Function at 0x403590
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file size
Get graphical window text
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov edi, eax
call dbg.DoCloseFile
test eax, eax
jne 0x4035b8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x4038f0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov ecx, eax
cmp eax, 0xffffffff
je 0x403920
lea eax, [eax + 2]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x34], edx
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x38], eax
call eax
mov ecx, dword [ebp - 0x30]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x403920
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
mov dword [esp], ebx
test eax, eax
je 0x4038b0
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x28]
sub esp, 4
cmp esi, 0xffffffff
je 0x403a18
cmp ebx, 1
jbe 0x4039e8
lea eax, [esi - 1]
cmp eax, 1
jbe 0x403a70
cmp esi, 3
mov ecx, 0xfde9
mov eax, 0
cmove eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [ebp - 0x3c], eax
call eax
sub esp, 0x18
mov ecx, eax
lea eax, [eax + eax + 2]
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x40], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x34], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
call eax
mov ecx, dword [ebp - 0x40]
sub esp, 0xc
test eax, eax
je 0x403b21
mov dword [esp + 0x10], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], ecx
mov dword [ebp - 0x40], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], 0
call eax
mov eax, dword [ebp - 0x34]
sub esp, 0x18
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x34], eax
call eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
sub esp, 0xc
mov ebx, ecx
lea ebx, [edi + ebx*2]
test ecx, ecx
jle 0x403ad0
mov eax, edi
lea ecx, [edi + ecx*2]
lea esi, [esi]
cmp word [eax], 0
jne 0x4037b6
mov edx, 0x20
mov word [eax], dx
add eax, 2
cmp eax, ecx
jne 0x4037a8
xor edx, edx
mov eax, dword [0x40b02c]
mov word [ebx], dx
cmp word [edi], 0xfeff
je 0x403aa8
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
call eax
mov eax, dword [0x40b02c]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call ebx
mov eax, dword [0x40b02c]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
mov dword [esp], eax
call ebx
mov eax, dword [0x40b02c]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [0x40b02c]
mov dword [esp + 8], 5
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
test eax, eax
jne 0x403940
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._SetFileNameAndEncoding
call dbg.UpdateWindowCaption
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call dbg.ShowLastError
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0x30
mov dword [esp + 4], 0x17b
mov dword [esp + 8], eax
mov dword [esp], 0
call dbg.DIALOG_StringMsgBox
jmp 0x4035ad
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.ShowLastError
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], str..LOG
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40388e
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [0x40b02c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0xb1
mov dword [esp], eax
call ebx
mov eax, dword [0x40b02c]
sub esp, 0x10
mov dword [esp + 0xc], 0x40917c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov dword [esp], eax
call ebx
sub esp, 0x10
call dbg.DIALOG_EditTimeDate
mov eax, dword [0x40b02c]
mov dword [esp + 0xc], 0x40917c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x40388e
cmp esi, 1
je 0x4039f6
cmp esi, 2
jne 0x4036b5
lea eax, [ebp - 0x24]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, ebx
mov esi, 1
mov dword [ebp - 0x34], eax
jmp 0x403795
cmp ebx, 2
jbe 0x403a28
cmp word [edi], 0xbbef
je 0x403b06
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x288
mov dword [ebp - 0x30], eax
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.advapi32.dll_IsTextUnicode]
mov esi, dword [ebp - 0x24]
sub esp, 0xc
test esi, 8
jne 0x403ac0
and esi, 0x80
jne 0x403a86
mov dword [ebp - 0x30], 0
jmp 0x4036c8
movzx eax, byte [edi]
cmp al, 0xff
je 0x403adf
cmp al, 0xfe
je 0x403af2
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
cmp esi, 1
je 0x403ac0
shr ebx, 1
je 0x4039fe
xor eax, eax
rol word [edi + eax*2], 8
add eax, 1
cmp eax, ebx
jb 0x403a90
jmp 0x4039fe
lea ecx, [edi + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
jmp 0x4037e2
shr ebx, 1
jmp 0x4039fe
xor eax, eax
mov word [ebx], ax
mov eax, dword [0x40b02c]
jmp 0x4037d2
cmp byte [edi + 1], 0xfe
jne 0x403a7b
lea eax, [ebp - 0x24]
shr ebx, 1
mov dword [ebp - 0x30], eax
jmp 0x4039fe
cmp byte [edi + 1], 0xff
jne 0x403a7b
lea eax, [ebp - 0x24]
shr ebx, 1
mov dword [ebp - 0x30], eax
jmp 0x403a8e
cmp byte [edi + 2], 0xbf
jne 0x403a28
mov dword [ebp - 0x30], 0xfde9
mov esi, 3
jmp 0x4036c8
call dbg.ShowLastError
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4035ad