Function at 0x405a40
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Get file attributes
Move file
Read .ini file
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x58e3d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x214], eax
call fcn.00407a71
mov ecx, eax
test ecx, ecx
je 0x406632
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x210], esi
call fcn.00407a71
mov ecx, eax
test ecx, ecx
je 0x40663c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
call fcn.00407a71
mov ecx, eax
test ecx, ecx
je 0x406646
mov eax, dword [ecx]
push ebx
push edi
call dword [eax + 0xc]
mov edi, eax
call fcn.00407a71
mov ecx, eax
test ecx, ecx
je 0x406650
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x23c], eax
call fcn.00407a71
mov ecx, eax
test ecx, ecx
je 0x40665a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x218], eax
call fcn.00407a71
mov ecx, eax
test ecx, ecx
je 0x406664
mov eax, dword [ecx]
call dword [eax + 0xc]
push str.PININST_Mutex
push 1
add eax, 0x10
xorps xmm0, xmm0
push 0
mov dword [ebp - 0x238], eax
movlpd qword [ebp - 0x228], xmm0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
mov dword [ebp - 0x234], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405b5e
push str.C:System.SavLogsPININST.DBG
push str.Another_instance_of_PININST_being_executed._Exit_this_instance_
push str.Note
push str.PININST_Debug
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x214], 0
jmp 0x40656d
mov edx, dword [ebp - 0x214]
test edx, edx
jne 0x405b6c
xor ecx, ecx
jmp 0x405b7a
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405b71
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x210]
call fcn.00405390
lea eax, [ebp - 0x210]
push eax
call fcn.00404cc0
mov esi, dword [ebp - 0x210]
add esp, 4
cmp dword [esi - 0xc], 0
je 0x405c7d
push 0x541da8
push esi
call fcn.0051617f
add esp, 8
test eax, eax
je 0x405c7d
push 0
push esi
call fcn.005173ea
add esp, 8
test eax, eax
jne 0x405c7d
push esi
push eax
push str.Is2PP
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x58f898], eax
test eax, eax
je 0x405c04
lea eax, [ebp - 0x210]
push str.C:SYSTEM.SAVUTILPININST.2PP
push eax
call fcn.00401eb0
mov esi, dword [ebp - 0x210]
add esp, 8
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
push str.C:SYSTEM.SAVUTILPININST.LOG
push str.LogFile
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401240
lea eax, [ebp - 0x21c]
push eax
call fcn.00404cc0
push 0x541e08
push dword [ebp - 0x21c]
call fcn.00516912
add esp, 0xc
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x405ca7
push 0x541e08
push str.C:SYSTEM.SAVUTILPININST.LOG
call fcn.00516912
add esp, 8
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x405c97
test ebx, ebx
je 0x405c88
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0
jmp 0x40656d
push str.C:SYSTEM.SAVUTILPININST.LOG
lea ecx, [ebp - 0x21c]
call fcn.00401240
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
push str.C:SYSTEM.SAVUtilTDCMCPPDELETE.LST
push str.DeleteList
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x58f8e4
call fcn.00401240
push 0x58f8e4
call fcn.00404cc0
mov ebx, dword [ebp - 0x214]
push str._n
push ebx
call fcn.00516927
push str.PININST__Mini_FBI__starts_at:
push ebx
call fcn.00516927
push 0
call fcn.0051739b
add esp, 0x18
mov dword [ebp - 0x228], eax
push str._A___B__d___Y
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x224], edx
call fcn.00402430
mov ebx, dword [eax]
push str._H:_M:_S
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402430
push ebx
push dword [eax]
mov ebx, dword [ebp - 0x214]
push str._s__s_n
push ebx
call fcn.00516927
add esp, 0x10
lea ecx, [ebp - 0x22c]
call fcn.004011b0
lea ecx, [ebp - 0x220]
call fcn.004011b0
push str._n_n
push ebx
call fcn.00516927
push ebx
call fcn.00516698
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push 0x104
push eax
push 0x541c9b
push str.OSType
push str.Settings
call ebx
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x58f8d0
call fcn.00401240
push 0x58f8d0
call fcn.00404cc0
mov eax, dword [0x58f8d0]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x405de8
push str.Vista
mov ecx, 0x58f8d0
call fcn.00401240
call fcn.004026f0
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
push str.RunOnceThese
push str.CurrentState
push str.Settings
call ebx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x218]
call fcn.00401240
lea eax, [ebp - 0x218]
push eax
call fcn.00404cc0
add esp, 4
lea eax, [ebp - 0x108]
push esi
push 0x104
push eax
push 0x541c9b
push str.ProgressBarINI
push str.Settings
call ebx
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x58f8c4
call fcn.00401240
push 0x58f8c4
call fcn.00404cc0
mov eax, dword [0x58f8c4]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x405e82
push str.C:SYSTEM.SAVUTILPBARINFO.INI
mov ecx, 0x58f8c4
call fcn.00401240
mov eax, dword [0x58f8c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405eab
lea eax, [ebp - 0x210]
push eax
call fcn.00402770
mov esi, dword [ebp - 0x210]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 4
jmp 0x405eca
push dword [0x58f8c4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push str.CurrentPos
push str.ProgressBarInfo
call ebx
mov dword [0x58f880], eax
push esi
push 0
push str.RebootAfter
push str.Settings
call ebx
push esi
push 0
push str.WaitTime
push str.Settings
mov dword [0x58f884], eax
call ebx
push esi
push 0
push str.MaxTime
push str.Settings
mov dword [section..data], eax
call ebx
push esi
push 0
push str.HideAll
push str.Settings
mov dword [0x58a004], eax
call ebx
push esi
push 0
push str.DebugMode
push str.Settings
mov dword [0x58f88c], eax
call ebx
push esi
push 0
push str.DebugLog
push str.Settings
mov dword [0x58f890], eax
call ebx
push esi
push 0
push str.DISWOW64FR
push str.Settings
mov dword [0x58f8a0], eax
call ebx
push str.DONE
lea ecx, [ebp - 0x218]
mov dword [0x58f8a4], eax
call fcn.00401bb0
test eax, eax
jne 0x406054
push 0x541e08
push dword [ebp - 0x21c]
call fcn.00516912
mov ebx, eax
add esp, 8
mov dword [ebp - 0x220], ebx
test ebx, ebx
je 0x406552
push str._n
push ebx
call fcn.00516927
push str.PININST__Mini_FBI__exits_at:
push ebx
call fcn.00516927
add esp, 0x10
lea eax, [ebp - 0x230]
push eax
call fcn.004028b0
mov ecx, dword [eax]
mov dword [ebp - 0x228], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x224], eax
push str._A___B__d___Y
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402430
mov ebx, dword [eax]
push str._H:_M:_S
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402430
push ebx
push dword [eax]
mov ebx, dword [ebp - 0x220]
push str._s__s_n
push ebx
call fcn.00516927
add esp, 0x10
lea ecx, [ebp - 0x22c]
call fcn.004011b0
lea ecx, [ebp - 0x214]
call fcn.004011b0
push str.CurrentStateDONE_has_been_detected._Exit_program_without_any_process...__n
push ebx
call fcn.00516927
push str._n_n
push ebx
call fcn.00516927
push ebx
call fcn.00516698
lea eax, [ebp - 0x21c]
push eax
call fcn.00405660
add esp, 0x18
jmp 0x406552
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push eax
lea eax, [ebp - 0x108]
push 0x541c98
push eax
call fcn.00516dd7
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push eax
push str.xResolution
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
call ebx
push eax
lea eax, [ebp - 0x108]
push 0x541c98
push eax
call fcn.00516dd7
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push eax
push str.yResolution
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x58f890], 0
jne 0x40612a
push 0
push dword [0x58f8c0]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [0x58f894]
mov edx, 1
test eax, eax
cmovne ecx, edx
mov dword [0x58f894], ecx
call fcn.00402a90
test eax, eax
je 0x406102
push 0x58f8c0
call fcn.00402ac0
add esp, 4
test eax, eax
lea eax, [ebp - 0x210]
push eax
call fcn.00405430
add esp, 4
push 0x58f8b4
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x210]
push eax
call fcn.00402910
jmp 0x406136
lea eax, [ebp - 0x210]
push eax
call fcn.00405430
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1388
call ebx
push str.RunOnceThese
lea ecx, [ebp - 0x218]
call fcn.00401bb0
test eax, eax
jne 0x40619c
push 0x1f4
call ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00403940
mov esi, dword [ebp - 0x210]
add esp, 0xc
push esi
push str.RunThese
push str.CurrentState
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4061a2
mov esi, dword [ebp - 0x210]
push str.Vista
mov ecx, 0x58f8d0
call fcn.00401bb0
test eax, eax
jne 0x4061c5
push str.RunThese
lea ecx, [ebp - 0x218]
call fcn.00401240
push str.RunThese
lea ecx, [ebp - 0x218]
call fcn.00401bb0
test eax, eax
jne 0x40627a
push str.RunThese
lea ecx, [ebp - 0x218]
call fcn.00401240
push 0x1f4
call ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00403940
push str.taskkill.exe__F__IM_AuditShD.exe__T
call fcn.00516f06
add esp, 0x10
push dword [ebp - 0x210]
push str.RunLastThese
push str.CurrentState
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.RunLastThese
lea ecx, [ebp - 0x218]
call fcn.00401240
push 0x1f4
call ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00403940
push str.taskkill.exe__F__IM_AuditShD.exe__T
call fcn.00516f06
mov esi, dword [ebp - 0x210]
add esp, 0x10
push str.RunLastThese
lea ecx, [ebp - 0x218]
call fcn.00401bb0
test eax, eax
jne 0x40632e
push 0x3e8
call ebx
lea eax, [ebp - 0x210]
push eax
call fcn.00405430
mov ecx, dword [0x58f8b4]
mov eax, dword [0x58f8b8]
add esp, 4
cmp ecx, 0x7d0
jne 0x4062ce
cmp eax, 0x4b0
jne 0x4062ce
push 0x1e0
push 0x280
jmp 0x4062d0
push eax
push ecx
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
call eax
cmp dword [0x58f898], 0
jne 0x4062ef
lea eax, [ebp - 0x210]
push eax
call fcn.00401770
add esp, 4
mov esi, dword [ebp - 0x210]
push esi
push str.DONE
push str.CurrentState
push str.Settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
push str.C:SYSTEM.SAVUTILPININST.DON
push esi
call ebx
cmp dword [0x58f898], 0
je 0x40632e
push 4
push esi
push str.C:SYSTEM.SAVUTILPININST.2PP
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push 0
push str.StandAlone
push str.Settings
call ebx
test eax, eax
jne 0x4063d6
push dword [0x58f8c4]
push eax
push str.CurrentPos
push str.ProgressBarInfo
call ebx
push dword [0x58f8c4]
mov ebx, eax
push 0
push 0x5420f0
push str.ProgressBarInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push dword [0x58f8e0]
mov dword [ebp - 0x220], eax
push 0xffffffffffffffff
push str.TotalForPrev
push str.TotalProgress
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, eax
mov eax, dword [ebp - 0x220]
cmp ebx, eax
jne 0x4063d6
add eax, ecx
push eax
lea eax, [ebp - 0x20c]
push 0x541c98
push eax
call fcn.00516dd7
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [0x58f8e0]
push eax
push str.TotalForPrev
push str.TotalProgress
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x541e08
push dword [ebp - 0x21c]
call fcn.00516912
mov ebx, eax
add esp, 8
mov dword [ebp - 0x220], ebx
test ebx, ebx
je 0x4064ac
push str._n
push ebx
call fcn.00516927
push str.PININST__Mini_FBI__exits_at:
push ebx
call fcn.00516927
add esp, 0x10
lea eax, [ebp - 0x230]
push eax
call fcn.004028b0
mov ecx, dword [eax]
mov dword [ebp - 0x228], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x224], eax
push str._A___B__d___Y
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402430
mov ebx, dword [eax]
push str._H:_M:_S
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402430
push ebx
push dword [eax]
mov ebx, dword [ebp - 0x220]
push str._s__s_n
push ebx
call fcn.00516927
add esp, 0x10
lea ecx, [ebp - 0x22c]
call fcn.004011b0
lea ecx, [ebp - 0x214]
call fcn.004011b0
push str._n_n
push ebx
call fcn.00516927
push ebx
call fcn.00516698
lea eax, [ebp - 0x21c]
push eax
call fcn.00405660
add esp, 0x10
cmp dword [0x58f884], 0
je 0x406552
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4064fc
push str.C:SYSTEM.SAVUTILPININST.DON
lea ecx, [ebp - 0x214]
call fcn.004010d0
lea eax, [ebp - 0x214]
push eax
call fcn.00405430
add esp, 4
lea ecx, [ebp - 0x214]
call fcn.004011b0
jmp 0x406511
lea eax, [ebp - 0x210]
push eax
call fcn.00405430
mov esi, dword [ebp - 0x210]
add esp, 4
mov ecx, dword [0x58f8b4]
mov eax, dword [0x58f8b8]
cmp ecx, 0x7d0
jne 0x406537
cmp eax, 0x4b0
jne 0x406537
push 0x1e0
push 0x280
jmp 0x406539
push eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.00405290
test eax, eax
je 0x406552
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x406563
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 1
mov edx, dword [ebp - 0x238]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40658f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x218]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4065ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x23c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4065cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4065e3
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406602
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
pop edi
test ebx, ebx
pop ebx
jg 0x40661b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop esi
call fcn.00517448
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00401700
push 0x80004005
call fcn.00401700
push 0x80004005
call fcn.00401700
push 0x80004005
call fcn.00401700
push 0x80004005
call fcn.00401700
push 0x80004005
call fcn.00401700
int3