Function at 0x479add
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, eax
mov ebx, edx
test edx, edx
je 0x47a6f8
mov eax, dword [edx + 4]
cmp eax, 0xd
je 0x479aff
cmp eax, 9
jne 0x479b0f
mov edx, ebx
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.0047a789
cmp eax, 0x13
je 0x47a6f8
cmp eax, 0x14
je 0x47a6f8
cmp eax, 0xe
jne 0x479b34
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.0047b282
cmp eax, 0xb
jne 0x479b4a
mov edx, dword [edx + 0xc]
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.0047a700
mov esi, dword [edi + 0x18]
cmp eax, 0xf
jne 0x479b66
mov dword [esp + 4], edx
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDumpElementDecl
jmp 0x47a6f8
cmp eax, 0x10
jne 0x479b7f
mov dword [esp + 4], edx
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDumpAttributeDecl
jmp 0x47a6f8
cmp eax, 0x11
jne 0x479b98
mov dword [esp + 4], edx
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDumpEntityDecl
jmp 0x47a6f8
cmp eax, 3
jne 0x479be4
mov eax, dword [edx + 0x28]
test eax, eax
je 0x47a6f8
mov edx, dword [edx + 8]
cmp edx, sym.evasi0n_gui.exe_xmlStringText
je 0x479bbb
cmp edx, sym.evasi0n_gui.exe_xmlStringTextNoenc
je 0x479bd3
mov edx, dword [edi + 0x74]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteEscape
jmp 0x47a6f8
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
jmp 0x47a6f8
cmp eax, 7
jne 0x479c79
cmp dword [edx + 0x28], 0
je 0x479c3d
mov dword [esp + 8], 0x68a13f
mov dword [esp + 4], 2
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
cmp dword [ebx + 0x28], 0
je 0x479c64
mov dword [esp + 8], 0x689fb6
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x28]
jmp 0x479c58
mov dword [esp + 8], 0x68a13f
mov dword [esp + 4], 2
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a142
mov dword [esp + 4], 2
jmp 0x47a6df
cmp eax, 8
jne 0x479cbc
cmp dword [edx + 0x28], 0
je 0x47a6f8
mov dword [esp + 8], 0x68a145
mov dword [esp + 4], 4
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a14a
jmp 0x47a401
cmp eax, 5
jne 0x479cf5
mov dword [esp + 8], 0x68a134
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a136
jmp 0x47a6d7
cmp eax, 4
jne 0x479dbd
mov ebx, dword [edx + 0x28]
test ebx, ebx
je 0x479d0c
mov eax, ebx
cmp byte [ebx], 0
jne 0x479d7e
mov dword [esp + 8], str.___CDATA____
mov dword [esp + 4], 0xc
jmp 0x47a6df
cmp dl, 0x5d
jne 0x479d7d
cmp byte [eax + 1], 0x5d
jne 0x479d7d
lea edi, [eax + 2]
cmp byte [eax + 2], 0x3e
jne 0x479d7d
mov dword [esp + 8], str.___CDATA_
mov dword [esp + 4], 9
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], ebx
mov eax, edi
sub eax, ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x68a165
mov dword [esp + 4], 3
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov ebx, edi
mov eax, edi
inc eax
mov dl, byte [eax]
test dl, dl
jne 0x479d21
cmp ebx, eax
je 0x47a6f8
mov dword [esp + 8], str.___CDATA_
mov dword [esp + 4], 9
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a165
jmp 0x47a401
cmp eax, 2
jne 0x479dd0
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.00479a14
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
dec eax
jne 0x479dfb
mov eax, dword [edx + 0xc]
jmp 0x479dee
mov edx, dword [eax + 4]
cmp edx, 5
je 0x479df4
cmp edx, 3
je 0x479df4
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x479dde
jmp 0x479dfb
mov dword [ebp - 0x24], 0
mov dword [esp + 8], 0x68a169
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x479e45
mov eax, dword [eax + 0xc]
test eax, eax
je 0x479e45
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a138
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x479e77
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x18]
mov ecx, edi
mov edx, dword [ebp - 0x1c]
call fcn.00479148
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov dword [ebp - 0x1c], edx
test edx, edx
jne 0x479e5e
mov dword [esp + 4], 0x68a16b
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x479eaa
cmp dword [ebx + 0x24], 0
jne 0x479eaa
cmp dword [ebx + 0x30], 0
jne 0x479eaa
mov dword [esp + 4], str._xmlns_http:__www.w3.org_1999_xhtml_
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov ecx, dword [ebx + 0x2c]
test ecx, ecx
je 0x47a1dd
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x20], eax
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], esi
mov esi, ebx
mov ebx, ecx
cmp dword [ebx + 0x24], 0
jne 0x479f05
mov dword [esp + 4], 0x68a196
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479fcc
cmp dword [ebx + 0x24], 0
jne 0x479f26
mov dword [esp + 4], 0x68a199
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479fd1
cmp dword [ebx + 0x24], 0
jne 0x479f47
mov dword [esp + 4], 0x68a19e
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479fd6
cmp dword [ebx + 0x24], 0
je 0x479f7e
mov dword [esp + 4], 0x68a19e
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x479f7e
mov dword [esp + 4], 0x689fb2
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479fdb
cmp dword [ebx + 0x24], 0
jne 0x479fde
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x479f97
mov eax, dword [eax + 0x28]
test eax, eax
je 0x479f97
cmp byte [eax], 0
jne 0x479fde
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_htmlIsBooleanAttr
test eax, eax
je 0x479fde
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x479fb5
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlFreeNode
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlNewText
mov dword [ebx + 0xc], eax
test eax, eax
je 0x479fde
mov dword [eax + 0x14], ebx
jmp 0x479fde
mov dword [ebp - 0x34], ebx
jmp 0x479fde
mov dword [ebp - 0x30], ebx
jmp 0x479fde
mov dword [ebp - 0x2c], ebx
jmp 0x479fde
mov dword [ebp - 0x28], ebx
mov edx, ebx
mov eax, edi
call fcn.00479a14
mov ebx, dword [ebx + 0x18]
test ebx, ebx
jne 0x479ee4
mov ebx, esi
mov esi, dword [ebp - 0x38]
cmp dword [ebp - 0x34], 0
jne 0x47a15b
cmp dword [ebp - 0x30], 0
je 0x47a15b
cmp dword [ebp - 0x1c], 0
je 0x47a15b
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x47a15b
mov dword [esp + 4], 0x68a1a3
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], 0x68a1a5
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], 0x68a1a7
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], str.ERROR:_Unexpected_packet_number___lld____lld__aborting.
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], 0x68a1af
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], str.applet
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], 0x68a1ba
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], str.frame
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a117
mov dword [esp + 4], str.iframe
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x47a15b
mov dword [esp + 8], str._id_
mov dword [esp + 4], 5
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov edx, dword [ebp - 0x30]
call fcn.0047996b
mov dword [esp + 8], 0x68a13d
mov dword [esp + 4], 1
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [ebp - 0x28], 0
jne 0x47a18d
cmp dword [ebp - 0x2c], 0
je 0x47a18d
mov dword [esp + 8], str._xml:lang_
mov dword [esp + 4], 0xb
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov edx, dword [ebp - 0x2c]
jmp 0x47a1bd
cmp dword [ebp - 0x2c], 0
jne 0x47a1dd
cmp dword [ebp - 0x28], 0
je 0x47a1dd
mov dword [esp + 8], str._lang_
mov dword [esp + 4], 7
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov edx, dword [ebp - 0x28]
call fcn.0047996b
mov dword [esp + 8], 0x68a13d
mov dword [esp + 4], 1
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [ebp - 0x1c], 0
cmp dword [ebx + 4], 1
jne 0x47a2bf
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x47a2bf
mov edx, dword [ebx + 0x20]
cmp dword [eax + 0x14], edx
jne 0x47a2bf
mov dword [esp + 4], 0x68a1e6
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x47a2bf
mov dword [esp + 4], 0x68a16b
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x47a2bf
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x47a2b2
mov dword [esp + 4], 0x68a1eb
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x47a2a9
mov dword [esp + 4], 0x68a1f0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlGetProp
test eax, eax
je 0x47a2a9
mov dword [esp + 4], 0x68a1fb
mov dword [esp], eax
mov dword [ebp - 0x3c], eax
call sym.evasi0n_gui.exe_xmlStrcasecmp
test eax, eax
mov eax, dword [sym.evasi0n_gui.exe_xmlFree]
mov edx, dword [ebp - 0x3c]
jne 0x47a2a4
mov dword [esp], edx
call eax
mov dword [ebp - 0x1c], 0
jmp 0x47a2bf
mov dword [esp], edx
call eax
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x18]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x47a246
mov dword [ebp - 0x1c], 1
cmp dword [ebx + 4], 1
jne 0x47a500
cmp dword [ebx + 0xc], 0
jne 0x47a500
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x47a2ff
cmp dword [eax + 0xc], 0
jne case.0x47a31d.3
mov dword [esp + 4], str.http:__www.w3.org_1999_xhtml
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je case.0x47a31d.3
cmp dword [ebx + 0xc], 0
jne case.0x47a31d.3
mov eax, dword [ebx + 8]
mov dl, byte [eax]
sub edx, 0x61
cmp dl, 0xf
ja case.0x47a31d.3
movzx edx, dl
jmp dword [edx*4 + 0x68a2ac]
mov dword [esp + 4], str.area
jmp 0x47a3e8
mov dword [esp + 4], 0x68a22a
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a6e9
mov dword [esp + 4], 0x68a22d
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a6e9
mov dword [esp + 4], str.basefont
jmp 0x47a3c7
mov dword [esp + 4], 0x68a23b
jmp 0x47a3e8
mov dword [esp + 4], str.frame
jmp 0x47a3e8
mov dword [esp + 4], 0x68a23f
jmp 0x47a3e8
mov dword [esp + 4], str.ERROR:_Unexpected_packet_number___lld____lld__aborting.
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a6e9
mov dword [esp + 4], str.input
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x47a6e9
mov dword [esp + 4], str.isindex
mov eax, dword [ebx + 8]
jmp 0x47a3e8
mov dword [esp + 4], str.link
jmp 0x47a3e8
mov dword [esp + 4], 0x68a1eb
jmp 0x47a3e8
mov dword [esp + 4], 0x68a255
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je case.0x47a31d.3
jmp 0x47a6e9
mov dword [esp + 8], 0x68a25b
mov dword [esp + 4], 3
jmp 0x47a6df
cmp dword [ebp - 0x1c], 1
jne 0x47a4eb
mov dword [esp + 8], 0x68a25f
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [edi + 0x28], 1
jne 0x47a482
mov dword [esp + 8], 0x689fb0
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
call sym.evasi0n_gui.exe___xmlIndentTreeOutput
cmp dword [eax], 0
je 0x47a482
lea ecx, [edi + 0x2c]
mov eax, dword [edi + 0x70]
mov dword [ebp - 0x1c], eax
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x6c]
cmp edx, eax
jge 0x47a46e
lea eax, [edx + 1]
mov dword [esp + 8], ecx
imul eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 4], str._meta_http_equiv_Content_Type__content_text_html__charset
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov eax, dword [edi + 0x10]
test eax, eax
je 0x47a4a7
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
jmp 0x47a4bf
mov dword [esp + 8], 0x68a29e
mov dword [esp + 4], 5
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x68a2a4
mov dword [esp + 4], 4
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [edi + 0x28], 1
jne 0x47a676
mov dword [esp + 8], 0x689fb0
jmp 0x47a4f3
mov dword [esp + 8], 0x68a25f
mov dword [esp + 4], 1
jmp 0x47a66e
mov dword [esp + 8], 0x68a25f
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [ebp - 0x1c], 1
jne 0x47a5c9
cmp dword [edi + 0x28], 1
jne 0x47a574
mov dword [esp + 8], 0x689fb0
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
call sym.evasi0n_gui.exe___xmlIndentTreeOutput
cmp dword [eax], 0
je 0x47a574
lea ecx, [edi + 0x2c]
mov edx, dword [edi + 0x70]
mov dword [ebp - 0x1c], edx
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x6c]
cmp edx, eax
jge 0x47a560
lea eax, [edx + 1]
mov dword [esp + 8], ecx
imul eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 4], str._meta_http_equiv_Content_Type__content_text_html__charset
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov eax, dword [edi + 0x10]
test eax, eax
je 0x47a599
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
jmp 0x47a5b1
mov dword [esp + 8], 0x68a29e
mov dword [esp + 4], 5
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x68a2a4
mov dword [esp + 4], 4
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [ebx + 4], 1
je 0x47a5e9
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x47a5e9
mov edx, dword [edi + 0x74]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteEscape
cmp dword [ebx + 0xc], 0
je 0x47a676
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], 1
jne 0x47a617
mov dword [esp + 8], 0x689fb0
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [edi + 0x24]
test eax, eax
js 0x47a622
inc eax
mov dword [edi + 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [edi + 0x28], edx
mov edx, dword [ebx + 0xc]
mov eax, edi
call fcn.0047a700
mov eax, dword [edi + 0x24]
test eax, eax
jle 0x47a63d
dec eax
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x28], eax
call sym.evasi0n_gui.exe___xmlIndentTreeOutput
cmp dword [eax], 0
je 0x47a676
cmp dword [ebp - 0x24], 1
jne 0x47a676
lea eax, [edi + 0x2c]
mov dword [esp + 8], eax
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x6c]
cmp eax, edx
jle 0x47a666
mov eax, edx
imul eax, dword [edi + 0x70]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x68a2a9
mov dword [esp + 4], 2
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x47a6c0
mov eax, dword [eax + 0xc]
test eax, eax
je 0x47a6c0
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a138
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x68a25f
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
jmp 0x47a6f8
cmp dword [ebp - 0x1c], 0
jne 0x47a418
jmp 0x47a3f9
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret