Function at 0x40e730
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push str.FSCommand:
push edi
call fcn.00426a40
mov esi, eax
add esp, 8
test esi, esi
je 0x40ea0d
push str.quit
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40e779
mov eax, dword [0x450988]
mov ecx, dword [eax + 0xbdc]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
pop ebx
ret
push str.fullscreen
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40e7a9
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040ea40
mov ecx, dword [0x450988]
add esp, 4
push eax
call fcn.0040e060
pop edi
pop esi
pop ebp
pop ebx
ret
push str.allowscale
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40e7e7
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ea40
mov ecx, dword [esp + 0x18]
add esp, 4
neg eax
sbb eax, eax
push 2
and al, 0xfd
add eax, 3
mov dword [ecx + 0xa38], eax
call fcn.00429d80
pop edi
pop esi
pop ebp
pop ebx
ret
push str.save
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40e8d8
mov ecx, dword [esp + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ea34
mov edx, dword [esp + 0x14]
mov edi, dword [edx + 0x114]
test edi, edi
mov dword [esp + 0x18], edi
je 0x40e8cc
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40e847
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x18]
cmp byte [eax], 0x24
je 0x40e8bd
mov ecx, dword [esp + 0x14]
push edi
call fcn.00436050
lea ecx, [esp + 0x1c]
push 0
push ecx
push 1
push 0x44e520
push ebx
mov esi, eax
call ebp
mov edx, dword [edi + 0x18]
lea eax, [esp + 0x1c]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
push 1
push 0x44e51c
push ebx
call ebp
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
push ecx
push esi
push ebx
call ebp
push esi
call fcn.00426af0
mov edi, dword [esp + 0x1c]
add esp, 4
mov edi, dword [edi + 0x14]
test edi, edi
mov dword [esp + 0x18], edi
jne 0x40e843
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push str.exec
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40e947
mov ebp, dword [esp + 0x1c]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
push esi
call fcn.0040b0a0
mov edi, eax
add esp, 4
test edi, edi
je 0x40ea34
xor ebx, ebx
test esi, esi
jle 0x40e930
mov edx, ebp
sub edx, edi
mov cl, byte [edx + eax]
cmp cl, 0x20
mov byte [eax], cl
je 0x40e92c
inc ebx
inc eax
cmp ebx, esi
jl 0x40e91a
jmp 0x40e930
mov byte [ebx + edi], 0
push 5
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
call fcn.0040b0b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
push str.showmenu
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40e9dd
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push eax
call fcn.0040ea40
mov dword [esi + 0xa24], eax
mov ecx, dword [0x450988]
add esp, 4
mov edx, dword [ecx + 0xbf0]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov ecx, dword [esi + 0xa24]
test ecx, ecx
jne 0x40e9bf
test eax, eax
je 0x40ea34
mov ecx, dword [0x450988]
push 0
mov dword [ecx + 0xc28], eax
mov edx, dword [0x450988]
mov eax, dword [edx + 0xbf0]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [0x450988]
mov ecx, dword [eax + 0xc28]
mov edx, dword [eax + 0xbf0]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetMenu]
pop edi
pop esi
pop ebp
pop ebx
ret
push str.trapAllKeys
push esi
call fcn.00426a80
add esp, 8
test eax, eax
je 0x40ea34
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040ea40
mov ecx, dword [0x450988]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [ecx + 0xbf8], eax
pop ebx
ret
mov edx, dword [esp + 0x14]
push edi
mov eax, dword [edx + 0xbd4]
push eax
call fcn.00410790
mov ecx, dword [esp + 0x28]
mov esi, eax
push ecx
push esi
call fcn.0040bd70
push esi
call fcn.00426af0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret