Function at 0x480002
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, eax
mov ebx, edx
mov edi, dword [edx + 0x20]
cmp dword [edx + 0x14], 0
jne 0x480027
mov ecx, str.Node_has_no_parent_n
mov edx, 0x1395
call fcn.0047f78e
cmp dword [ebx + 0x20], 0
jne 0x480040
mov ecx, str.Node_has_no_doc_n
mov edx, 0x1396
mov eax, esi
call fcn.0047f78e
jmp 0x48006c
mov eax, dword [edi + 0x50]
test eax, eax
jne 0x48005a
cmp dword [esi + 0x84], 0
jne 0x48005a
mov dword [esi + 0x84], 1
cmp dword [esi + 0x70], 0
jne 0x480063
mov dword [esi + 0x70], edi
cmp dword [esi + 0x78], 0
jne 0x48006c
mov dword [esi + 0x78], eax
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4800a3
mov edx, dword [eax + 0x20]
cmp dword [ebx + 0x20], edx
je 0x4800a3
mov dword [esp + 4], str.pseudoroot
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x4800a3
mov ecx, str.Node_doc_differs_from_parents_one_n
mov edx, 0x1399
mov eax, esi
call fcn.0047f78e
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x4800d8
cmp dword [ebx + 4], 2
mov eax, dword [ebx + 0x14]
jne 0x4800c3
test eax, eax
je 0x4800ee
mov ecx, str.Attr_has_no_prev_and_not_first_of_attr_list_n
cmp ebx, dword [eax + 0x2c]
jne 0x4800d1
jmp 0x4800ee
test eax, eax
je 0x4800ee
cmp dword [eax + 0xc], ebx
je 0x4800ee
mov ecx, str.Node_has_no_prev_and_not_first_of_parent_list_n
mov edx, 0x139a
jmp 0x4800e7
cmp dword [eax + 0x18], ebx
je 0x4800ee
mov ecx, str.Node_prev__next_:_back_link_wrong_n
mov edx, 0x139b
mov eax, esi
call fcn.0047f78e
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x480119
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x48014b
cmp dword [ebx + 4], 2
je 0x48014b
cmp dword [eax + 0x10], ebx
je 0x48014b
cmp dword [eax + 4], 1
jne 0x48014b
mov ecx, str.Node_has_no_next_and_not_last_of_parent_list_n
mov edx, 0x139c
jmp 0x480144
cmp dword [eax + 0x1c], ebx
je 0x48012f
mov ecx, str.Node_next__prev_:_forward_link_wrong_n
mov edx, 0x139d
mov eax, esi
call fcn.0047f78e
mov eax, dword [ebx + 0x18]
mov edx, dword [ebx + 0x14]
cmp dword [eax + 0x14], edx
je 0x48014b
mov ecx, str.Node_next__prev_:_forward_link_wrong_n
mov edx, 0x13a5
mov eax, esi
call fcn.0047f78e
mov eax, dword [ebx + 4]
cmp eax, 1
jne 0x48016b
mov edi, dword [ebx + 0x30]
jmp 0x480165
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.0047fe5b
mov edi, dword [edi]
test edi, edi
jne 0x480158
jmp 0x480170
cmp eax, 2
jne 0x480180
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x480180
mov edx, ebx
mov eax, esi
call fcn.0047fe5b
mov eax, dword [ebx + 4]
lea edx, [eax - 1]
cmp edx, 1
jbe 0x4801d1
cmp eax, 0xf
je 0x4801d1
cmp eax, 0x10
je 0x4801d1
cmp eax, 0xe
je 0x4801d1
cmp eax, 0xd
je 0x4801d1
cmp eax, 9
je 0x4801d1
mov edi, dword [ebx + 0x28]
test edi, edi
je 0x4801d1
cmp dword [esi + 0x7c], 0
je 0x4801d1
mov dword [esp], edi
call sym.evasi0n_gui.exe_xmlCheckUTF8
test eax, eax
jne 0x4801d1
mov dword [esp], edi
mov ecx, str.String_is_not_UTF_8__s
mov edx, 0x13a8
mov eax, esi
call fcn.0047fb26
mov eax, dword [ebx + 4]
dec eax
cmp eax, 7
ja case.0x4801de.5
jmp dword [eax*4 + 0x66ebc0]
mov edi, dword [ebx + 8]
cmp edi, sym.evasi0n_gui.exe_xmlStringText
je case.0x4801de.5
cmp edi, sym.evasi0n_gui.exe_xmlStringTextNoenc
je case.0x4801de.5
mov eax, dword [esi + 0x78]
test eax, eax
je 0x48021b
mov dword [esp + 8], 7
mov dword [esp + 4], str.nbktext
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDictLookup
cmp edi, eax
je case.0x4801de.5
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov ecx, str.Text_node_has_wrong_name__s
jmp 0x48023a
mov eax, dword [ebx + 8]
cmp eax, sym.evasi0n_gui.exe_xmlStringComment
je case.0x4801de.5
mov dword [esp], eax
mov ecx, str.Comment_node_has_wrong_name__s
mov edx, 0x13ac
jmp 0x480266
mov edx, dword [ebx + 8]
mov eax, esi
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
jmp fcn.0047ff6d
mov eax, dword [ebx + 8]
test eax, eax
je case.0x4801de.5
mov dword [esp], eax
mov ecx, str.CData_section_has_non_NULL_name__s
mov edx, 0x13ad
mov eax, esi
call fcn.0047fb26
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret