Function at 0x4034d0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file size
Get graphical window text
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x48
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov edi, eax
call dbg.DoCloseFile
test eax, eax
jne 0x4034f8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x403838
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov ecx, eax
cmp eax, 0xffffffff
je 0x403860
lea eax, [eax + 2]
mov dword [ebp - 0x24], ecx
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x28], eax
call eax
mov ecx, dword [ebp - 0x24]
sub esp, 0xc
test eax, eax
mov edx, eax
je 0x403860
lea eax, [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [ebp - 0x24], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, dword [ebp - 0x24]
sub esp, 0x14
test eax, eax
je 0x4037f8
mov dword [ebp - 0x24], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub esp, 4
cmp esi, 0xffffffff
je 0x403940
cmp ebx, 1
jbe 0x403928
lea eax, [esi - 1]
cmp eax, 1
jbe 0x4039c0
mov dword [ebp - 0x24], 0xfde9
cmp esi, 3
je 0x403611
mov dword [ebp - 0x24], 0
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [ebp - 0x38], edx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x30], eax
call eax
sub esp, 0x18
mov ecx, eax
lea eax, [eax + eax + 2]
mov dword [ebp - 0x34], ecx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2c], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x403a9f
mov dword [esp + 0x14], ecx
mov dword [ebp - 0x34], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
mov dword [ebp - 0x28], edx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
mov edx, dword [ebp - 0x28]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0x18
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], eax
sub esp, 0xc
lea eax, [ecx + ecx]
lea edx, [edi + eax]
test ecx, ecx
jle 0x4039ad
mov eax, edi
lea ecx, [edi + ecx*2]
lea esi, [esi]
cmp word [eax], 0
jne 0x403703
mov word [eax], 0x20
add eax, 2
cmp ecx, eax
jne 0x4036f8
xor eax, eax
mov word [edx], ax
cmp word [edi], 0xfeff
mov eax, dword [0x40b02c]
je 0x403a20
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
mov eax, dword [0x40b02c]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
sub esp, 4
mov dword [esp + 8], 5
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
test eax, eax
jne 0x403880
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._SetFileNameAndEncoding
call dbg.UpdateWindowCaption
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x20], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
sub esp, 4
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call dbg.ShowLastError
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x30
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0x17b
mov dword [esp + 8], eax
mov dword [esp], 0
call dbg.DIALOG_StringMsgBox
jmp 0x4034ed
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.ShowLastError
mov dword [esp + 4], str..LOG
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x4037d8
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
sub esp, 4
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb1
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0x40913c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
call dbg.DIALOG_EditTimeDate
mov dword [esp + 0xc], 0x40913c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov eax, dword [0x40b02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x4037d8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], eax
cmp esi, 1
je 0x4039a0
cmp esi, 2
jne 0x4035fe
jmp 0x4039a0
cmp ebx, 2
jbe 0x403950
cmp word [edx], 0xbbef
je 0x403a84
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x288
mov dword [ebp - 0x24], eax
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [ebp - 0x2c], edx
call dword [sym.imp.advapi32.dll_IsTextUnicode]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
test esi, 8
jne 0x403a6e
and esi, 0x80
je 0x40360a
shr ebx, 1
mov edi, ebx
jne 0x4039de
lea esi, cs:[esi]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov edi, edx
mov esi, 1
xor ecx, ecx
mov eax, dword [0x40b02c]
mov word [edx], cx
jmp 0x40371f
movzx eax, byte [edx]
cmp al, 0xff
je 0x403a38
cmp al, 0xfe
je 0x403a79
cmp esi, 1
je 0x403a4d
lea eax, [ebp - 0x18]
shr ebx, 1
mov dword [ebp - 0x24], eax
mov edi, ebx
lea eax, [edi + edi]
mov ecx, edx
lea ebx, [edx + eax]
test al, 2
je 0x4039f8
lea ecx, [edx + 2]
rol word [edx], 8
cmp ecx, ebx
je 0x403a08
lea esi, [esi]
rol word [ecx], 8
rol word [ecx + 2], 8
add ecx, 4
cmp ecx, ebx
jne 0x4039f8
mov ecx, edi
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov edi, edx
mov esi, 1
jmp 0x4036e5
lea edx, [edi + 2]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
jmp 0x40372f
cmp byte [edx + 1], 0xfe
je 0x403a4d
mov edi, ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], eax
shr edi, 1
cmp esi, 1
jne 0x4039de
mov ecx, ebx
lea eax, [ebp - 0x18]
and ebx, 0xfffffffe
mov edi, edx
mov dword [ebp - 0x24], eax
add edx, ebx
shr ecx, 1
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, 1
jmp 0x4036f0
mov edi, ebx
mov eax, ebx
shr edi, 1
and eax, 0xfffffffe
jmp 0x403a08
cmp byte [edx + 1], 0xff
jne 0x403a3e
jmp 0x4039d4
cmp byte [edx + 2], 0xbf
jne 0x403950
mov dword [ebp - 0x24], 0xfde9
mov esi, 3
jmp 0x403611
mov dword [ebp - 0x20], edx
call dbg.ShowLastError
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4034ed