Function at 0x4010b0
Capabilities:
Create process on windows
Get common file path
Get file attributes
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc8
cmp dword [ebp + 0xc], 0
je 0x4010c6
xor eax, eax
jmp 0x4015fc
call fcn.00401602
push 0x100
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0xb68]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0xc6c]
push ecx
lea edx, [ebp - 0xc70]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.004018e0
add esp, 0x14
lea ecx, [ebp - 0xc6c]
push ecx
lea edx, [ebp - 0xc70]
push edx
push str._s_sACGSHL32.INI
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
push 0x200
lea edx, [ebp - 0x91c]
push edx
push 0x4099e0
push str.preloadwait
push 0x407064
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x407070
lea eax, [ebp - 0x91c]
push eax
call fcn.00401b10
add esp, 8
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 0
je 0x401217
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00401ab0
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0xa68]
push edx
call fcn.00401ab0
add esp, 0xc
mov dword [ebp - 0xa68], 0x44
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x920]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4011f5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x407074
push 0
call fcn.00401b10
add esp, 8
mov dword [ebp - 0x920], eax
jmp 0x401171
lea eax, [ebp - 0x210]
push eax
push 0x200
lea ecx, [ebp - 0x91c]
push ecx
push 0x4099e4
push str.preload
push 0x407080
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x40708c
lea edx, [ebp - 0x91c]
push edx
call fcn.00401b10
add esp, 8
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 0
je 0x401290
push 1
mov eax, dword [ebp - 0x920]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x407090
push 0
call fcn.00401b10
add esp, 8
mov dword [ebp - 0x920], eax
jmp 0x401259
lea ecx, [ebp - 0x210]
push ecx
push 0x200
lea edx, [ebp - 0x91c]
push edx
push 0x4099e8
push str.apps
push 0x40709c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4070a8
lea eax, [ebp - 0x91c]
push eax
call fcn.00401b10
add esp, 8
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0x920], 0
je 0x401394
push 0
mov ecx, dword [ebp - 0x920]
push ecx
call fcn.00401a60
add esp, 8
test eax, eax
jne 0x40137a
push 0x44
push 0
lea edx, [ebp - 0xcc4]
push edx
call fcn.00401ab0
add esp, 0xc
mov dword [ebp - 0xcc4], 0x44
mov eax, dword [ebp - 0x920]
push eax
call fcn.0040104c
add esp, 4
lea ecx, [ebp - 0xc80]
push ecx
lea edx, [ebp - 0xcc4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x920]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40137a
mov ecx, dword [ebp - 0xc7c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc80]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xc80]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4070ac
push 0
call fcn.00401b10
add esp, 8
mov dword [ebp - 0x920], eax
jmp 0x4012d2
push 0x104
lea ecx, [ebp - 0xa24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.SYSTEM.INI
lea edx, [ebp - 0xa24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x414], eax
push 0x80
lea ecx, [ebp - 0xa24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x210]
push edx
push 0x100
lea eax, [ebp - 0x718]
push eax
push 0x4099ec
push str.OLDSHELL
push str.ACG_SHELL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0xa24]
push ecx
push 0x100
lea edx, [ebp - 0x514]
push edx
push 0x4099f0
push 0x4070d4
push 0x4070dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
lea eax, [ebp - 0x718]
push eax
call fcn.00401a60
add esp, 8
test eax, eax
jne 0x401484
lea ecx, [ebp - 0xa24]
push ecx
lea edx, [ebp - 0x718]
push edx
push 0x4070e4
push 0x4070ec
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0xa24]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
lea ecx, [ebp - 0x718]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4014d5
push 0x104
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.EXPLORER.EXE
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xa24]
push ecx
lea edx, [ebp - 0x618]
push edx
push 0x407104
push 0x40710c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x71c], 0
jmp 0x4014f8
mov ecx, dword [ebp - 0x71c]
add ecx, 1
mov dword [ebp - 0x71c], ecx
cmp dword [ebp - 0x71c], 0x3c
jge 0x401519
call fcn.0040162c
test eax, eax
je 0x40150c
jmp 0x401519
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4014e9
push 0x100
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x514]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4015e6
push 0x80
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xa24]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x71c], 0
jmp 0x40158e
mov edx, dword [ebp - 0x71c]
add edx, 1
mov dword [ebp - 0x71c], edx
cmp dword [ebp - 0x71c], 0xa
jge 0x4015d3
lea eax, [ebp - 0xa24]
push eax
lea ecx, [ebp - 0x410]
push ecx
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0xcc8], eax
cmp dword [ebp - 0xcc8], 0
je 0x4015c6
jmp 0x4015d3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40157f
lea edx, [ebp - 0xa24]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0xa24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10