Function at 0x468e50
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
push str.FSCommand:
mov edi, ecx
push eax
call fcn.004151a0
mov esi, eax
add esp, 8
test esi, esi
je 0x4691d3
push str.quit
push esi
call fcn.004151f0
add esp, 8
test al, al
je 0x468ea6
mov ecx, dword [edi + 0x10cc]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.fullscreen
push esi
call fcn.004151f0
add esp, 8
test al, al
je 0x468ee5
mov edx, dword [esp + 0x174]
mov edi, dword [edi + 0x10c0]
push edx
call fcn.004691f0
add esp, 4
mov ecx, edi
push eax
call fcn.0046c7c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.allowscale
push esi
call fcn.004151f0
add esp, 8
test al, al
je 0x468f2e
mov eax, dword [esp + 0x174]
push eax
call fcn.004691f0
add esp, 4
mov ecx, edi
neg eax
sbb eax, eax
push 2
and al, 0xfd
add eax, 3
mov dword [edi + 0xc48], eax
call fcn.00442550
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.exec
push esi
call fcn.004151f0
add esp, 8
test al, al
je 0x46913a
mov ecx, dword [esp + 0x174]
xor ebp, ebp
mov al, byte [ecx]
test al, al
je 0x468f80
cmp al, 0x61
jl 0x468f5b
cmp al, 0x7a
jle 0x468f77
cmp al, 0x41
jl 0x468f63
cmp al, 0x5a
jle 0x468f77
cmp al, 0x30
jl 0x468f6b
cmp al, 0x39
jle 0x468f77
cmp al, 0x2e
je 0x468f77
cmp al, 0x5f
jne 0x4691c4
mov al, byte [ecx + ebp + 1]
inc ebp
test al, al
jne 0x468f53
lea ecx, [esp + 0x68]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, eax
test edx, edx
je 0x469128
dec edx
je 0x469128
mov al, byte [esp + edx + 0x68]
cmp al, 0x5c
je 0x468fc1
cmp al, 0x2f
je 0x468fc1
dec edx
jne 0x468fa3
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
test edx, edx
je 0x469128
mov edi, str._fscommand
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + edx + 0x68], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx + edx]
mov ecx, 0x4ba850
lea edx, [esi + 1]
push edx
call fcn.00417490
mov ebx, eax
lea eax, [esi + ebp + 2]
push eax
mov ecx, 0x4ba850
call fcn.00417490
mov edx, eax
test edx, edx
mov dword [esp + 0x10], edx
je 0x469137
test ebx, ebx
je 0x469137
or ecx, 0xffffffff
lea edi, [esp + 0x68]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, ebx
mov ebp, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._fscommand
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4b31c4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x14], eax
mov ecx, 0x11
mov dword [esp + 0x18], eax
lea edi, [esp + 0x24]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
push ecx
push edx
push ebx
push eax
push eax
push eax
push eax
push eax
push eax
push esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov ecx, 0x4ba850
call fcn.00417540
push ebx
mov ecx, 0x4ba850
call fcn.00417540
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push edx
jmp 0x469113
push str.showmenu
push esi
call fcn.004151f0
add esp, 8
test al, al
je 0x469196
mov eax, dword [esp + 0x174]
push eax
call fcn.004691f0
mov dword [edi + 0xc1c], eax
mov ecx, dword [0x4bb40c]
add esp, 4
mov edx, dword [ecx + 0x10e8]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [edi + 0xc1c]
mov ecx, dword [0x4bb40c]
push eax
call fcn.0046ce40
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.trapallkeys
push esi
call fcn.004151f0
add esp, 8
test al, al
je 0x4691d3
mov ecx, dword [esp + 0x174]
push ecx
call fcn.004691f0
mov edx, dword [0x4bb40c]
add esp, 4
mov dword [edx + 0x1134], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x15c
ret 8