Function at 0x403740
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file size
Get graphical window text
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
call sym._DoCloseFile
test eax, eax
jne 0x403760
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call sym.unk_128
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x403a90
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.unk_203
sub esp, 8
mov edx, eax
cmp eax, 0xffffffff
je 0x403a70
lea eax, [eax + 2]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_180
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x403a70
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.unk_115
sub esp, 0x14
mov dword [esp], esi
test eax, eax
je 0x403a40
call sym.unk_161
mov esi, dword [ebp - 0x28]
sub esp, 4
cmp dword [ebp + 0xc], 0xffffffff
je 0x403be0
cmp esi, 1
jbe 0x403ac0
mov eax, dword [ebp + 0xc]
sub eax, 1
cmp eax, 1
jbe 0x403b00
cmp dword [ebp + 0xc], 3
mov edx, 0xfde9
mov eax, 0
cmove eax, edx
mov ecx, eax
mov dword [esp], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x34], ecx
mov edi, dword fs:[0x18]
call sym.unk_122
sub esp, 0x18
mov edx, eax
lea eax, [eax + eax + 2]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x30], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_180
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x403c84
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov dword [ebp - 0x30], edx
call sym.unk_122
sub esp, 0x18
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
lea edi, [ebp - 0x24]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
mov edx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
sub esp, 0xc
mov esi, edx
lea ecx, [ebx + esi*2]
test edx, edx
jle 0x403c50
mov eax, ebx
lea edx, [ebx + edx*2]
lea esi, [esi]
nop
cmp word [eax], 0
jne 0x40394e
mov esi, 0x20
mov word [eax], si
add eax, 2
cmp eax, edx
jne 0x403940
xor edx, edx
mov word [ecx], dx
cmp word [ebx], 0xfeff
je 0x403c30
mov eax, dword [0x40a40c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.unk_130
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
mov eax, dword [0x40a40c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call sym.unk_96
mov eax, dword [0x40a40c]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
mov dword [esp], eax
call sym.unk_96
mov eax, dword [0x40a40c]
sub esp, 0x10
mov dword [esp], eax
call sym.unk_118
mov eax, dword [0x40a40c]
sub esp, 4
mov dword [esp + 8], 5
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.unk_160
sub esp, 0xc
test eax, eax
jne 0x403b30
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.SetFileNameAndEncoding
call dbg.UpdateWindowCaption
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.unk_161
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
sub esp, 0xc
call dbg.ShowLastError
jmp 0x403752
mov dword [esp], esi
call sym.unk_161
sub esp, 4
call dbg.ShowLastError
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x30
mov dword [esp + 4], 0x17b
mov dword [esp + 8], eax
mov dword [esp], 0
call dbg.DIALOG_StringMsgBox
jmp 0x403752
cmp dword [ebp + 0xc], 1
je 0x403b24
cmp dword [ebp + 0xc], 2
jne 0x403858
lea edi, [ebp - 0x24]
shr esi, 1
je 0x403aec
xor eax, eax
lea esi, [esi]
rol word [ebx + eax*2], 8
add eax, 1
cmp eax, esi
jb 0x403ae0
mov edx, esi
mov dword [ebp + 0xc], 1
jmp 0x403928
movzx eax, byte [ebx]
cmp al, 0xff
je 0x403c5a
cmp al, 0xfe
je 0x403c75
cmp dword [ebp + 0xc], 2
jne 0x403c64
shr esi, 1
lea edi, [ebp - 0x24]
jmp 0x403ad7
xor esi, esi
lea edi, [ebp - 0x24]
jmp 0x403aec
mov dword [esp + 4], str..LOG
mov dword [esp], edi
call sym.unk_201
sub esp, 8
test eax, eax
jne 0x403a20
mov eax, dword [0x40a40c]
mov dword [esp], eax
call sym.unk_136
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [0x40a40c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0xb1
mov dword [esp], eax
call sym.unk_96
mov eax, dword [0x40a40c]
sub esp, 0x10
mov dword [esp + 0xc], 0x40913c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov dword [esp], eax
call sym.unk_96
sub esp, 0x10
call dbg.DIALOG_EditTimeDate
mov eax, dword [0x40a40c]
mov dword [esp + 0xc], 0x40913c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov dword [esp], eax
call sym.unk_96
sub esp, 0x10
jmp 0x403a20
cmp esi, 2
jbe 0x403bf5
movzx eax, word [0x409136]
cmp word [ebx], ax
je 0x403cab
lea edi, [ebp - 0x24]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [ebp - 0x24], 0x288
call sym.unk_157
mov eax, dword [ebp - 0x24]
sub esp, 0xc
test al, 8
jne 0x403c6e
and eax, 0x80
mov dword [ebp + 0xc], eax
jne 0x403ad3
xor ecx, ecx
jmp 0x40386b
lea eax, [ebx + 2]
mov dword [esp + 4], eax
mov eax, dword [0x40a40c]
mov dword [esp], eax
call sym.unk_130
sub esp, 8
jmp 0x403979
xor eax, eax
mov word [ecx], ax
jmp 0x403965
cmp byte [ebx + 1], 0xfe
jne 0x403b13
shr esi, 1
lea edi, [ebp - 0x24]
jmp 0x403aec
shr esi, 1
jmp 0x403aec
cmp byte [ebx + 1], 0xff
jne 0x403b13
jmp 0x403b1d
call dbg.ShowLastError
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
sub esp, 0xc
jmp 0x403752
movzx eax, byte [0x409138]
cmp byte [ebx + 2], al
jne 0x403bf5
mov ecx, 0xfde9
mov dword [ebp + 0xc], 3
jmp 0x40386b