Function at 0x406370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x4a99c8]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb4]
push ebp
mov ebp, dword [esp + 0x8c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xbc]
push esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc4]
push edi
mov edi, dword [esp + 0xd8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xd0]
mov esi, dword [edi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x24], eax
test esi, esi
je 0x406a25
push 0
call fcn.00424ac8
push edx
push eax
push 0x50
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.004135d0
push str.Analysis
push 0x440bbc
push esi
call fcn.0041a180
push dword [ebx + 0xf8]
push 0x441778
push str.__20s__s
push esi
call fcn.0041a710
push dword [ebx + 0xfc]
push str.Comment
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x44
lea eax, [esp + 0x38]
push eax
push str.Time
push str.__20s__s
push esi
call fcn.0041a710
mov ecx, dword [esp + 0xa8]
mov edx, 0x10b
mov eax, str.PE64
cmp word [ecx], dx
mov edx, 0x44108c
cmove eax, edx
push eax
push str.Type
push str.__20s__s
push esi
call fcn.0041a710
push ebp
call fcn.004038d0
test eax, eax
mov edx, 0x441794
mov ecx, 0x440e30
cmove ecx, edx
push ecx
push str.PEType
push str.__20s__s
push esi
call fcn.0041a710
push dword [edi]
call fcn.00403800
push eax
push str.File
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x48
push dword [ebx + 0x60]
push str.Size
push str.__20s__d
push esi
call fcn.0041a710
add esp, 0x10
cmp dword [ebx + 0x84], 0
je 0x406500
lea eax, [edi + 0x5fffb8]
push eax
push 0x4413a0
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x10
cmp dword [ebx + 0x8c], 0
je 0x406523
lea eax, [edi + 0x6001b8]
push eax
push str.SHA256
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x10
cmp dword [ebx + 0x150], 0
je 0x40654f
movsd xmm0, qword [edi + 0x5fffb0]
sub esp, 8
movsd qword [esp], xmm0
push str.FileEntropy
push str.__20s__g
push esi
call fcn.0041a710
add esp, 0x14
mov eax, dword [edi + 0x6002b8]
test eax, eax
je 0x40656d
push eax
push str.PackerID
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x10
push dword [esp + 0xa4]
push str.AnomalyScore
push str.__20s__d
push esi
call fcn.0041a710
push dword [esp + 0xb8]
push str.PackerScore
push str.__20s__d
push esi
call fcn.0041a710
push dword [esp + 0xcc]
push str.SuspicousScore
push str.__20s__d
push esi
call fcn.0041a710
add esp, 0x30
cmp dword [ebx + 0x204], 4
jl 0x40668d
mov edi, dword [esp + 0x20]
test edi, edi
je 0x40668d
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x40668d
mov eax, dword [edi + 8]
test eax, eax
jle 0x4065f8
movd xmm1, dword [ebp + 0x50]
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
jmp 0x4065fb
xorps xmm1, xmm1
sub esp, 8
movsd qword [esp], xmm1
push str.VDACallRatio
push str.__20s__g
push esi
call fcn.0041a710
push dword [edi + 8]
push str.VDAImportRefs
push str.__20s__d
push esi
call fcn.0041a710
push dword [ebp + 0x50]
push str.VDACodeRefs
push str.__20s__d
push esi
call fcn.0041a710
mov ecx, dword [ebp + 0x60]
add esp, 0x34
test ecx, ecx
je 0x40668d
mov eax, dword [ebp + 0x64]
sub esp, 8
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x441a00]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x441a00]
divsd xmm1, xmm0
movsd qword [esp], xmm1
push str.VDACoverage
push str.__20s__g
push esi
call fcn.0041a710
add esp, 0x14
push dword [esp + 0xa0]
lea eax, [esp + 0x3c]
push dword [esp + 0xa0]
push str._llx
push 0x50
push eax
call fcn.00401010
lea eax, [esp + 0x4c]
push eax
push str.FeatureBits
push str.__20s__s
push esi
call fcn.0041a710
mov ebp, dword [esp + 0x48]
add esp, 0x24
test ebp, ebp
je 0x406768
push str.Capabilities
push esi
call fcn.0041a220
lea eax, [esp + 0x38]
push eax
push dword [ebp + 4]
call fcn.00414160
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40675f
mov ecx, dword [edi + 8]
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x406749
push eax
push dword [edi + 4]
push str._s__Count_d
push esi
call fcn.0041a220
lea eax, [esp + 0x34]
push eax
push dword [edi + 8]
call fcn.00414160
add esp, 0x18
test eax, eax
je 0x406740
nop
push eax
push 0x440bbc
push esi
call fcn.0041a710
lea eax, [esp + 0x30]
push eax
push dword [edi + 8]
call fcn.00414250
add esp, 0x14
test eax, eax
jne 0x406720
push esi
call fcn.0041a5c0
add esp, 4
lea eax, [esp + 0x30]
push eax
push dword [ebp + 4]
call fcn.00414250
mov edi, eax
add esp, 8
test edi, edi
jne 0x4066f1
push esi
call fcn.0041a5c0
add esp, 4
cmp dword [ebx + 0x1fc], 0
je 0x4067de
push str.FeatureNames
push 0x440bbc
push esi
call fcn.0041a220
mov ebp, dword [esp + 0xac]
add esp, 0xc
xor edi, edi
nop dword [eax]
xor edx, edx
xor ecx, ecx
mov eax, edi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [esp + 0x9c]
and ecx, ebp
or edx, ecx
je 0x4067cf
push edi
call fcn.00408570
add esp, 4
test eax, eax
je 0x4067cf
push 0x440bbc
push esi
call fcn.0041a710
add esp, 8
inc edi
cmp edi, 0x40
jl 0x406790
push esi
call fcn.0041a5c0
add esp, 4
cmp dword [ebx + 0x200], 0
je 0x4068c4
movaps xmm5, xmmword [0x4419f0]
xor eax, eax
movups xmm6, xmmword [0x441a10]
mov ebp, dword [esp + 0x2c]
xorps xmm3, xmm3
xorps xmm4, xmm4
xorps xmm2, xmm2
nop dword [eax + eax]
movups xmm1, xmmword [ebp + eax*4]
movaps xmm0, xmm5
pcmpeqd xmm1, xmm4
paddd xmm0, xmm3
pandn xmm1, xmm6
pand xmm0, xmm1
pandn xmm1, xmm3
por xmm0, xmm1
movups xmm1, xmmword [ebp + eax*4 + 0x10]
add eax, 8
movaps xmm3, xmm0
movaps xmm0, xmm5
pcmpeqd xmm1, xmm4
paddd xmm0, xmm2
pandn xmm1, xmm6
pand xmm0, xmm1
pandn xmm1, xmm2
por xmm0, xmm1
movaps xmm2, xmm0
cmp eax, 0x40
jl 0x406810
paddd xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd eax, xmm2
push eax
push str.AnomalySummary
push str._s_Count_d
push esi
call fcn.0041a220
add esp, 0x10
xor edi, edi
mov eax, dword [ebp + edi*4]
test eax, eax
je 0x4068b5
push eax
push edi
call fcn.00408570
add esp, 4
push eax
push str.__20s___d_
push esi
call fcn.0041a710
add esp, 0x10
inc edi
cmp edi, 0x40
jl 0x406894
push esi
call fcn.0041a5c0
add esp, 4
cmp dword [ebx + 0x204], 4
jl 0x4069c2
cmp dword [ebx + 0x16c], 0
je 0x406936
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x406936
mov edx, dword [esp + 0x20]
add edx, 0x14
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4068f0
sub ecx, edi
je 0x40690f
push edx
push str.ImportHash
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x10
lea edx, [ebp + 0x14]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406917
sub ecx, edi
je 0x406936
push edx
push str.DelayHash
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x10
cmp dword [ebx + 0x17c], 0
je 0x40696f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40696f
lea edx, [eax + 0x14]
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406950
sub ecx, edi
je 0x40696f
push edx
push str.ExportHash
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x10
cmp dword [ebx + 0x1c0], 0
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
je 0x4069ca
test ebp, ebp
je 0x4069ca
test edi, edi
je 0x4069ca
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406990
sub ecx, edx
je 0x4069ca
push ebp
push str.VDAHash
push str.__20s__s
push esi
call fcn.0041a710
push edi
push str.VDAEntryHash
push str.__20s__s
push esi
call fcn.0041a710
add esp, 0x20
jmp 0x4069ca
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp dword [ebx + 0x204], 4
jl 0x406a25
cmp dword [ebx + 0x1b8], 0
je 0x406a25
cmp dword [ebx + 0x1c4], 0
je 0x406a25
cmp dword [ebp + 0x58], 0
je 0x406a05
mov eax, dword [esp + 0x98]
push str.VDACodeSequence
push dword [eax + 0x10]
push ebp
push ebx
push esi
call fcn.004079e0
add esp, 0x14
cmp dword [edi + 0x58], 0
je 0x406a25
mov eax, dword [esp + 0x98]
push str.VDAEntrySequence
push dword [eax + 0x10]
push edi
push ebx
push esi
call fcn.004079e0
add esp, 0x14
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c143
add esp, 0x7c
ret