Function at 0x471050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb3e4
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004b493e
add esp, 0xc
push str.FortiClient.exe
call fcn.004a7f78
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.0042da70
xorps xmm0, xmm0
mov dword [ebp - 0x2b4], 0x44
add esp, 0x18
movlpd qword [ebp - 0x2b0], xmm0
lea eax, [ebp - 0x234]
movlpd qword [ebp - 0x2a8], xmm0
movlpd qword [ebp - 0x2a0], xmm0
movlpd qword [ebp - 0x298], xmm0
push eax
lea eax, [ebp - 0x2b4]
movlpd qword [ebp - 0x290], xmm0
push eax
movlpd qword [ebp - 0x288], xmm0
movlpd qword [ebp - 0x280], xmm0
movlpd qword [ebp - 0x278], xmm0
movups xmmword [ebp - 0x234], xmm0
call fcn.004a7f78
push eax
push 0
push 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x47117f
push dword [ebp - 0x22c]
push str.CFortiTrayDlg::OpenFCTConsole
push str._ws____CreateProcess___succeed__pid_d
call fcn.004648e0
push str.FortiClient_GUI_started_
call fcn.0045c450
add esp, 0x10
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x471263
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFortiTrayDlg::OpenFCTConsole
push str._ws____CreateProcess___failed__err_d_app_s
call fcn.004648e0
xorps xmm0, xmm0
mov dword [ebp - 0x26c], 0
add esp, 0x10
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x21c]
movlpd qword [ebp - 0x250], xmm0
movlpd qword [ebp - 0x248], xmm0
movlpd qword [ebp - 0x240], xmm0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x270], 0x3c
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], str.open
mov dword [ebp - 0x260], eax
call fcn.004a7f78
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2e4
jne 0x471240
call fcn.004a7fd8
test eax, eax
mov ecx, str.runas
cmove ecx, dword [ebp - 0x264]
mov dword [ebp - 0x264], ecx
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x47129b
push str.CFortiTrayDlg::OpenFCTConsole
push str._ws____ShellExecuteEx___succeed
call fcn.004648e0
add esp, 8
mov esi, 0x14
dec esi
call fcn.004a81d2
test eax, eax
jne 0x471281
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jg 0x471268
call fcn.004a81a2
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 1
mov ecx, edi
call fcn.0046a430
jmp 0x471360
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFortiTrayDlg::OpenFCTConsole
push str._ws____ShellExecuteEx___failed__err_d_app_s
call fcn.004648e0
add esp, 0x10
mov dword [0x50dad0], 0
lea ecx, [ebp - 0x220]
call dword [0x4c5d94]
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 0
push eax
call fcn.0045b1f0
cmp esi, 0x522
jne 0x4712f6
push dword [eax]
mov byte [ebp - 4], 1
push 0x6c
jmp 0x4712fe
push dword [eax]
mov byte [ebp - 4], 2
push 0x6b
lea eax, [ebp - 0x220]
push eax
call dword [0x4c5da4]
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call dword [0x4c5d9c]
mov eax, dword [ebp - 0x220]
lock inc dword [0x541a48]
push 0
push 0
push eax
call fcn.004b31ec
lock dec dword [0x541a48]
push esi
push str.Failed_to_start_FortiClient_GUI__GetLastError_d
call fcn.0045c450
add esp, 8
mov dword [0x50dad0], 1
lea ecx, [ebp - 0x220]
call dword [0x4c5d9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret