Function at 0x4039a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], eax
push edi
test eax, eax
je 0x4039d1
mov byte [eax], 0
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x403be1
xorps xmm0, xmm0
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp - 0x28]
xor edi, edi
movups xmmword [eax], xmm0
push edi
movq qword [eax + 0x10], xmm0
mov eax, dword [ebp - 0xc]
mov esi, dword [esi]
push edi
push dword [eax + 4]
mov esi, dword [esi + 8]
mov ecx, esi
push dword [eax]
call dword [0x47d42c]
mov ecx, dword [ebp - 0x28]
call esi
test eax, eax
je 0x403a42
mov eax, dword [ebp - 0x28]
push edi
mov esi, dword [eax]
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [ebp - 0x14]
mov esi, dword [esi]
mov ecx, esi
call dword [0x47d42c]
mov ecx, dword [ebp - 0x28]
call esi
test eax, eax
jne 0x403a4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0x103
jne 0x403a84
push dword [ebp - 0x2c]
push str.DBG:_ReadCefDb2BlobHeader____read_pending_for___wZ__n
call fcn.00406c20
mov edi, dword [ebp - 0x28]
add esp, 8
mov eax, dword [edi]
push 0
push 0
push 1
mov esi, dword [eax + 0x10]
mov ecx, esi
push 1
call dword [0x47d42c]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x403a9a
mov esi, dword [ebp - 0x1c]
push esi
push dword [ebp - 0x14]
push ebx
call fcn.0042ebb0
add esp, 0xc
jmp 0x403a9c
xor esi, esi
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jne 0x403bb5
cmp esi, 0x18
jne 0x403bac
push 8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x78357475
push eax
push ebx
mov dword [ebp - 0x14], 0x35796466
mov dword [ebp - 0x10], 0x63347267
mov dword [ebp - 0xc], 0x31747831
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
mov esi, eax
lea ecx, [ebx + 0x10]
push 8
lea eax, [ebp - 0x10]
cmp esi, 8
push eax
push ecx
sete byte [ebp - 0x21]
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp eax, 8
sete al
cmp esi, 8
jne 0x403b48
test al, al
je 0x403b48
cmp dword [ebx + 8], edi
jne 0x403c15
cmp dword [ebx + 0xc], edi
jne 0x403c15
mov esi, dword [ebp - 0x2c]
push esi
push edi
push edi
push str.DBG:_ReadCefDb2BlobHeader____NULL_header__type_d__len_d___wZ___treating_as_truncated_n
call fcn.00406c20
push esi
push dword [ebx + 0xc]
push dword [ebx + 8]
push str.LOG:_CmgFFE_RCDH:_NULL_header__type_d__len_d___wZ___treating_as_truncated_n
call fcn.00406c20
add esp, 0x20
jmp 0x403b7c
push dword [ebp - 0x2c]
movzx edi, byte [ebp - 0x21]
movzx esi, al
push esi
push edi
push dword [ebx + 0xc]
push dword [ebx + 8]
push str.DBG:_ReadCefDb2BlobHeader:_Bad_header__type_d__len_d___d__d____wZ__n
call fcn.00406c20
push dword [ebp - 0x2c]
push esi
push edi
push dword [ebx + 0xc]
push dword [ebx + 8]
push str.LOG:_CmgFFE_RCDH:_Bad_header__type_d__len_d___d__d____wZ__n
call fcn.00406c20
add esp, 0x30
mov eax, dword [ebp - 0x30]
mov edi, 0x57
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
test eax, eax
je 0x403c15
mov byte [eax], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x403be6
lea edi, [esi + 0x26]
jmp 0x403c07
cmp edi, 0x26
je 0x403bfd
cmp edi, 0xc000000d
je 0x403bd2
cmp edi, 0x10dd
je 0x403bd2
cmp edi, 0x458
jne 0x403be6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
jne 0x403be9
lea edi, [eax + 0x26]
jmp 0x403c07
mov edi, 8
mov ecx, dword [ebp - 0xc]
push dword [ebp - 0x2c]
push dword [ecx]
push esi
push edi
push str.DBG:_ReadCefDb2BlobHeader____read_failed_status0x_08X__info_X__pos_d___wZ__n
call fcn.00406c20
add esp, 0x14
test edi, edi
mov eax, 0x26
cmove edi, eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret