Function at 0x438230
Capabilities:
Write file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x8c], edx
mov edi, dword [ebp + 8]
cmp ecx, ebx
jge 0x438275
mov byte [ebp + ecx*2 - 0x87], 0x20
mov byte [ebp + ecx*2 - 0x88], 0x20
inc ecx
cmp ecx, ebx
setl dl
cmp ecx, 0x18
setle al
and eax, 0xff
test edx, eax
jne 0x438250
mov byte [ebp + ecx*2 - 0x87], 0
mov byte [ebp + ecx*2 - 0x88], 0
push eax
push eax
lea eax, [ebp - 0x88]
push esi
push eax
call sub.msvcrt.dll_fputs
add esp, 0x10
test edi, edi
je 0x4382be
mov eax, dword [edi]
cmp eax, 0x13
ja case.default.0x4382a2
jmp dword [eax*4 + 0x7446a8]
push edx
push eax
push str.UNKNOWN__d_n
push esi
call sub.msvcrt.dll_fprintf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push esi
push 0xd
push 1
push str.Step_is_NULL_n
call sub.msvcrt.dll_fwrite
jmp 0x4382b6
push esi
push 7
push 1
push str.RANGETO
call sub.msvcrt.dll_fwrite
add esp, 0x10
push eax
push eax
push esi
push 0xa
call sub.msvcrt.dll_fputc
mov edx, dword [edi + 4]
add esp, 0x10
test edx, edx
js 0x438317
push eax
push eax
lea eax, [ebx + 1]
push eax
lea eax, [edx + edx*4]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + 8]
lea eax, [edx + eax*8]
mov edx, ecx
push eax
mov eax, esi
call fcn.00438230
add esp, 0x10
mov edx, dword [edi + 8]
test edx, edx
js 0x4382b6
push eax
push eax
lea eax, [ebx + 1]
push eax
lea eax, [edx + edx*4]
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ecx + 8]
lea eax, [edx + eax*8]
mov edx, ecx
push eax
mov eax, esi
call fcn.00438230
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push esi
push 3
push 1
push 0x744496
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 3
push 1
push 0x74449a
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 2
push 1
push 0x74449e
call sub.msvcrt.dll_fwrite
jmp 0x4382de
mov eax, dword [edi + 0xc]
test eax, eax
je 0x438742
push esi
push 7
push 1
push str.EQUAL_
call sub.msvcrt.dll_fwrite
jmp 0x4382de
mov eax, dword [edi + 0xc]
test eax, eax
je 0x438756
push esi
push 5
push 1
push 0x7444a9
call sub.msvcrt.dll_fwrite
mov eax, dword [edi + 0x10]
add esp, 0x10
test eax, eax
jne 0x4382e1
push eax
push eax
push esi
push 0x3d
call sub.msvcrt.dll_fputc
jmp 0x4382de
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4387aa
cmp eax, 1
je 0x438802
cmp eax, 2
je 0x438816
cmp eax, 3
jne 0x4382e1
push esi
push 0xe
push 1
push str.PLUS_unary____
call sub.msvcrt.dll_fwrite
jmp 0x4382de
mov eax, dword [edi + 0xc]
test eax, eax
je 0x438796
dec eax
je 0x4387be
push esi
push 8
push 1
push str.MULT_mod
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 5
push 1
push str.UNION
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 4
push 1
push str.ROOT
call sub.msvcrt.dll_fwrite
jmp 0x4382de
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x90], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x98], eax
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa0], eax
push esi
push 8
push 1
push str.COLLECT
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp dword [ebp - 0x90], 0xd
ja case.0x4384b1.0
mov ecx, dword [ebp - 0x90]
jmp dword [ecx*4 + 0x7446f8]
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0xa4], ecx
push esi
push 5
push 1
push str.ELEM
call sub.msvcrt.dll_fwrite
add esp, 0xc
push 0
mov eax, dword [ebp - 0xa4]
push eax
push esi
call fcn.00437b80
jmp 0x4382eb
push esi
push 3
push 1
push 0x7444e1
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 9
push 1
push str.PREDICATE
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 6
push 1
push str.FILTER
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 4
push 1
push str.SORT
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 4
push 1
push str.NODE
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 5
push 1
push str.RESET
call sub.msvcrt.dll_fwrite
jmp 0x4382de
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x18]
test eax, eax
je 0x4387de
push edx
push eax
push str.VARIABLE__s:_s
push esi
call sub.msvcrt.dll_fprintf
jmp 0x4382de
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 0x18]
test eax, eax
je 0x4387d2
sub esp, 0xc
push edx
push ecx
push eax
push str.FUNCTION__s:_s__d_args_
push esi
call sub.msvcrt.dll_fprintf
add esp, 0x20
jmp 0x4382e1
push esi
push 0xd
push 1
push str._preceding
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp dword [ebp - 0x94], 5
ja case.default.0x4385ca
mov eax, dword [ebp - 0x94]
jmp dword [eax*4 + 0x744730]
push esi
push 7
push 1
push 0x74453b
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp dword [ebp - 0x98], 3
je 0x4387ea
ja 0x438765
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x4387f6
mov edx, dword [ebp - 0x9c]
test edx, edx
je 0x438624
push eax
mov eax, dword [ebp - 0x9c]
push eax
push 0x744543
push esi
call sub.msvcrt.dll_fprintf
add esp, 0x10
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x4382e1
push eax
push eax
push esi
mov eax, dword [ebp - 0xa0]
push eax
call sub.msvcrt.dll_fputs
jmp 0x4382de
push esi
push 7
push 1
push 0x744547
jmp 0x4385db
push esi
push 0xc
push 1
push 0x74454f
jmp 0x4385db
push esi
push 6
push 1
push 0x74455c
jmp 0x4385db
push esi
push 5
push 1
push str.PI
jmp 0x4385db
push esi
push 7
push 1
push 0x744569
jmp 0x4385db
push esi
push 0xa
push 1
push str._parent
jmp 0x4385b3
push esi
push 0xd
push 1
push str._namespace
jmp 0x4385b3
push esi
push 0x16
push 1
push str._following_siblings
jmp 0x4385b3
push esi
push 8
push 1
push str._self
jmp 0x4385b3
push esi
push 0x15
push 1
push str._preceding_sibling
jmp 0x4385b3
push esi
push 0xd
push 1
push str._following
jmp 0x4385b3
push esi
push 0x16
push 1
push str._descendant_or_self
jmp 0x4385b3
push esi
push 0xe
push 1
push str._descendant
jmp 0x4385b3
push esi
push 9
push 1
push str._child
jmp 0x4385b3
push esi
push 0xe
push 1
push str._attributes
jmp 0x4385b3
push esi
push 0x15
push 1
push str._ancestors_or_self
jmp 0x4385b3
push esi
push 0xd
push 1
push str._ancestors
jmp 0x4385b3
push esi
push 8
push 1
push str.EQUAL__
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 5
push 1
push str.CMP__
jmp 0x4383b5
cmp dword [ebp - 0x98], 7
je 0x43882a
cmp dword [ebp - 0x98], 8
jne 0x438604
push esi
push 0xa
push 1
push 0x744640
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x438604
push esi
push 6
push 1
push str.MULT_
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 6
push 1
push str.PLUS__
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 8
push 1
push str.MULT_div
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push edx
push ecx
push str.FUNCTION__s__d_args_
jmp 0x438574
push ecx
push edx
push str.VARIABLE__s
jmp 0x438574
push esi
push 7
push 1
push 0x744683
jmp 0x438789
push esi
push 7
push 1
push str.node
jmp 0x438789
push esi
push 6
push 1
push str.PLUS_
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 0xc
push 1
push str.PLUS_unary__
call sub.msvcrt.dll_fwrite
jmp 0x4382de
push esi
push 5
push 1
push str.PI
jmp 0x438789