Function at 0x484900
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
push str.FSCommand:
mov edi, ecx
push eax
call fcn.0041c1a0
mov esi, eax
add esp, 8
test esi, esi
je 0x484c83
push str.quit
push esi
call fcn.0041c1f0
add esp, 8
test al, al
je 0x484956
mov ecx, dword [edi + 0x11c4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.fullscreen
push esi
call fcn.0041c1f0
add esp, 8
test al, al
je 0x484995
mov edx, dword [esp + 0x174]
mov edi, dword [edi + 0x11b8]
push edx
call fcn.00484ca0
add esp, 4
mov ecx, edi
push eax
call fcn.00488480
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.allowscale
push esi
call fcn.0041c1f0
add esp, 8
test al, al
je 0x4849de
mov eax, dword [esp + 0x174]
push eax
call fcn.00484ca0
add esp, 4
mov ecx, edi
neg eax
sbb eax, eax
push 2
and al, 0xfd
add eax, 3
mov dword [edi + 0xc58], eax
call fcn.004590c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.exec
push esi
call fcn.0041c1f0
add esp, 8
test al, al
je 0x484bea
mov ecx, dword [esp + 0x174]
xor ebp, ebp
mov al, byte [ecx]
test al, al
je 0x484a30
cmp al, 0x61
jl 0x484a0b
cmp al, 0x7a
jle 0x484a27
cmp al, 0x41
jl 0x484a13
cmp al, 0x5a
jle 0x484a27
cmp al, 0x30
jl 0x484a1b
cmp al, 0x39
jle 0x484a27
cmp al, 0x2e
je 0x484a27
cmp al, 0x5f
jne 0x484c74
mov al, byte [ecx + ebp + 1]
inc ebp
test al, al
jne 0x484a03
lea ecx, [esp + 0x68]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, eax
test edx, edx
je 0x484bd8
dec edx
je 0x484bd8
mov al, byte [esp + edx + 0x68]
cmp al, 0x5c
je 0x484a71
cmp al, 0x2f
je 0x484a71
dec edx
jne 0x484a53
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
test edx, edx
je 0x484bd8
mov edi, str._fscommand
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + edx + 0x68], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx + edx]
mov ecx, 0x4de568
lea edx, [esi + 1]
push edx
call fcn.0041e8f0
mov ebx, eax
lea eax, [esi + ebp + 2]
push eax
mov ecx, 0x4de568
call fcn.0041e8f0
mov edx, eax
test edx, edx
mov dword [esp + 0x10], edx
je 0x484be7
test ebx, ebx
je 0x484be7
or ecx, 0xffffffff
lea edi, [esp + 0x68]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, ebx
mov ebp, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._fscommand
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4d69c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x14], eax
mov ecx, 0x11
mov dword [esp + 0x18], eax
lea edi, [esp + 0x24]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
push ecx
push edx
push ebx
push eax
push eax
push eax
push eax
push eax
push eax
push esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov ecx, 0x4de568
call fcn.0041e9a0
push ebx
mov ecx, 0x4de568
call fcn.0041e9a0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push edx
jmp 0x484bc3
push str.showmenu
push esi
call fcn.0041c1f0
add esp, 8
test al, al
je 0x484c46
mov eax, dword [esp + 0x174]
push eax
call fcn.00484ca0
mov dword [edi + 0xc2c], eax
mov ecx, dword [0x4df12c]
add esp, 4
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [edi + 0xc2c]
mov ecx, dword [0x4df12c]
push eax
call fcn.00488b00
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.trapallkeys
push esi
call fcn.0041c1f0
add esp, 8
test al, al
je 0x484c83
mov ecx, dword [esp + 0x174]
push ecx
call fcn.00484ca0
mov edx, dword [0x4df12c]
add esp, 4
mov dword [edx + 0x122c], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x15c
ret 8