx
test eax, eax
je 0x4037d0
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x28]
sub esp, 4
cmp esi, 0xffffffff
je 0x403940
cmp ebx, 1
jbe 0x403908
lea eax, [esi - 1]
cmp eax, 1
jbe 0x4039b0
xor ecx, ecx
cmp esi, 3
je 0x4039a0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x30]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 4], 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], eax
call eax
sub esp, 0x18
mov edx, eax
lea eax, [eax + eax + 2]
mov dword [ebp - 0x40], edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x34], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
call eax
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x403a99
mov dword [esp + 0x14], edx
mov dword [ebp - 0x38], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x30]
mov dword [esp], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x3c]
call eax
sub esp, 0x18
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
sub esp, 0xc
mov eax, edx
lea ecx, [edi + eax*2]
test edx, edx
jle 0x403a91
mov eax, edi
lea edx, [edi + edx*2]
nop
cmp word [eax], 0
jne 0x4036db
mov word [eax], 0x20
add eax, 2
cmp eax, edx
jne 0x4036d0
xor eax, eax
mov word [ecx], ax
cmp word [edi], 0xfeff
mov eax, dword [0x40b02c]
je 0x403a08
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
mov eax, dword [0x40b02c]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
sub esp, 4
mov dword [esp + 8], 5
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
test eax, eax
jne 0x403860
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._SetFileNameAndEncoding
call dbg.UpdateWindowCaption
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call dbg.ShowLastError
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x30
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 0x17b
mov dword [esp + 8], eax
mov dword [esp], 0
call dbg.DIALOG_StringMsgBox
jmp 0x4034dd
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.ShowLastError
mov dword [esp + 4], str..LOG
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x4037b0
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
sub esp, 4
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb1
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0x40913c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
call dbg.DIALOG_EditTimeDate
mov dword [esp + 0xc], 0x40913c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x4037b0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], eax
cmp esi, 1
je 0x40391c
cmp esi, 2
jne 0x4035e6
mov ecx, dword [ebp - 0x30]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, 1
xor edx, edx
mov edi, dword [ebp - 0x30]
mov eax, dword [0x40b02c]
mov word [ecx], dx
jmp 0x4036f7
cmp ebx, 2
jbe 0x40394f
mov eax, dword [ebp - 0x30]
cmp word [eax], 0xbbef
je 0x403992
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x288
mov dword [ebp - 0x34], eax
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_IsTextUnicode]
mov eax, dword [ebp - 0x24]
sub esp, 0xc
test al, 8
jne 0x403a5b
and eax, 0x80
mov esi, eax
jne 0x403a82
xor ecx, ecx
jmp 0x4035f1
cmp byte [eax + 2], 0xbf
jne 0x40394f
lea esi, [esi]
nop
mov ecx, 0xfde9
mov esi, 3
jmp 0x4035f1
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
cmp al, 0xff
je 0x403a20
cmp al, 0xfe
je 0x403a74
cmp esi, 1
je 0x403a38
lea eax, [ebp - 0x24]
shr ebx, 1
mov dword [ebp - 0x34], eax
mov edi, ebx
mov esi, dword [ebp - 0x30]
lea ecx, [edi + edi]
mov eax, esi
lea edx, [esi + ecx]
lea esi, [esi]
rol word [eax], 8
add eax, 2
cmp edx, eax
jne 0x4039e0
mov edx, edi
mov edi, dword [ebp - 0x30]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, 1
add ecx, edi
jmp 0x4036c9
lea edx, [edi + 2]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
jmp 0x403707
mov eax, dword [ebp - 0x30]
cmp byte [eax + 1], 0xfe
je 0x403a38
mov edi, ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], eax
shr edi, 1
cmp esi, 1
jne 0x4039d1
mov edi, dword [ebp - 0x30]
mov edx, ebx
lea eax, [ebp - 0x24]
and ebx, 0xfffffffe
mov dword [ebp - 0x34], eax
shr edx, 1
mov esi, 1
lea ecx, [edi + ebx]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4036c9
mov eax, ebx
mov edi, dword [ebp - 0x30]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, 1
shr eax, 1
mov edx, eax
jmp 0x4036be
mov eax, dword [ebp - 0x30]
cmp byte [eax + 1], 0xff
jne 0x403a29
jmp 0x4039c7
shr ebx, 1
mov edi, ebx
jne 0x4039d1
jmp 0x40391c
mov dword [ebp - 0x30], edi
jmp 0x40392a
call dbg.ShowLastError
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4034dd