Function at 0x403940
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get file size
Get graphical window text
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
mov esi, dword [edi]
mov eax, dword [edi + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
call sym._DoCloseFile
test eax, eax
jne 0x403978
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x403cb8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov ecx, eax
cmp eax, 0xffffffff
je 0x403ce0
lea eax, [eax + 2]
mov dword [ebp - 0x34], ecx
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x34]
sub esp, 0xc
test eax, eax
mov edx, eax
je 0x403ce0
lea eax, [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [ebp - 0x34], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, dword [ebp - 0x34]
sub esp, 0x14
test eax, eax
je 0x403c70
mov dword [ebp - 0x34], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
sub esp, 4
cmp dword [ebp - 0x2c], 0xffffffff
je 0x403dc8
cmp esi, 1
jbe 0x403da8
mov ebx, dword [ebp - 0x2c]
lea eax, [ebx - 1]
cmp eax, 1
jbe 0x403e40
cmp dword [ebp - 0x2c], 3
mov ecx, 0xfde9
je 0x403a8d
xor ecx, ecx
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [ebp - 0x40], edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
call eax
mov ebx, eax
sub esp, 0x18
mov eax, dword fs:[0x18]
mov dword [ebp - 0x34], eax
mov ecx, eax
lea eax, [ebx + ebx + 2]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x403fe5
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [ebp - 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x38]
call eax
mov edx, dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0x18
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
lea ecx, [ebp - 0x24]
mov eax, ebx
mov dword [ebp - 0x34], ecx
sub esp, 0xc
lea ecx, [edi + eax*2]
test ebx, ebx
jle 0x403e31
mov eax, edi
lea edx, [edi + ebx*2]
lea esi, [esi]
cmp word [eax], 0
jne 0x403b76
mov ebx, 0x20
mov word [eax], bx
add eax, 2
cmp eax, edx
jne 0x403b68
xor eax, eax
mov word [ecx], ax
cmp word [edi], 0xfeff
mov eax, dword [0x40c02c]
je 0x403f48
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov eax, dword [0x40c02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
mov eax, dword [0x40c02c]
mov dword [esp], eax
call ebx
mov eax, dword [0x40c02c]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
sub esp, 4
mov dword [esp + 8], 5
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x40c02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
test eax, eax
jne 0x403d00
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._SetFileNameAndEncoding
call sym._UpdateWindowCaption
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [ebp - 0x2c], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call sym._ShowLastError
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 0xc], 0x30
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], 0x17b
mov dword [esp + 8], eax
mov dword [esp], 0
call sym._DIALOG_StringMsgBox
jmp 0x403968
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
jmp sym._ShowLastError
mov dword [esp + 4], str..LOG
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x403c4b
mov eax, dword [0x40c02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
sub esp, 4
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb1
mov eax, dword [0x40c02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0x40a13c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov eax, dword [0x40c02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
call sym._DIALOG_EditTimeDate
mov dword [esp + 0xc], 0x40a13c
mov dword [esp + 8], 1
mov dword [esp + 4], 0xc2
mov eax, dword [0x40c02c]
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x403c4b
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 1
je 0x403e20
cmp eax, 2
jne 0x403a80
jmp 0x403e20
cmp esi, 2
jbe 0x403dd8
cmp word [edx], 0xbbef
je 0x403fc3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x288
mov dword [ebp - 0x34], eax
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [ebp - 0x2c], edx
call dword [sym.imp.advapi32.dll_IsTextUnicode]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
test al, 8
jne 0x403f9e
and eax, 0x80
mov dword [ebp - 0x2c], eax
je 0x403a8b
shr esi, 1
mov edi, esi
jne 0x403e66
nop
mov dword [ebp - 0x2c], 1
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, edx
mov edi, edx
xor edx, edx
mov eax, dword [0x40c02c]
mov word [ecx], dx
jmp 0x403b92
movzx eax, byte [edx]
cmp al, 0xff
je 0x403f60
cmp al, 0xfe
je 0x403fb8
cmp ebx, 1
je 0x403f7a
lea eax, [ebp - 0x24]
shr esi, 1
mov dword [ebp - 0x34], eax
mov edi, esi
lea eax, [edi - 1]
cmp eax, 6
jbe 0x403fde
mov ecx, edi
mov eax, edx
shr ecx, 3
shl ecx, 4
add ecx, edx
nop
movdqu xmm1, xmmword [eax]
movdqu xmm0, xmmword [eax]
add eax, 0x10
psllw xmm1, 8
psrlw xmm0, 8
por xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
cmp eax, ecx
jne 0x403e80
mov eax, edi
and eax, 0xfffffff8
test edi, 7
je 0x403f29
mov ecx, edi
sub ecx, eax
cmp ecx, 1
je 0x403f24
lea ebx, [edx + eax*2]
mov esi, ecx
movd xmm0, dword [ebx]
shr esi, 1
movdqu xmm1, xmm0
psllw xmm0, 8
psrlw xmm1, 8
por xmm0, xmm1
movd dword [ebx], xmm0
cmp esi, 1
je 0x403f1a
movd xmm0, dword [ebx + 4]
movdqu xmm1, xmm0
psllw xmm0, 8
psrlw xmm1, 8
por xmm0, xmm1
movd dword [ebx + 4], xmm0
cmp esi, 2
je 0x403f1a
movd xmm0, dword [ebx + 8]
movdqu xmm1, xmm0
psllw xmm0, 8
psrlw xmm1, 8
por xmm0, xmm1
movd dword [ebx + 8], xmm0
test cl, 1
je 0x403f29
and ecx, 0xfffffffe
add eax, ecx
rol word [edx + eax*2], 8
mov ebx, edi
lea ecx, [edx + edi*2]
mov edi, edx
mov dword [ebp - 0x2c], 1
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x403b5d
lea edx, [edi + 2]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.user32.dll_SetWindowTextW]
sub esp, 8
jmp 0x403ba2
cmp byte [edx + 1], 0xfe
je 0x403f7a
mov edi, esi
lea eax, [ebp - 0x24]
shr edi, 1
cmp dword [ebp - 0x2c], 1
mov dword [ebp - 0x34], eax
jne 0x403e66
mov ebx, esi
lea eax, [ebp - 0x24]
and esi, 0xfffffffe
mov dword [ebp - 0x2c], 1
lea ecx, [edx + esi]
mov dword [ebp - 0x34], eax
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
shr ebx, 1
mov edi, edx
jmp 0x403b5d
mov eax, esi
mov dword [ebp - 0x2c], 1
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov edi, edx
shr eax, 1
mov ebx, eax
jmp 0x403b52
cmp byte [edx + 1], 0xff
jne 0x403f66
jmp 0x403e5c
cmp byte [edx + 2], 0xbf
jne 0x403dd8
mov dword [ebp - 0x2c], 3
mov ecx, 0xfde9
jmp 0x403a8d
xor eax, eax
jmp 0x403eae
mov dword [ebp - 0x2c], edx
xor esi, esi
call sym._ShowLastError
mov edx, dword [ebp - 0x2c]
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x403968