Function at 0x4a0bc0
Capabilities:
Create process on windows
Create thread
Enumerate processes
Hide graphical window
Read .ini file
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x2f4
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
call fcn.0061501c
push eax
call fcn.006133a7
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
add esp, 8
push 1
call ebx
xor ecx, ecx
cmp eax, 0x300
setg cl
mov dword [0x6486c8], ecx
mov esi, dword [esp + 0x310]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x200]
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x200]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x200]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x10
jae 0x4a0c66
push ebp
push 0x656458
push 0x656414
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret 0x10
push str..Config.ini
push ebp
push str.State
push str.Launcher
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
mov dword [0xa4f2b0], eax
jl 0x4a0c90
cmp eax, ebp
jne 0x4a0d41
jmp 0x4a0c98
cmp eax, ebp
jne 0x4a0d41
mov esi, dword [sym.imp.USER32.dll_GetActiveWindow]
push ebp
push 0x656458
push 0x65638c
call esi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push eax
call edi
test eax, eax
je 0x4a0d41
push 5
push ebp
push str.UpdateQianMa
push str.Update.exe
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4a0d18
cmp eax, 2
push 0x10
push 0x656458
jne 0x4a0cff
push 0x6562e4
call esi
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret 0x10
push 0x656294
call esi
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret 0x10
push str..Config.ini
push 0x656290
push 0x656288
push str.Launcher
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret 0x10
lea eax, [esp + 0x200]
push 0x656284
push eax
call fcn.00614f78
push 0x656284
push ebp
mov dword [0xa26fdc], eax
mov dword [0xa2e494], eax
call fcn.00614f78
push 0x656284
push ebp
mov dword [0xa43a6c], eax
call fcn.00614f78
push 0x656284
push ebp
mov dword [0xa439ac], eax
call fcn.00614f78
add esp, 0x20
cmp eax, ebp
je 0x4a0da7
push str.FullScreen
push eax
call fcn.0061fa50
add esp, 8
test eax, eax
jne 0x4a0da7
mov dword [0x6486c8], ebp
mov esi, dword [esp + 0x308]
push 0x7f00
push ebp
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x4a0800
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebp
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 1
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], str.LoadMenu
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], str.LoadClass
mov dword [esp + 0x40], ebp
call dword [sym.imp.USER32.dll_RegisterClassExA]
push ebp
call ebx
push 1
mov edi, eax
call ebx
push ebp
push esi
push ebp
push ebp
push 0xa0
add eax, 0xffffff38
push 0x19e
add edi, 0xfffffe58
push eax
push edi
push 0x90080000
push str.ElysiumLoad
push str.LoadClass
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebp
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [esp + 0x314]
mov dword [0xa2b0ac], eax
jne 0x4a0e7f
push ebx
push 0
call ebp
mov edx, dword [0xa2b0ac]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0xa26fd8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov dword [esp + 0xe0], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a0eb5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret 0x10
lea eax, [esp + 0xd8]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4a0edd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f4
ret 0x10
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0xfc]
push str.SanboxieDcomlaunch.exe
push ecx
call edi
test eax, eax
je 0x4a0f1b
lea edx, [esp + 0xd8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4a0f32
lea eax, [esp + 0xfc]
push str.SanboxieDcomlaunch.exe
push eax
call edi
test eax, eax
jne 0x4a0ef6
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x40]
xor edi, edi
push ecx
push edi
push edi
push 0x4a0b40
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4a0f59
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret 0x10
cmp dword [0x6486c8], edi
je 0x4a0fa7
lea edx, [esp + 0x44]
mov word [esp + 0x68], 0x94
push edx
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
mov esi, 0x10
cmp dword [esp + 0xac], esi
je 0x4a0fa7
lea eax, [esp + 0x44]
push 0x10000000
push eax
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
lea ecx, [esp + 0x44]
push edi
push ecx
mov dword [esp + 0xb4], esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
mov edx, dword [0xa26fd8]
push ebx
push edx
call fcn.004a2560
add esp, 8
cmp eax, edi
mov dword [0xa4efc4], eax
jne 0x4a0fc8
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [0xa2b0ac]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [0xa2af98]
push ebx
push ecx
mov dword [0xa2b0ac], edi
call ebp
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
push edi
push edi
push edi
push edi
push 0xa4b9b8
call esi
test eax, eax
je 0x4a102b
push edi
push edi
push edi
push 0xa4b9b8
call ebx
test eax, eax
je 0x4a10e9
push 0xa4b9b8
call ebp
push 0xa4b9b8
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4a0ff6
cmp dword [0xa4efc4], edi
je 0x4a10de
call fcn.004fa1e0
test byte [0xa4bb00], 1
mov eax, dword [0x6d6790]
jne 0x4a1065
mov cl, byte [0xa4bb00]
lea edx, [eax + 0x1f4]
or cl, 1
mov dword [0xa2b130], edx
mov byte [0xa4bb00], cl
cmp eax, dword [0xa2b130]
jbe 0x4a1099
push 0x4ac
call fcn.005a4370
add esp, 4
call fcn.005a39b0
test eax, eax
jne 0x4a1088
call fcn.005a3d70
mov eax, dword [0x6d6790]
lea ecx, [eax + 0x7d0]
mov dword [0xa2b130], ecx
mov cl, byte [0xa4bb00]
test cl, 2
jne 0x4a10b9
or cl, 2
lea edx, [eax + 0x1f4]
mov byte [0xa4bb00], cl
mov dword [0xa2b024], edx
cmp eax, dword [0xa2b024]
jbe 0x4a0ff6
call fcn.005a2270
mov eax, dword [0x6d6790]
add eax, 0xea60
mov dword [0xa2b024], eax
jmp 0x4a0ff6
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x4a0ff6
mov eax, dword [0xa4efc0]
cmp eax, edi
je 0x4a10ff
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0xa4efc0], edi
cmp dword [0x6486c8], edi
je 0x4a1129
lea ecx, [esp + 0x44]
mov word [esp + 0x68], 0x94
push ecx
push 0xfffffffffffffffe
push edi
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
lea edx, [esp + 0x44]
push 1
push edx
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
mov eax, dword [0xa4b9c0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f4
ret 0x10