Function at 0x4d30c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x15c
push esi
push edi
push str.FSCommand:
push eax
mov edi, ecx
call fcn.00434aa0
mov esi, eax
add esp, 8
test esi, esi
je 0x4d3409
push str.quit
push esi
call fcn.00434b50
add esp, 8
test al, al
je 0x4d3112
mov ecx, dword [edi + 0xc64]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.fullscreen
push esi
call fcn.00434b50
add esp, 8
test al, al
je 0x4d314b
mov esi, dword [esp + 0x16c]
mov edi, dword [edi + 0xc58]
call fcn.004d2720
push eax
mov ecx, edi
call fcn.004d83a0
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.allowscale
push esi
call fcn.00434b50
add esp, 8
test al, al
je 0x4d318f
mov esi, dword [esp + 0x16c]
call fcn.004d2720
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
push 2
mov ecx, edi
mov dword [edi + 0x4a0], eax
call fcn.004a5560
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.exec
push esi
call fcn.00434b50
add esp, 8
test al, al
je 0x4d337c
mov ecx, dword [esp + 0x16c]
mov al, byte [ecx]
xor edi, edi
test al, al
je 0x4d31e1
cmp al, 0x61
jl 0x4d31bc
cmp al, 0x7a
jle 0x4d31d8
cmp al, 0x41
jl 0x4d31c4
cmp al, 0x5a
jle 0x4d31d8
cmp al, 0x30
jl 0x4d31cc
cmp al, 0x39
jle 0x4d31d8
cmp al, 0x2e
je 0x4d31d8
cmp al, 0x5f
jne 0x4d33fc
mov al, byte [edi + ecx + 1]
inc edi
test al, al
jne 0x4d31b4
push 0x104
lea edx, [esp + 0x64]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4d33fc
dec eax
je 0x4d33fc
mov cl, byte [esp + eax + 0x60]
cmp cl, 0x5c
je 0x4d3220
cmp cl, 0x2f
je 0x4d3220
dec eax
jne 0x4d3202
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
test eax, eax
je 0x4d33fc
mov ecx, str._fscommand
mov byte [esp + eax + 0x60], 0
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4d3235
sub ecx, esi
lea esi, [ecx + eax]
lea eax, [esi + 1]
push ebx
push eax
call fcn.00439320
lea ecx, [esi + edi + 2]
push ecx
mov ebx, eax
call fcn.00439320
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0xc], esi
je 0x4d335f
test ebx, ebx
je 0x4d335f
lea eax, [esp + 0x64]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d3280
mov edi, ebx
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3290
mov edx, dword [str._fscommand]
mov dword [edi], edx
mov eax, dword [0x545b20]
mov dword [edi + 4], eax
mov cx, word [0x545b24]
mov word [edi + 8], cx
mov dl, byte [0x545b26]
mov byte [edi + 0xa], dl
mov edx, esi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d32c2
mov edi, esi
dec edi
push ebp
lea ebp, [edi + 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d32d3
mov ax, word [0x544ec0]
mov word [edi], ax
mov eax, dword [esp + 0x174]
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d32f0
sub eax, esi
dec ebp
mov edi, ebp
pop ebp
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d3300
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
call fcn.00527b30
push ebx
call fcn.00527b30
add esp, 8
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.showmenu
push esi
call fcn.00434b50
add esp, 8
test al, al
je 0x4d33d2
mov esi, dword [esp + 0x16c]
call fcn.004d2720
mov dword [edi + 0x474], eax
mov ecx, dword [0x5616a8]
mov edx, dword [ecx + 0xc80]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [edi + 0x474]
mov ecx, dword [0x5616a8]
push eax
call fcn.004d7df0
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.trapallkeys
push esi
call fcn.00434b50
add esp, 8
test al, al
je 0x4d3409
mov esi, dword [esp + 0x16c]
call fcn.004d2720
mov ecx, dword [0x5616a8]
mov dword [ecx + 0xccc], eax
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
pop edi
xor al, al
pop esi
add esp, 0x15c
ret 8