Function at 0x403380
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file size
Get graphical window text
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
call dbg.DoCloseFile
test eax, eax
jne 0x4033a8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x4036f0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov ecx, eax
cmp eax, 0xffffffff
je 0x4036d8
lea eax, [eax + 2]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x34], edx
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x38], eax
call eax
mov ecx, dword [ebp - 0x30]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x4036d8
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
mov dword [esp], edi
test eax, eax
je 0x4036a0
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [ebp - 0x28]
sub esp, 4
cmp dword [ebp - 0x2c], 0xffffffff
je 0x403830
mov eax, dword [ebp - 0x2c]
cmp ecx, 1
jbe 0x403718
sub eax, 1
cmp eax, 1
jbe 0x403748
cmp dword [ebp - 0x2c], 3
mov edx, 0xfde9
mov eax, 0
cmove eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], ecx
mov dword [ebp - 0x3c], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x44], eax
call eax
sub esp, 0x18
mov edx, eax
lea eax, [eax + eax + 2]
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x40], edi
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x34], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
call eax
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x4038e2
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], edx
mov dword [ebp - 0x34], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], 0
call eax
mov eax, dword [ebp - 0x40]
sub esp, 0x18
mov dword [esp + 8], ebx
mov ebx, edi
lea edi, [ebp - 0x24]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x30], eax
call eax
mov edx, dword [ebp - 0x34]
sub esp, 0xc
mov ecx, edx
lea ecx, [ebx + ecx*2]
test edx, edx
jle 0x4038b0
mov eax, ebx
lea edx, [ebx + edx*2]
lea esi, [esi]
nop
cmp word [eax], 0
jne 0x4035ab
mov word [eax], 0x20
add eax, 2
cmp eax, edx
jne 0x4035a0
xor edx, edx
mov word [ecx], dx
cmp word [ebx], 0xfeff
je 0x403888
mov eax, dword [0x40a02c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._SetWindowTextW_8
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
mov eax, dword [0x40a02c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x40a02c]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x40a02c]
sub esp, 0x10
mov dword [esp], eax
call sym._SetFocus_4
mov eax, dword [0x40a02c]
sub esp, 4
mov dword [esp + 8], 5
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._GetWindowTextW_12
sub esp, 0xc
test eax, eax
jne 0x403780
mov eax, dword [ebp - 0x2c]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._SetFileNameAndEncoding
call dbg.UpdateWindowCaption
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call dbg.ShowLastError
jmp 0x40339b
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.ShowLastError
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], esi
mov dword [esp + 4], 0x17b
mov dword [esp], 0
call dbg.DIALOG_StringMsgBox
jmp 0x40339b
cmp eax, 1
je 0x403726
cmp eax, 2
jne 0x4034a9
xor ecx, ecx
lea edi, [ebp - 0x24]
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x2c], 1
mov edx, ecx
mov dword [ebp - 0x30], eax
jmp 0x40358b
movzx eax, byte [ebx]
cmp al, 0xff
je 0x4038ba
cmp al, 0xfe
je 0x4038ce
cmp dword [ebp - 0x2c], 1
lea edi, [ebp - 0x24]
je 0x4038a8
shr ecx, 1
je 0x40372b
xor eax, eax
nop
rol word [ebx + eax*2], 8
add eax, 1
cmp eax, ecx
jb 0x403770
jmp 0x40372b
mov dword [esp + 4], str..LOG
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40367d
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sym._GetWindowTextLengthW_4
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [0x40a02c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0xb1
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x40a02c]
sub esp, 0x10
mov dword [esp + 0xc], 0x40813c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
call dbg.DIALOG_EditTimeDate
mov eax, dword [0x40a02c]
mov dword [esp + 0xc], 0x40813c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x40367d
cmp ecx, 2
jbe 0x403840
cmp word [ebx], 0xbbef
je 0x40390d
lea edi, [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], 0x288
call sym._IsTextUnicode_12
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
test al, 8
jne 0x4038a8
and eax, 0x80
mov dword [ebp - 0x2c], eax
jne 0x403768
mov dword [ebp - 0x30], 0
jmp 0x4034bd
lea eax, [ebx + 2]
mov dword [esp + 4], eax
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sym._SetWindowTextW_8
sub esp, 8
jmp 0x4035d6
shr ecx, 1
jmp 0x40372b
xor eax, eax
mov word [ecx], ax
jmp 0x4035c2
cmp byte [ebx + 1], 0xfe
jne 0x40375b
shr ecx, 1
lea edi, [ebp - 0x24]
jmp 0x40372b
cmp byte [ebx + 1], 0xff
jne 0x40375b
shr ecx, 1
lea edi, [ebp - 0x24]
jmp 0x40376c
call dbg.ShowLastError
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x40339b
cmp byte [ebx + 2], 0xbf
jne 0x403840
mov dword [ebp - 0x30], 0xfde9
mov dword [ebp - 0x2c], 3
jmp 0x4034bd