Function at 0x4d5d20
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x15c
push esi
push edi
push str.FSCommand:
push eax
mov edi, ecx
call fcn.00435350
mov esi, eax
add esp, 8
test esi, esi
je 0x4d6069
push str.quit
push esi
call fcn.00435400
add esp, 8
test al, al
je 0x4d5d72
mov ecx, dword [edi + 0xc7c]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.fullscreen
push esi
call fcn.00435400
add esp, 8
test al, al
je 0x4d5dab
mov esi, dword [esp + 0x16c]
mov edi, dword [edi + 0xc70]
call fcn.004d5380
push eax
mov ecx, edi
call fcn.004db4e0
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.allowscale
push esi
call fcn.00435400
add esp, 8
test al, al
je 0x4d5def
mov esi, dword [esp + 0x16c]
call fcn.004d5380
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
push 2
mov ecx, edi
mov dword [edi + 0x4a4], eax
call fcn.004a7ac0
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.exec
push esi
call fcn.00435400
add esp, 8
test al, al
je 0x4d5fdc
mov ecx, dword [esp + 0x16c]
mov al, byte [ecx]
xor edi, edi
test al, al
je 0x4d5e41
cmp al, 0x61
jl 0x4d5e1c
cmp al, 0x7a
jle 0x4d5e38
cmp al, 0x41
jl 0x4d5e24
cmp al, 0x5a
jle 0x4d5e38
cmp al, 0x30
jl 0x4d5e2c
cmp al, 0x39
jle 0x4d5e38
cmp al, 0x2e
je 0x4d5e38
cmp al, 0x5f
jne 0x4d605c
mov al, byte [edi + ecx + 1]
inc edi
test al, al
jne 0x4d5e14
push 0x104
lea edx, [esp + 0x64]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4d605c
dec eax
je 0x4d605c
mov cl, byte [esp + eax + 0x60]
cmp cl, 0x5c
je 0x4d5e80
cmp cl, 0x2f
je 0x4d5e80
dec eax
jne 0x4d5e62
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
test eax, eax
je 0x4d605c
mov ecx, str._fscommand
mov byte [esp + eax + 0x60], 0
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4d5e95
sub ecx, esi
lea esi, [ecx + eax]
lea eax, [esi + 1]
push ebx
push eax
call fcn.0052b380
lea ecx, [esi + edi + 2]
push ecx
mov ebx, eax
call fcn.0052b380
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0xc], esi
je 0x4d5fbf
test ebx, ebx
je 0x4d5fbf
lea eax, [esp + 0x64]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d5ee0
mov edi, ebx
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d5ef0
mov edx, dword [str._fscommand]
mov dword [edi], edx
mov eax, dword [0x548d48]
mov dword [edi + 4], eax
mov cx, word [0x548d4c]
mov word [edi + 8], cx
mov dl, byte [0x548d4e]
mov byte [edi + 0xa], dl
mov edx, esi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d5f22
mov edi, esi
dec edi
push ebp
lea ebp, [edi + 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d5f33
mov ax, word [0x5481a8]
mov word [edi], ax
mov eax, dword [esp + 0x174]
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d5f50
sub eax, esi
dec ebp
mov edi, ebp
pop ebp
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d5f60
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
call fcn.00439d00
push ebx
call fcn.00439d00
add esp, 8
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.showmenu
push esi
call fcn.00435400
add esp, 8
test al, al
je 0x4d6032
mov esi, dword [esp + 0x16c]
call fcn.004d5380
mov dword [edi + 0x478], eax
mov ecx, dword [0x564708]
mov edx, dword [ecx + 0xc98]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [edi + 0x478]
mov ecx, dword [0x564708]
push eax
call fcn.004dad30
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
push str.trapallkeys
push esi
call fcn.00435400
add esp, 8
test al, al
je 0x4d6069
mov esi, dword [esp + 0x16c]
call fcn.004d5380
mov ecx, dword [0x564708]
mov dword [ecx + 0xce4], eax
pop edi
mov al, 1
pop esi
add esp, 0x15c
ret 8
pop edi
xor al, al
pop esi
add esp, 0x15c
ret 8