Function at 0x40ed00
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov eax, ecx
xor ebx, ebx
push esi
push edi
xor ecx, ecx
mov dword [esp + 0x14], eax
push dword [eax + 0x10]
mov dword [esp + 0x30], ebx
mov word [esp + 0x34], cx
mov dword [esp + 0x36], ebx
mov word [esp + 0x3a], bx
call dword [sym.imp.ntdll.dll_RtlNormalizeProcessParams]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ecx
mov edx, ebx
and dword [esp + 0x1c], edx
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x24], ebx
inc edi
mov dword [esp + 0x20], ebx
inc ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
mov esi, ebx
test eax, eax
je 0x40ee3c
mov ecx, dword [eax + 0xc]
add eax, 0x40
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp dword [eax + 4], ecx
je 0x40ed7b
cmp word [eax], cx
jne 0x40ed8b
mov eax, dword [esp + 0x18]
add eax, 0x38
cmp dword [eax + 4], ecx
je 0x40ee0e
push 1
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
js 0x40ef72
mov esi, dword [esp + 0x34]
movzx ebx, word [esp + 0x30]
jmp 0x40ee0a
cmp byte [esi], 0
je 0x40ee0e
test ebx, ebx
je 0x40ee0e
mov al, byte [esi]
test al, al
je 0x40edd4
movsx eax, al
push eax
call dword [sym.imp.ntdll.dll_isspace]
pop ecx
test eax, eax
je 0x40edd4
inc esi
dec ebx
jne 0x40edbb
test ebx, ebx
je 0x40ee0e
cmp byte [esi], 0
je 0x40ee0a
inc edi
mov dword [esp + 0x10], edi
mov edi, esi
inc esi
dec ebx
je 0x40edf7
movsx eax, byte [esi]
push eax
call dword [sym.imp.ntdll.dll_isspace]
pop ecx
test eax, eax
je 0x40ede4
mov ecx, dword [esp + 0xc]
mov eax, esi
sub eax, edi
inc ecx
mov edi, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0xc], ecx
test ebx, ebx
jne 0x40edb2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x48]
xor eax, eax
mov edx, eax
test ecx, ecx
je 0x40ee35
jmp 0x40ee30
add ecx, 2
inc edx
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ee23
xor eax, eax
cmp word [ecx], ax
jne 0x40ee1f
lea ecx, [edx + 1]
mov edx, dword [esp + 0xc]
lea eax, [edi + ecx]
cmp eax, 2
jbe 0x40ef6e
cmp edi, 1
jbe 0x40ee56
mov esi, dword [esp + 0x34]
movzx ebx, word [esp + 0x30]
mov edi, eax
xor ecx, ecx
mov eax, dword fs:[0x18]
shl edi, 2
add edx, edi
push edx
mov dword [eax + 0xbf4], ecx
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0x14], edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x40eea6
mov eax, dword fs:[0x18]
mov ebx, dword [eax + 0xbf4]
test ebx, ebx
js 0x40ef72
mov ebx, 0xc0000017
jmp 0x40ef72
cmp dword [esp + 0x10], 1
mov dword [esp + 0x28], ecx
jbe 0x40ef40
mov eax, dword [esp + 0xc]
add edi, ecx
lea edx, [ecx + eax]
mov dword [esp + 0x10], edx
jmp 0x40ef3c
cmp byte [esi], 0
je 0x40ef40
cmp edi, edx
jae 0x40ef40
test ebx, ebx
je 0x40ef40
mov al, byte [esi]
test al, al
je 0x40eeea
movsx eax, al
push eax
call dword [sym.imp.ntdll.dll_isspace]
pop ecx
test eax, eax
je 0x40eeea
inc esi
dec ebx
jne 0x40eed1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test ebx, ebx
je 0x40ef40
cmp byte [esi], 0
je 0x40ef3c
mov dword [ecx], edi
add ecx, 4
inc dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
dec ebx
je 0x40ef28
cmp edi, edx
jae 0x40ef33
movsx eax, byte [esi]
push eax
call dword [sym.imp.ntdll.dll_isspace]
mov edx, dword [esp + 0x14]
pop ecx
test eax, eax
je 0x40ef08
cmp edi, edx
jae 0x40ef33
xor eax, eax
mov byte [edi], al
inc edi
jmp 0x40ef38
dec edi
xor eax, eax
mov byte [edi], al
mov ecx, dword [esp + 0x14]
test ebx, ebx
jne 0x40eec4
mov eax, dword [esp + 0x18]
lea edx, [ecx + 4]
xor ebx, ebx
mov dword [ecx], ebx
mov ecx, dword [eax + 0x48]
test ecx, ecx
je 0x40ef6c
jmp 0x40ef67
mov dword [edx], ecx
add edx, 4
add ecx, 2
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ef5c
cmp word [ecx], bx
jne 0x40ef54
mov dword [edx], ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeAnsiString]
cmp dword [esp + 0x24], 0
je 0x40ef85
int3
test ebx, ebx
js 0x40ef9c
mov edx, dword [esp + 0x28]
push ecx
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0040cb27
pop ecx
pop ecx
mov ebx, eax
push ebx
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret