Function at 0x482b50
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
push str.FSCommand:
mov edi, ecx
push eax
call fcn.0041c040
mov esi, eax
add esp, 8
test esi, esi
je 0x482ed3
push str.quit
push esi
call fcn.0041c090
add esp, 8
test al, al
je 0x482ba6
mov ecx, dword [edi + 0x11c4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.fullscreen
push esi
call fcn.0041c090
add esp, 8
test al, al
je 0x482be5
mov edx, dword [esp + 0x174]
mov edi, dword [edi + 0x11b8]
push edx
call fcn.00482ef0
add esp, 4
mov ecx, edi
push eax
call fcn.004866e0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.allowscale
push esi
call fcn.0041c090
add esp, 8
test al, al
je 0x482c2e
mov eax, dword [esp + 0x174]
push eax
call fcn.00482ef0
add esp, 4
mov ecx, edi
neg eax
sbb eax, eax
push 2
and al, 0xfd
add eax, 3
mov dword [edi + 0xc54], eax
call fcn.004587c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.exec
push esi
call fcn.0041c090
add esp, 8
test al, al
je 0x482e3a
mov ecx, dword [esp + 0x174]
xor ebp, ebp
mov al, byte [ecx]
test al, al
je 0x482c80
cmp al, 0x61
jl 0x482c5b
cmp al, 0x7a
jle 0x482c77
cmp al, 0x41
jl 0x482c63
cmp al, 0x5a
jle 0x482c77
cmp al, 0x30
jl 0x482c6b
cmp al, 0x39
jle 0x482c77
cmp al, 0x2e
je 0x482c77
cmp al, 0x5f
jne 0x482ec4
mov al, byte [ecx + ebp + 1]
inc ebp
test al, al
jne 0x482c53
lea ecx, [esp + 0x68]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, eax
test edx, edx
je 0x482e28
dec edx
je 0x482e28
mov al, byte [esp + edx + 0x68]
cmp al, 0x5c
je 0x482cc1
cmp al, 0x2f
je 0x482cc1
dec edx
jne 0x482ca3
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
test edx, edx
je 0x482e28
mov edi, str._fscommand
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + edx + 0x68], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [ecx + edx]
mov ecx, 0x4da3e8
lea edx, [esi + 1]
push edx
call fcn.0041e760
mov ebx, eax
lea eax, [esi + ebp + 2]
push eax
mov ecx, 0x4da3e8
call fcn.0041e760
mov edx, eax
test edx, edx
mov dword [esp + 0x10], edx
je 0x482e37
test ebx, ebx
je 0x482e37
or ecx, 0xffffffff
lea edi, [esp + 0x68]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, ebx
mov ebp, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._fscommand
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4d28d0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x14], eax
mov ecx, 0x11
mov dword [esp + 0x18], eax
lea edi, [esp + 0x24]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
push ecx
push edx
push ebx
push eax
push eax
push eax
push eax
push eax
push eax
push esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov ecx, 0x4da3e8
call fcn.0041e810
push ebx
mov ecx, 0x4da3e8
call fcn.0041e810
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push edx
jmp 0x482e13
push str.showmenu
push esi
call fcn.0041c090
add esp, 8
test al, al
je 0x482e96
mov eax, dword [esp + 0x174]
push eax
call fcn.00482ef0
mov dword [edi + 0xc28], eax
mov ecx, dword [0x4dafac]
add esp, 4
mov edx, dword [ecx + 0x11e0]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [edi + 0xc28]
mov ecx, dword [0x4dafac]
push eax
call fcn.00486d60
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
push str.trapallkeys
push esi
call fcn.0041c090
add esp, 8
test al, al
je 0x482ed3
mov ecx, dword [esp + 0x174]
push ecx
call fcn.00482ef0
mov edx, dword [0x4dafac]
add esp, 4
mov dword [edx + 0x122c], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15c
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x15c
ret 8