Function at 0x48172b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
mov esi, edx
test edx, edx
jne 0x48175d
cmp dword [eax + 0x7c], 0
jne 0x482033
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.node_is_NULL_n
jmp 0x481dd2
mov dword [ebx + 0x74], edx
mov eax, dword [edx + 4]
dec eax
cmp eax, 0x13
ja case.default.0x48176d
jmp dword [eax*4 + 0x68b9cc]
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.ELEMENT
call fcn.005a1030
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4817be
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4817be
mov eax, ebx
call fcn.00480e1b
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0x3a
call fcn.005a0f68
mov edx, dword [esi + 8]
mov eax, ebx
call fcn.00480e1b
jmp 0x481868
cmp dword [ebx + 0x7c], 0
jne 0x4817da
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.Error__ATTRIBUTE_found_here_n
jmp 0x481955
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
cmp dword [esi + 8], 0x67d884
mov eax, dword [ebx]
jne 0x481815
mov dword [esp + 4], eax
mov dword [esp], str.TEXT_no_enc
jmp 0x481820
mov dword [esp + 4], eax
mov dword [esp], str.TEXT
call fcn.005a1030
test byte [ebx + 0x88], 1
je 0x481868
mov eax, dword [esi + 0x28]
lea edx, [esi + 0x2c]
cmp eax, edx
jne 0x481847
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str._compact_n
jmp 0x48189d
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x78]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlDictOwns
dec eax
mov eax, dword [ebx]
jne 0x48186a
mov dword [esp + 4], eax
mov dword [esp], str._interned_n
jmp 0x48189d
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.005a0f68
jmp 0x481e05
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.CDATA_SECTION_n
call fcn.005a1030
jmp 0x481e05
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [esi + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ENTITY_REF__s__n
jmp 0x481909
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.ENTITY_n
jmp 0x48189d
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [esi + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.PI__s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x481e05
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.COMMENT_n
jmp 0x48189d
cmp dword [ebx + 0x7c], 0
jne 0x481948
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.Error__DOCUMENT_found_here_n
call fcn.005a1030
jmp 0x48200c
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.DOCUMENT_TYPE_n
jmp 0x48189d
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.DOCUMENT_FRAG_n
jmp 0x48189d
cmp dword [ebx + 0x7c], 0
jne 0x481e05
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.NOTATION_n
jmp 0x48189d
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.004814d5
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.004815bf
mov eax, ebx
call fcn.004809ae
cmp dword [esi + 4], 0x10
je 0x481a00
mov ecx, str.Node_is_not_an_attribute_declaration
mov edx, 0x13a0
jmp 0x481c08
mov eax, dword [esi + 8]
test eax, eax
je 0x481a25
cmp dword [ebx + 0x7c], 0
jne 0x481a36
mov dword [esp + 8], eax
mov dword [esp + 4], str.ATTRDECL__s_
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x481a36
mov ecx, str.Node_attribute_declaration_has_no_name
mov edx, 0x1397
mov eax, ebx
call fcn.004809ee
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x481a5b
cmp dword [ebx + 0x7c], 0
jne 0x481a6c
mov dword [esp + 8], eax
mov dword [esp + 4], str._for__s
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x481a6c
mov ecx, str.Node_attribute_declaration_has_no_element_name
mov edx, 0x1398
mov eax, ebx
call fcn.004809ee
cmp dword [ebx + 0x7c], 0
jne 0x48200c
mov edx, dword [esi + 0x28]
dec edx
cmp edx, 9
ja case.default.0x481a85
mov eax, dword [ebx]
jmp dword [edx*4 + 0x68ba1c]
mov dword [esp + 4], eax
mov dword [esp], str._CDATA
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], 0x68b778
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._IDREF
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._IDREFS
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._ENTITY
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._ENTITIES
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._NMTOKEN
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._NMTOKENS
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._ENUMERATION
jmp 0x481b0c
mov dword [esp + 4], eax
mov dword [esp], str._NOTATION
call fcn.005a1030
mov edi, dword [esi + 0x34]
test edi, edi
je 0x481b72
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0
mov eax, dword [ebx]
mov edx, dword [edi + 4]
je 0x481b38
mov dword [esp + 8], edx
mov dword [esp + 4], 0x68b7c8
jmp 0x481b44
mov dword [esp + 8], edx
mov dword [esp + 4], 0x68b7cc
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edi, dword [edi]
test edi, edi
je 0x481b60
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jne 0x481b1f
jmp 0x48201c
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0x29
call fcn.005a0f68
mov eax, dword [esi + 0x2c]
cmp eax, 3
je 0x481b93
cmp eax, 4
je 0x481ba2
cmp eax, 2
jne 0x481bb4
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str._REQUIRED
jmp 0x481baf
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str._IMPLIED
jmp 0x481baf
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str._FIXED
call fcn.005a1030
cmp dword [esi + 0x30], 0
je 0x481d6f
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0x22
call fcn.005a0f68
mov edx, dword [esi + 0x30]
mov eax, ebx
call fcn.00480e1b
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0x22
call fcn.005a0f68
jmp 0x481d6f
mov eax, ebx
call fcn.004809ae
cmp dword [esi + 4], 0x11
je 0x481c16
mov ecx, str.Node_is_not_an_entity_declaration
mov edx, 0x13a2
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.004809ee
cmp dword [esi + 8], 0
je 0x481c52
cmp dword [ebx + 0x7c], 0
jne 0x481c63
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.ENTITYDECL_
call fcn.005a1030
mov edx, dword [esi + 8]
mov eax, ebx
call fcn.00480e1b
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0x29
call fcn.005a0f68
jmp 0x481c63
mov ecx, str.Entity_declaration_has_no_name
mov edx, 0x1397
mov eax, ebx
call fcn.004809ee
cmp dword [ebx + 0x7c], 0
jne 0x48200c
mov edx, dword [esi + 0x30]
dec edx
cmp edx, 5
ja case.default.0x481c78
mov eax, dword [ebx]
jmp dword [edx*4 + 0x68ba44]
mov dword [esp + 4], eax
mov dword [esp], str.__internal_n
jmp 0x481ccb
mov dword [esp + 4], eax
mov dword [esp], str.__external_parsed_n
jmp 0x481ccb
mov dword [esp + 4], eax
mov dword [esp], str.__unparsed_n
jmp 0x481ccb
mov dword [esp + 4], eax
mov dword [esp], str.__parameter_n
jmp 0x481ccb
mov dword [esp + 4], eax
mov dword [esp], str.__external_parameter_n
jmp 0x481ccb
mov dword [esp + 4], eax
mov dword [esp], str.__predefined_n
call fcn.005a1030
cmp dword [esi + 0x34], 0
je 0x481cf6
mov eax, ebx
call fcn.004809ae
mov eax, dword [esi + 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], str._ExternalID_s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [esi + 0x38], 0
je 0x481d1c
mov eax, ebx
call fcn.004809ae
mov eax, dword [esi + 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], str._SystemID_s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [esi + 0x40], 0
je 0x481d42
mov eax, ebx
call fcn.004809ae
mov eax, dword [esi + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], str._URI_s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [esi + 0x28], 0
je 0x48200c
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str._content
call fcn.005a1030
mov edx, dword [esi + 0x28]
mov eax, ebx
call fcn.00480e1b
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.005a0f68
jmp 0x48200c
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.00480ebb
cmp dword [ebx + 0x7c], 0
jne 0x482033
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.INCLUDE_START_n
jmp 0x481dd2
cmp dword [ebx + 0x7c], 0
jne 0x482033
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.INCLUDE_END_n
call fcn.005a1030
jmp 0x482033
cmp dword [ebx + 0x7c], 0
jne 0x481de9
mov eax, ebx
call fcn.004809ae
mov eax, dword [esi + 4]
mov dword [esp], eax
mov ecx, str.Unknown_node_type__d_n
mov edx, 0x1393
mov eax, ebx
call fcn.00480a7f
jmp 0x482033
cmp dword [esi + 0x20], 0
jne 0x481e2a
cmp dword [ebx + 0x7c], 0
jne 0x481e18
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.PBM:_doc__NULL_____n
call fcn.005a1030
inc dword [ebx + 0x6c]
cmp dword [esi + 4], 1
jne 0x481e47
mov edi, dword [esi + 0x30]
test edi, edi
je 0x481e47
mov edx, edi
mov eax, ebx
call fcn.00480ebb
mov edi, dword [edi]
jmp 0x481e36
cmp dword [esi + 4], 1
jne 0x481e62
mov edi, dword [esi + 0x2c]
test edi, edi
je 0x481e62
mov edx, edi
mov eax, ebx
call fcn.004820b6
mov edi, dword [edi + 0x18]
jmp 0x481e50
mov eax, dword [esi + 4]
cmp eax, 5
je 0x481ea6
dec eax
je 0x482009
cmp dword [esi + 0x28], 0
je 0x482009
cmp dword [ebx + 0x7c], 0
jne 0x482009
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.content
call fcn.005a1030
mov edx, dword [esi + 0x28]
jmp 0x481ff0
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlGetDocEntity
mov edi, eax
test eax, eax
je 0x482009
mov eax, ebx
call fcn.004809ae
cmp dword [ebx + 0x7c], 0
jne 0x482009
mov eax, dword [edi + 0x30]
lea edx, [eax - 1]
cmp edx, 4
ja case.default.0x481ee0
mov eax, dword [ebx]
jmp dword [edx*4 + 0x68ba5c]
mov dword [esp + 4], eax
mov dword [esp], str.INTERNAL_GENERAL_ENTITY
jmp 0x481eff
mov dword [esp + 4], eax
mov dword [esp], str.EXTERNAL_GENERAL_PARSED_ENTITY
call fcn.005a1030
jmp 0x481f43
mov dword [esp + 4], eax
mov dword [esp], str.EXTERNAL_GENERAL_UNPARSED_ENTITY
jmp 0x481eff
mov dword [esp + 4], eax
mov dword [esp], str.INTERNAL_PARAMETER_ENTITY
jmp 0x481eff
mov dword [esp + 4], eax
mov dword [esp], str.EXTERNAL_PARAMETER_ENTITY
jmp 0x481eff
mov dword [esp + 8], eax
mov dword [esp + 4], str.ENTITY__d__
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x68b99e
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [edi + 0x34], 0
je 0x481f82
mov eax, ebx
call fcn.004809ae
mov eax, dword [edi + 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ExternalID_s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [edi + 0x38], 0
je 0x481fa8
mov eax, ebx
call fcn.004809ae
mov eax, dword [edi + 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SystemID_s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [edi + 0x40], 0
je 0x481fce
mov eax, ebx
call fcn.004809ae
mov eax, dword [edi + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], str.URI_s_n
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
cmp dword [edi + 0x28], 0
je 0x482009
mov eax, ebx
call fcn.004809ae
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str.content
call fcn.005a1030
mov edx, dword [edi + 0x28]
mov eax, ebx
call fcn.00480e1b
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.005a0f68
dec dword [ebx + 0x6c]
mov edx, esi
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.00481262
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], str...._
call fcn.005a1030
jmp 0x481b72
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret