Function at 0x4031f1
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x20646142
mov dword [ebp - 0x2c], 0x656c6966
mov dword [ebp - 0x28], 0x61656820
mov word [ebp - 0x24], 0x6564
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0
mov dword [ebp - 0x20], 0x6e6e6143
mov dword [ebp - 0x1c], 0x6f20746f
mov dword [ebp - 0x18], 0x206e6570
mov dword [ebp - 0x14], 0x656c6966
mov dword [ebp - 0x10], 0x726f6620
mov dword [ebp - 0xc], 0x61657220
mov dword [ebp - 8], 0x676e6964
mov byte [ebp - 4], 0x2e
mov byte [ebp - 3], 0
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
mov dword [0x401633], 0x4c
push dword [0x40101e]
pop dword [0x401637]
lea edx, str.Scratches_RES_file
mov dword [0x40163f], edx
mov dword [0x401653], 0x208
mov dword [0x40164f], 0x401747
push 0x401633
call dword [sym.imp.COMDLG32.DLL_GetOpenFileNameA]
cmp eax, 0
jbe 0x403521
push 0
push 0
push 0x1101
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push 0x401747
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x403501
push 0x401747
call 0x403358
dec esp
outsd dx, dword [esi]
popal
imul ebp, dword fs:[esi + 0x67], 0x7325203a
add byte [ebp - 0x4336b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x434]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0x40106e
push 0x14
push 0x40172f
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
call 0x4033bc
push ebx
inc ebx
jb 0x403410
popal
insd dword es:[edi], dx
and byte [edx + 0x65], dh
jae 0x403421
jne 0x403426
arpl word [ebp + 0x20], sp
imul bp, word [ebp], 0x2f68
pop ss
inc eax
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_lstrcmpA
cmp eax, 0
jne 0x4034dd
push 0x40172f
call 0x4033e5
dec eax
popal
jb 0x40341b
and byte [0x958d0073], ah
int3
inc eax
add byte [ebx - 0x7a72f33c], al
int3
inc eax
add bh, bh
adc eax, sym.imp.USER32.DLL_SendMessageA
push 0
push 0
push 0x100
add byte [eax], ch
add dword [eax], eax
add bh, bh
jne 0x4033f0
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
jb 0x403468
inc eax
add byte [edx], ch
push 0x40106e
push 4
push 0x401743
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x401743]
call 0x403460
dec esi
jne 0x4034bc
bound esp, qword [ebp + 0x72]
and byte [edi + 0x66], ch
and byte [esi + 0x69], ah
insb byte es:[edi], dx
jae 0x403496
and byte [0x958d0064], ah
int3
adc eax, sym.imp.USER32.DLL_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x434]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [0x401076], 0
jbe 0x4034a8
adc byte [eax], al
add byte [esi + 0xc], dh
push dword [0x401076]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
xor edx, edx
mov eax, 0x60
mov ecx, dword [0x401743]
mul ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x401076], eax
pop esi
inc eax
inc eax
add byte [ebx + 0x401076], ah
push 0
push 0
push dword [ebp - 0x34]
push 0x40357f
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x4034fd
lea eax, [ebp - 0x30]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
leave
ret
lea eax, [ebp - 0x20]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
leave
ret