Function at 0x47887d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, eax
mov ebx, edx
test edx, edx
je 0x479498
mov eax, dword [edx + 4]
cmp eax, 0xd
je 0x47889f
cmp eax, 9
jne 0x4788af
mov edx, ebx
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.00479529
cmp eax, 0x13
je 0x479498
cmp eax, 0x14
je 0x479498
cmp eax, 0xe
jne 0x4788d4
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.0047a022
cmp eax, 0xb
jne 0x4788ea
mov edx, dword [edx + 0xc]
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.004794a0
mov esi, dword [edi + 0x18]
cmp eax, 0xf
jne 0x478906
mov dword [esp + 4], edx
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDumpElementDecl
jmp 0x479498
cmp eax, 0x10
jne 0x47891f
mov dword [esp + 4], edx
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDumpAttributeDecl
jmp 0x479498
cmp eax, 0x11
jne 0x478938
mov dword [esp + 4], edx
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDumpEntityDecl
jmp 0x479498
cmp eax, 3
jne 0x478984
mov eax, dword [edx + 0x28]
test eax, eax
je 0x479498
mov edx, dword [edx + 8]
cmp edx, sym.evasi0n_gui.exe_xmlStringText
je 0x47895b
cmp edx, sym.evasi0n_gui.exe_xmlStringTextNoenc
je 0x478973
mov edx, dword [edi + 0x74]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteEscape
jmp 0x479498
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
jmp 0x479498
cmp eax, 7
jne 0x478a19
cmp dword [edx + 0x28], 0
je 0x4789dd
mov dword [esp + 8], 0x66d7ff
mov dword [esp + 4], 2
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
cmp dword [ebx + 0x28], 0
je 0x478a04
mov dword [esp + 8], 0x66d676
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x28]
jmp 0x4789f8
mov dword [esp + 8], 0x66d7ff
mov dword [esp + 4], 2
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d802
mov dword [esp + 4], 2
jmp 0x47947f
cmp eax, 8
jne 0x478a5c
cmp dword [edx + 0x28], 0
je 0x479498
mov dword [esp + 8], 0x66d805
mov dword [esp + 4], 4
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d80a
jmp 0x4791a1
cmp eax, 5
jne 0x478a95
mov dword [esp + 8], 0x66d7f4
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d7f6
jmp 0x479477
cmp eax, 4
jne 0x478b5d
mov ebx, dword [edx + 0x28]
test ebx, ebx
je 0x478aac
mov eax, ebx
cmp byte [ebx], 0
jne 0x478b1e
mov dword [esp + 8], str.___CDATA____
mov dword [esp + 4], 0xc
jmp 0x47947f
cmp dl, 0x5d
jne 0x478b1d
cmp byte [eax + 1], 0x5d
jne 0x478b1d
lea edi, [eax + 2]
cmp byte [eax + 2], 0x3e
jne 0x478b1d
mov dword [esp + 8], str.___CDATA_
mov dword [esp + 4], 9
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], ebx
mov eax, edi
sub eax, ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x66d825
mov dword [esp + 4], 3
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov ebx, edi
mov eax, edi
inc eax
mov dl, byte [eax]
test dl, dl
jne 0x478ac1
cmp ebx, eax
je 0x479498
mov dword [esp + 8], str.___CDATA_
mov dword [esp + 4], 9
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d825
jmp 0x4791a1
cmp eax, 2
jne 0x478b70
mov eax, edi
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
jmp fcn.004787b4
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
dec eax
jne 0x478b9b
mov eax, dword [edx + 0xc]
jmp 0x478b8e
mov edx, dword [eax + 4]
cmp edx, 5
je 0x478b94
cmp edx, 3
je 0x478b94
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x478b7e
jmp 0x478b9b
mov dword [ebp - 0x24], 0
mov dword [esp + 8], 0x66d829
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x478be5
mov eax, dword [eax + 0xc]
test eax, eax
je 0x478be5
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d7f8
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x478c17
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x18]
mov ecx, edi
mov edx, dword [ebp - 0x1c]
call fcn.00477ee8
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov dword [ebp - 0x1c], edx
test edx, edx
jne 0x478bfe
mov dword [esp + 4], 0x66d82b
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x478c4a
cmp dword [ebx + 0x24], 0
jne 0x478c4a
cmp dword [ebx + 0x30], 0
jne 0x478c4a
mov dword [esp + 4], str._xmlns_http:__www.w3.org_1999_xhtml_
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov ecx, dword [ebx + 0x2c]
test ecx, ecx
je 0x478f7d
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x20], eax
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], esi
mov esi, ebx
mov ebx, ecx
cmp dword [ebx + 0x24], 0
jne 0x478ca5
mov dword [esp + 4], 0x66d856
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478d6c
cmp dword [ebx + 0x24], 0
jne 0x478cc6
mov dword [esp + 4], 0x66d859
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478d71
cmp dword [ebx + 0x24], 0
jne 0x478ce7
mov dword [esp + 4], 0x66d85e
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478d76
cmp dword [ebx + 0x24], 0
je 0x478d1e
mov dword [esp + 4], 0x66d85e
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x478d1e
mov dword [esp + 4], 0x66d672
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478d7b
cmp dword [ebx + 0x24], 0
jne 0x478d7e
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x478d37
mov eax, dword [eax + 0x28]
test eax, eax
je 0x478d37
cmp byte [eax], 0
jne 0x478d7e
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_htmlIsBooleanAttr
test eax, eax
je 0x478d7e
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x478d55
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlFreeNode
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlNewText
mov dword [ebx + 0xc], eax
test eax, eax
je 0x478d7e
mov dword [eax + 0x14], ebx
jmp 0x478d7e
mov dword [ebp - 0x34], ebx
jmp 0x478d7e
mov dword [ebp - 0x30], ebx
jmp 0x478d7e
mov dword [ebp - 0x2c], ebx
jmp 0x478d7e
mov dword [ebp - 0x28], ebx
mov edx, ebx
mov eax, edi
call fcn.004787b4
mov ebx, dword [ebx + 0x18]
test ebx, ebx
jne 0x478c84
mov ebx, esi
mov esi, dword [ebp - 0x38]
cmp dword [ebp - 0x34], 0
jne 0x478efb
cmp dword [ebp - 0x30], 0
je 0x478efb
cmp dword [ebp - 0x1c], 0
je 0x478efb
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
test eax, eax
je 0x478efb
mov dword [esp + 4], 0x66d863
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], 0x66d865
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], 0x66d867
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], 0x66d86b
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], 0x66d86f
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], str.applet
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], 0x66d87a
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], str.frame
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x478eb7
mov dword [esp + 4], str.iframe
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x478efb
mov dword [esp + 8], 0x66d88c
mov dword [esp + 4], 5
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov edx, dword [ebp - 0x30]
call fcn.0047870b
mov dword [esp + 8], 0x66d7fd
mov dword [esp + 4], 1
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [ebp - 0x28], 0
jne 0x478f2d
cmp dword [ebp - 0x2c], 0
je 0x478f2d
mov dword [esp + 8], str._xml:lang_
mov dword [esp + 4], 0xb
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov edx, dword [ebp - 0x2c]
jmp 0x478f5d
cmp dword [ebp - 0x2c], 0
jne 0x478f7d
cmp dword [ebp - 0x28], 0
je 0x478f7d
mov dword [esp + 8], str._lang_
mov dword [esp + 4], 7
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov edx, dword [ebp - 0x28]
call fcn.0047870b
mov dword [esp + 8], 0x66d7fd
mov dword [esp + 4], 1
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [ebp - 0x1c], 0
cmp dword [ebx + 4], 1
jne 0x47905f
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x47905f
mov edx, dword [ebx + 0x20]
cmp dword [eax + 0x14], edx
jne 0x47905f
mov dword [esp + 4], 0x66d8a6
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x47905f
mov dword [esp + 4], 0x66d82b
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x47905f
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x479052
mov dword [esp + 4], 0x66d8ab
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je 0x479049
mov dword [esp + 4], 0x66d8b0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlGetProp
test eax, eax
je 0x479049
mov dword [esp + 4], 0x66d8bb
mov dword [esp], eax
mov dword [ebp - 0x3c], eax
call sym.evasi0n_gui.exe_xmlStrcasecmp
test eax, eax
mov eax, dword [sym.evasi0n_gui.exe_xmlFree]
mov edx, dword [ebp - 0x3c]
jne 0x479044
mov dword [esp], edx
call eax
mov dword [ebp - 0x1c], 0
jmp 0x47905f
mov dword [esp], edx
call eax
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x18]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x478fe6
mov dword [ebp - 0x1c], 1
cmp dword [ebx + 4], 1
jne 0x4792a0
cmp dword [ebx + 0xc], 0
jne 0x4792a0
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x47909f
cmp dword [eax + 0xc], 0
jne case.0x4790bd.3
mov dword [esp + 4], str.http:__www.w3.org_1999_xhtml
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je case.0x4790bd.3
cmp dword [ebx + 0xc], 0
jne case.0x4790bd.3
mov eax, dword [ebx + 8]
mov dl, byte [eax]
sub edx, 0x61
cmp dl, 0xf
ja case.0x4790bd.3
movzx edx, dl
jmp dword [edx*4 + 0x66d96c]
mov dword [esp + 4], str.area
jmp 0x479188
mov dword [esp + 4], 0x66d8ea
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479489
mov dword [esp + 4], 0x66d8ed
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479489
mov dword [esp + 4], str.basefont
jmp 0x479167
mov dword [esp + 4], 0x66d8fb
jmp 0x479188
mov dword [esp + 4], str.frame
jmp 0x479188
mov dword [esp + 4], 0x66d8ff
jmp 0x479188
mov dword [esp + 4], 0x66d86b
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479489
mov dword [esp + 4], str.input
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
jne 0x479489
mov dword [esp + 4], str.isindex
mov eax, dword [ebx + 8]
jmp 0x479188
mov dword [esp + 4], str.link
jmp 0x479188
mov dword [esp + 4], 0x66d8ab
jmp 0x479188
mov dword [esp + 4], 0x66d915
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrEqual
test eax, eax
je case.0x4790bd.3
jmp 0x479489
mov dword [esp + 8], 0x66d91b
mov dword [esp + 4], 3
jmp 0x47947f
cmp dword [ebp - 0x1c], 1
jne 0x47928b
mov dword [esp + 8], 0x66d91f
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [edi + 0x28], 1
jne 0x479222
mov dword [esp + 8], 0x66d670
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
call sym.evasi0n_gui.exe___xmlIndentTreeOutput
cmp dword [eax], 0
je 0x479222
lea ecx, [edi + 0x2c]
mov eax, dword [edi + 0x70]
mov dword [ebp - 0x1c], eax
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x6c]
cmp edx, eax
jge 0x47920e
lea eax, [edx + 1]
mov dword [esp + 8], ecx
imul eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 4], str._meta_http_equiv_Content_Type__content_text_html__charset
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov eax, dword [edi + 0x10]
test eax, eax
je 0x479247
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
jmp 0x47925f
mov dword [esp + 8], 0x66d95e
mov dword [esp + 4], 5
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x66d964
mov dword [esp + 4], 4
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [edi + 0x28], 1
jne 0x479416
mov dword [esp + 8], 0x66d670
jmp 0x479293
mov dword [esp + 8], 0x66d91f
mov dword [esp + 4], 1
jmp 0x47940e
mov dword [esp + 8], 0x66d91f
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [ebp - 0x1c], 1
jne 0x479369
cmp dword [edi + 0x28], 1
jne 0x479314
mov dword [esp + 8], 0x66d670
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
call sym.evasi0n_gui.exe___xmlIndentTreeOutput
cmp dword [eax], 0
je 0x479314
lea ecx, [edi + 0x2c]
mov edx, dword [edi + 0x70]
mov dword [ebp - 0x1c], edx
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x6c]
cmp edx, eax
jge 0x479300
lea eax, [edx + 1]
mov dword [esp + 8], ecx
imul eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 4], str._meta_http_equiv_Content_Type__content_text_html__charset
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov eax, dword [edi + 0x10]
test eax, eax
je 0x479339
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
jmp 0x479351
mov dword [esp + 8], 0x66d95e
mov dword [esp + 4], 5
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x66d964
mov dword [esp + 4], 4
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
cmp dword [ebx + 4], 1
je 0x479389
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x479389
mov edx, dword [edi + 0x74]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteEscape
cmp dword [ebx + 0xc], 0
je 0x479416
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], 1
jne 0x4793b7
mov dword [esp + 8], 0x66d670
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [edi + 0x24]
test eax, eax
js 0x4793c2
inc eax
mov dword [edi + 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [edi + 0x28], edx
mov edx, dword [ebx + 0xc]
mov eax, edi
call fcn.004794a0
mov eax, dword [edi + 0x24]
test eax, eax
jle 0x4793dd
dec eax
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x28], eax
call sym.evasi0n_gui.exe___xmlIndentTreeOutput
cmp dword [eax], 0
je 0x479416
cmp dword [ebp - 0x24], 1
jne 0x479416
lea eax, [edi + 0x2c]
mov dword [esp + 8], eax
mov edx, dword [edi + 0x24]
mov eax, dword [edi + 0x6c]
cmp eax, edx
jle 0x479406
mov eax, edx
imul eax, dword [edi + 0x70]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov dword [esp + 8], 0x66d969
mov dword [esp + 4], 2
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x479460
mov eax, dword [eax + 0xc]
test eax, eax
je 0x479460
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d7f8
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWriteString
mov dword [esp + 8], 0x66d91f
mov dword [esp + 4], 1
mov dword [esp], esi
call sym.evasi0n_gui.exe_xmlOutputBufferWrite
jmp 0x479498
cmp dword [ebp - 0x1c], 0
jne 0x4791b8
jmp 0x479199
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret