Function at 0x463220
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
push str.FSCommand:
mov edi, ecx
push eax
call fcn.00414320
mov esi, eax
add esp, 8
test esi, esi
je 0x4635a3
push str.quit
push esi
call fcn.00414370
add esp, 8
test al, al
je 0x463276
mov ecx, dword [edi + 0x102c]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.fullscreen
push esi
call fcn.00414370
add esp, 8
test al, al
je 0x4632b5
mov edx, dword [esp + 0x174]
mov edi, dword [edi + 0x1020]
push edx
call fcn.004635c0
add esp, 4
mov ecx, edi
push eax
call fcn.00466990
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.allowscale
push esi
call fcn.00414370
add esp, 8
test al, al
je 0x4632fe
mov eax, dword [esp + 0x174]
push eax
call fcn.004635c0
add esp, 4
mov ecx, edi
neg eax
sbb eax, eax
push 2
and al, 0xfd
add eax, 3
mov dword [edi + 0xbd0], eax
call fcn.0043fdb0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.exec
push esi
call fcn.00414370
add esp, 8
test al, al
je 0x46350a
mov ecx, dword [esp + 0x174]
xor ebp, ebp
mov al, byte [ecx]
test al, al
je 0x463350
cmp al, 0x61
jl 0x46332b
cmp al, 0x7a
jle 0x463347
cmp al, 0x41
jl 0x463333
cmp al, 0x5a
jle 0x463347
cmp al, 0x30
jl 0x46333b
cmp al, 0x39
jle 0x463347
cmp al, 0x2e
je 0x463347
cmp al, 0x5f
jne 0x463594
mov al, byte [ecx + ebp + 1]
inc ebp
test al, al
jne 0x463323
lea ecx, [esp + 0x68]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, eax
test edx, edx
je 0x4634f8
dec edx
je 0x4634f8
mov al, byte [esp + edx + 0x68]
cmp al, 0x5c
je 0x463391
cmp al, 0x2f
je 0x463391
dec edx
jne 0x463373
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
test edx, edx
je 0x4634f8
mov edi, str._fscommand
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + edx + 0x68], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx + edx]
mov ecx, 0x4afb50
lea edx, [esi + 1]
push edx
call fcn.00416190
mov ebx, eax
lea eax, [esi + ebp + 2]
push eax
mov ecx, 0x4afb50
call fcn.00416190
mov edx, eax
test edx, edx
mov dword [esp + 0x10], edx
je 0x463507
test ebx, ebx
je 0x463507
or ecx, 0xffffffff
lea edi, [esp + 0x68]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, ebx
mov ebp, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._fscommand
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a84b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x14], eax
mov ecx, 0x11
mov dword [esp + 0x18], eax
lea edi, [esp + 0x24]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
push ecx
push edx
push ebx
push eax
push eax
push eax
push eax
push eax
push eax
push esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov ecx, 0x4afb50
call fcn.004161f0
push ebx
mov ecx, 0x4afb50
call fcn.004161f0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push edx
jmp 0x4634e3
push str.showmenu
push esi
call fcn.00414370
add esp, 8
test al, al
je 0x463566
mov eax, dword [esp + 0x174]
push eax
call fcn.004635c0
mov dword [edi + 0xba4], eax
mov ecx, dword [0x4b05f8]
add esp, 4
mov edx, dword [ecx + 0x1048]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [edi + 0xba4]
mov ecx, dword [0x4b05f8]
push eax
call fcn.00467010
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.trapallkeys
push esi
call fcn.00414370
add esp, 8
test al, al
je 0x4635a3
mov ecx, dword [esp + 0x174]
push ecx
call fcn.004635c0
mov edx, dword [0x4b05f8]
add esp, 4
mov dword [edx + 0x1094], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x15c
ret 8