Function at 0x420c30
Capabilities:
Create directory
Create process on windows
Delete file
Get common file path
Identify system language via api
Query service status
Reference sql statements
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45170b
mov eax, dword fs:[0]
push eax
mov eax, 0x10a0
call fcn.00429120
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp + 0x14]
push 0x20a
mov dword [ebp - 0x1030], eax
lea eax, [ebp - 0xb90]
push esi
push eax
mov dword [ebp - 0xfd8], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0xfc4], esi
mov byte [ebp - 0xfbd], 0
mov dword [ebp - 0xff4], esi
mov dword [ebp - 0xfdc], esi
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x1018], esi
mov dword [ebp - 0xfe0], esi
call fcn.0042b800
add esp, 0xc
mov dword [ebp - 0x1028], esi
call fcn.00411c30
cmp eax, 2
je 0x420cec
call fcn.00411ce0
mov dword [ebp - 0x100c], 1
test eax, eax
je 0x420cf2
mov dword [ebp - 0x100c], esi
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0xfd8]
push eax
push str.MANIFEST
push 0
call fcn.00419910
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x420d39
push 0
push str.Failed_to_get_manifest_for_setup_chain.
push edi
push 4
push 0xa0c
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x422262
mov eax, dword [ebp - 0xfd8]
push 1
movzx eax, byte [eax + 1]
imul eax, eax, 0x468
push eax
call fcn.004190a0
mov esi, eax
mov dword [ebp - 0xfc4], esi
test esi, esi
jne 0x420d98
mov edi, 0x8007000e
push edi
push 0xa10
push 0x460280
mov dword [ebp - 0xfcc], edi
call fcn.00418700
push esi
push str.Failed_to_allocate_rollback_chain.
push edi
push 4
push 0xa10
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x422262
mov ecx, dword [ebp - 0xfd8]
movzx eax, byte [ecx + 1]
imul eax, eax, 0xa8
add eax, 4
add eax, ecx
cmp dword [0x47bc5c], 0
mov dword [ebp - 0xfc8], eax
je 0x420dd5
cmp dword [ebp + 0x1c], 1
jne 0x420dd5
push 1
push 0
push 0
push 0xd2
call fcn.00422af0
add esp, 0x10
mov eax, dword [ebp - 0xfd8]
xor cl, cl
mov edx, dword [ebp + 0x10]
mov byte [ebp - 0xfbe], cl
cmp byte [eax + 2], cl
jbe 0x420e5f
nop dword [eax + eax]
movzx esi, cl
shl esi, 4
add esi, dword [ebp - 0xfc8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xff0], eax
mov eax, edx
cmp edx, 0xffffffff
jne 0x420e1b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov cl, byte [ebp - 0xfbe]
movzx eax, ax
cmp eax, dword [ebp - 0xff0]
jne 0x420e49
lea eax, [ebp - 0xfdc]
push eax
push esi
call fcn.0041d940
mov edi, eax
add esp, 8
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x420ef2
mov cl, byte [ebp - 0xfbe]
mov eax, dword [ebp - 0xfd8]
inc cl
mov edx, dword [ebp + 0x10]
mov byte [ebp - 0xfbe], cl
cmp cl, byte [eax + 2]
jb 0x420df0
cmp dword [ebp - 0xfdc], 0
mov dword [ebp - 0xff0], 4
jne 0x420f90
mov eax, dword [ebp - 0xfd8]
xor cl, cl
mov byte [ebp - 0xfbe], cl
cmp byte [eax + 2], cl
jbe 0x420f90
nop dword [eax]
movzx esi, cl
mov eax, edx
shl esi, 4
add esi, dword [ebp - 0xfc8]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xfd0], ecx
cmp edx, 0xffffffff
jne 0x420ebb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, dword [ebp - 0xfd0]
movzx eax, ax
mov edx, eax
and edx, 0x3ff
cmp word [ebp - 0xff0], dx
jne 0x420f23
cmp eax, 0xc04
ja 0x420f06
je 0x420f14
cmp eax, 0x404
je 0x420f14
cmp eax, 0x804
jne 0x420ee8
mov eax, 0x804
xor ecx, ecx
cmp eax, dword [ebp - 0xfd0]
jmp 0x420f38
push 0
push str.Failed_to_extract_transform_to_temp_path.
push edi
push 4
push 0xa24
jmp 0x42224f
cmp eax, 0x1004
je 0x420ee3
cmp eax, 0x1404
jne 0x420ee8
mov eax, 0x404
xor ecx, ecx
cmp eax, dword [ebp - 0xfd0]
jmp 0x420f38
and ecx, 0x3ff
mov dword [ebp - 0xfd0], ecx
xor ecx, ecx
cmp dx, word [ebp - 0xfd0]
sete cl
test ecx, ecx
je 0x420f5b
lea eax, [ebp - 0xfdc]
push eax
push esi
call fcn.0041d940
mov edi, eax
add esp, 8
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x420f7c
mov cl, byte [ebp - 0xfbe]
mov eax, dword [ebp - 0xfd8]
inc cl
mov byte [ebp - 0xfbe], cl
cmp cl, byte [eax + 2]
jae 0x420f90
mov edx, dword [ebp + 0x10]
jmp 0x420e90
push 0
push str.Failed_to_extract_transform_to_temp_path.
push edi
push 4
push 0xa35
jmp 0x42224f
mov eax, dword [ebp - 0xfd8]
xor cl, cl
mov byte [ebp - 0xfbe], cl
cmp byte [eax + 1], cl
jbe 0x42225c
mov eax, dword [ebp - 0x1008]
mov edi, 0x45d894
mov dl, byte [ebp - 0xfbd]
test eax, eax
cmovne edi, eax
mov dword [ebp - 0x1040], edi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp - 0xfd8]
mov dword [ebp - 0x1008], eax
add esi, 4
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xfd4], eax
movzx eax, cl
imul ecx, eax, 0xa8
mov dword [ebp - 0x1024], eax
movzx eax, dl
imul eax, eax, 0x468
push 0
push edi
add esi, ecx
mov byte [ebp - 0xffd], dl
mov dword [ebp - 0x1004], esi
add eax, dword [ebp - 0xfc4]
mov dword [ebp - 0xfe8], eax
lea eax, [ebp - 0xfe0]
push eax
call fcn.00428800
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x422240
push 0x27
push dword [ebp - 0xfe8]
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x42222f
test esi, esi
je 0x421086
lea eax, [esi + 0xc]
push str.SslvpnClient.msi
push eax
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x421086
cmp dword [0x47c09c], eax
je 0x421cfc
test dword [esi + 0xa4], 0x100
je 0x4210a1
mov dword [ebp - 0xfd4], 6
jmp 0x42113f
mov eax, dword [ebp + 0x1c]
cmp eax, 7
je 0x42111f
cmp eax, 9
je 0x42111f
mov eax, dword [ebp - 0xfe8]
test eax, eax
jne 0x4210cd
push 0x78a
push 0x460280
call fcn.00418400
mov eax, dword [ebp - 0xfe8]
cmp dword [0x47bc5c], 0
mov dword [ebp - 0x1038], 0x24
je 0x4210ec
mov dword [ebp - 0xfd4], 1
jmp 0x421117
lea ecx, [ebp - 0x1038]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push str.VersionString
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
mov ecx, 1
mov eax, 4
cmove ecx, eax
mov dword [ebp - 0xfd4], ecx
xor edi, edi
mov dword [ebp - 0xfcc], edi
mov eax, dword [ebp - 0xfd4]
test eax, eax
je 0x421cfc
cmp eax, 4
jne 0x42113f
test byte [esi + 0xa4], 0x20
je 0x421d2a
inc byte [ebp - 0xfbd]
lea eax, [ebp - 0xff4]
push eax
push esi
call fcn.0041d610
mov edi, eax
add esp, 8
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x42221e
mov eax, dword [ebp - 0xff4]
xor esi, esi
push 0x208
mov dword [ebp - 0xfc8], eax
lea eax, [ebp - 0xd98]
push esi
push eax
mov dword [ebp - 0xff0], 1
mov dword [ebp - 0xfec], esi
mov dword [ebp - 0xfe4], esi
mov dword [ebp - 0x1020], esi
call fcn.0042b800
add esp, 0xc
mov dword [ebp - 0x101c], 0x104
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0xfd0], esi
push eax
push esi
push dword [ebp - 0xfc8]
call sub.msi.dll_MsiOpenProductW
test eax, eax
jne 0x421267
mov eax, dword [ebp - 0xfec]
test eax, eax
je 0x4211df
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0xfec]
mov dword [ebp - 0xfec], esi
push eax
push 0
push dword [ebp - 0xfc8]
push dword [ebp - 0xfd0]
call sub.msi.dll_MsiGetUserInfoW
test eax, eax
jne 0x421267
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0xd98]
push eax
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0xfe4]
push eax
push 7
push dword [ebp - 0xfec]
call sub.msi.dll_MsiUseFeatureA
test eax, eax
je 0x42123f
cmp dword [ebp - 0xfe4], esi
jne 0x421267
push 0
lea eax, [ebp - 0xd98]
push 0x4603e4
push eax
call fcn.0043b260
push 0x4603e8
push eax
call fcn.0043affb
add esp, 0x14
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov ecx, dword [ebp - 0xfd0]
test ecx, ecx
je 0x42127d
push ecx
call sub.msi.dll_MsiUseFeatureW
mov ecx, dword [ebp - 0xfd0]
mov eax, dword [ebp - 0xfec]
test eax, eax
je 0x421293
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0xfd0]
test ecx, ecx
je 0x42129d
push ecx
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
call fcn.0040c1b0
cmp esi, eax
jne 0x42212b
mov eax, dword [0x47c2b8]
cmp eax, 2
je 0x4212b9
cmp eax, 3
jne 0x4212d3
call fcn.004195c0
test al, al
jne 0x421ffa
call fcn.004196f0
test al, al
jne 0x421ffa
mov ecx, dword [ebp - 0x1004]
push 0xb
push str.FortiClient
lea eax, [ecx + 0xc]
push eax
mov dword [ebp - 0x101c], eax
call fcn.0043b3f6
add esp, 0xc
test eax, eax
jne 0x4214c5
mov esi, dword [ebp - 0xfd4]
cmp esi, 4
jne 0x4214a6
push 0x80
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0042b800
add esp, 0xc
mov dword [ebp - 0xfec], 0x40
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0xe0]
push eax
push str.VersionString
push 0x47c0a8
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x4214a6
lea ecx, [ebp - 0xfc8]
mov dword [ebp - 0xfc8], eax
call fcn.0040f010
push eax
push 0
push dword [ebp - 0xff4]
call sub.msi.dll_MsiOpenProductW
test eax, eax
jne 0x421496
push 0x80
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0042b800
mov esi, dword [ebp - 0xfc8]
lea ecx, [ebp - 0xfd0]
add esp, 0xc
mov dword [ebp - 0xfec], 0x40
mov dword [ebp - 0xfd0], 0
mov dword [ebp - 0xfe4], 0
call fcn.0040f010
push eax
push str.SELECT__Property_._Value__FROM__Property__WHERE__Property_._Property_ProductVersion
push esi
call sub.msi.dll_MsiEnumClientsA
test eax, eax
jne 0x421470
push eax
push dword [ebp - 0xfd0]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x421470
mov esi, dword [ebp - 0xfd0]
lea ecx, [ebp - 0xfe4]
call fcn.0040f010
push eax
push esi
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x421470
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0x160]
push eax
push 1
push dword [ebp - 0xfe4]
call sub.msi.dll_MsiRecordSetStreamA
test eax, eax
jne 0x421470
lea ecx, [ebp - 0x160]
lea eax, [ebp - 0xe0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42144d
test dx, dx
je 0x421449
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42144d
add eax, 4
add ecx, 4
test dx, dx
jne 0x421427
xor eax, eax
jmp 0x421452
sbb eax, eax
or eax, 1
test eax, eax
jne 0x421470
mov eax, dword [ebp - 0x1004]
mov esi, 8
mov dword [ebp - 0xfd4], esi
and dword [eax + 0xa4], 0xfffffffb
jmp 0x421476
mov esi, dword [ebp - 0xfd4]
mov eax, dword [ebp - 0xfe4]
test eax, eax
je 0x421486
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [ebp - 0xfd0]
test eax, eax
je 0x421496
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov eax, dword [ebp - 0xfc8]
test eax, eax
je 0x4214a6
push eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [0x47c09c], 0
je 0x4214c5
cmp esi, 8
jne 0x4214c5
mov dl, byte [ebp - 0xffd]
mov byte [ebp - 0xfbd], dl
jmp 0x421d02
mov edx, dword [ebp - 0xfe8]
mov ecx, 0x104
mov esi, dword [ebp - 0xff4]
add edx, 0x4e
nop dword [eax]
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x421500
movzx eax, word [esi]
test ax, ax
je 0x421500
mov word [edx], ax
add esi, 2
add edx, 2
sub ecx, 1
jne 0x4214e0
test ecx, ecx
lea eax, [edx - 2]
mov edi, 0x8007007a
cmovne eax, edx
xor edx, edx
mov word [eax], dx
xor eax, eax
test ecx, ecx
cmovne edi, eax
mov dword [ebp - 0xfcc], edi
je 0x421fe6
mov esi, dword [ebp - 0x1004]
cmp dword [ebp - 0xfdc], eax
je 0x421618
test byte [esi + 0xa4], 0x80
je 0x421618
push eax
push str._TRANSFORMS_
lea eax, [ebp - 0xfe0]
push eax
call fcn.00428450
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x421db7
mov eax, dword [esi + 0xa4]
test al, 4
je 0x4215ee
lea ecx, [ebp - 0x1018]
and eax, 1
push ecx
push eax
push dword [ebp - 0xfdc]
push esi
call fcn.0041bc00
mov edi, eax
add esp, 0x10
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x421d8f
mov eax, dword [ebp - 0xfdc]
test eax, eax
je 0x4215b4
push eax
call fcn.00428900
mov dword [ebp - 0xfdc], 0
push 0
push dword [ebp - 0x1018]
call fcn.00418f60
push eax
lea eax, [ebp - 0xfe0]
push eax
call fcn.00428450
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x421618
push 0
push str.Failed_to_append_transform_filename_to_MSI_args.
push edi
push 4
push 0xae7
jmp 0x42224f
push 0
push dword [ebp - 0xfdc]
call fcn.00418f60
push eax
lea eax, [ebp - 0xfe0]
push eax
call fcn.00428450
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x421da3
mov eax, dword [esi + 0xa4]
test al, 4
je 0x42176d
mov esi, dword [ebp - 0xff4]
test al, 1
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
lea ecx, [ebp - 0xfa0]
push ecx
push 0
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x42167e
push 0
push str.Failed_to_get_local_app_data_folder.
push edi
push 4
push 0x709
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x4216d0
push 0x27
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x1004]
add eax, 0x8c
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x4216c0
push 0
push str.Failed_to_convert_ProductCode_GUID_to_string.
push edi
push 4
push 0x70c
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x4216d0
lea eax, [ebp - 0x102c]
push eax
push esi
call fcn.00410d40
add esp, 8
test edi, edi
js 0x421df6
mov esi, dword [ebp - 0x102c]
mov dword [ebp - 0xff8], esi
test esi, esi
je 0x421ddf
mov edx, dword [ebp - 0xfe8]
mov ecx, 0x104
mov dword [ebp - 0xff0], 0
add edx, 0x256
nop word [eax + eax]
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x421730
movzx eax, word [esi]
test ax, ax
je 0x421730
mov word [edx], ax
add esi, 2
add edx, 2
sub ecx, 1
jne 0x421710
test ecx, ecx
lea eax, [edx - 2]
mov edi, 0x8007007a
cmovne eax, edx
xor edx, edx
mov word [eax], dx
xor eax, eax
test ecx, ecx
cmovne edi, eax
mov dword [ebp - 0xfcc], edi
je 0x421dcb
mov eax, dword [ebp - 0xfe8]
mov esi, dword [ebp - 0x1004]
mov dword [eax + 0x460], 1
jmp 0x4217bb
cmp dword [ebp - 0xfd4], 8
jne 0x4217af
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x1020], 0x105
push eax
lea eax, [ebp - 0xb90]
push eax
push str.LocalPackage
push 0x47c0a8
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x4217bb
lea ecx, [ebp - 0xb90]
mov dword [ebp - 0xff8], ecx
jmp 0x4217bb
mov eax, dword [ebp - 0xff4]
mov dword [ebp - 0xff8], eax
mov eax, dword [esi + 0xa4]
test al, 8
jne 0x4217da
test al, 0x10
mov ecx, 3
mov eax, 0x43
cmovne ecx, eax
mov dword [ebp - 0x1008], ecx
push esi
call fcn.00420610
add esp, 4
test eax, eax
je 0x421801
mov eax, dword [ebp - 0xfd4]
cmp eax, 1
je 0x4217f7
cmp eax, 5
jne 0x421801
mov dword [0x47c0a0], 1
mov eax, dword [ebp - 0xfd8]
movzx eax, byte [eax + 1]
dec eax
cmp dword [ebp - 0x1024], eax
jne 0x421850
cmp dword [0x47c2b4], 0
je 0x42187c
push 0
push str._REBOOTForce
lea eax, [ebp - 0xfe0]
push eax
call fcn.00428450
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x42187c
push 0
push str.failed_to_format_properties:_REBOOTForce
push edi
push 4
push 0xb2c
jmp 0x42224f
cmp dword [0x47c09c], 0
je 0x42187c
push 0
push str._REBOOTReallySuppress
lea eax, [ebp - 0xfe0]
push eax
call fcn.00428450
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x421e0a
cmp dword [0x47bc5c], 0
jne 0x421c35
cmp dword [ebp - 0x100c], 0
je 0x421c3e
push 0x822
lea eax, [ebp - 0x984]
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x984]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
push str._fctinstaller_
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
lea eax, [ebp - 0x984]
push eax
call fcn.0043b2c1
push 0xffffffffffffffff
push str.FortiClientInstaller.exe
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
lea eax, [ebp - 0x984]
push eax
push 0x73
push 0x17
call fcn.0041d580
add esp, 0x30
lea ecx, [ebp - 0x10ac]
xor esi, esi
mov dword [ebp - 0x1014], esi
mov dword [ebp - 0x1010], esi
mov dword [ebp - 0xffc], esi
call fcn.0040c260
lea eax, [ebp - 0xffc]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x984]
push eax
lea ecx, [ebp - 0x10ac]
call fcn.0040cd70
mov edi, dword [ebp - 0x1014]
test eax, eax
je 0x4219de
mov ecx, str.Fortinet_Technologies__Canada__Inc.
mov eax, edi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421996
test dx, dx
je 0x421992
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421996
add eax, 4
add ecx, 4
test dx, dx
jne 0x421970
xor eax, eax
jmp 0x42199b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4219d9
mov ecx, str.Fortinet_Technologies
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4219cc
test dx, dx
je 0x4219c8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4219cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4219a6
xor eax, eax
jmp 0x4219d1
sbb eax, eax
or eax, 1
test eax, eax
je 0x4219d9
xor esi, esi
jmp 0x4219de
mov esi, 1
test edi, edi
je 0x4219e9
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1010]
test eax, eax
je 0x4219fa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xffc]
test eax, eax
je 0x421a0f
push 1
push eax
call fcn.00428a68
add esp, 8
test esi, esi
je 0x421f26
mov edi, dword [ebp - 0x101c]
lea eax, [ebp - 0xffc]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x1014]
push eax
push edi
lea ecx, [ebp - 0x10ac]
call fcn.0040cd70
mov ecx, dword [ebp - 0x1014]
mov esi, eax
test ecx, ecx
je 0x421a58
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x1010]
test ecx, ecx
je 0x421a69
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xffc]
test eax, eax
je 0x421a7e
push 1
push eax
call fcn.00428a68
add esp, 8
test esi, esi
je 0x421e66
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0x44
push 0xffffffffffffffff
push str.___msi
lea eax, [ebp - 0x984]
movlpd qword [ebp - 0x54], xmm0
push 0x411
push eax
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movups xmmword [ebp - 0x1050], xmm0
call fcn.0043d09d
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
mov ecx, dword [ebp - 0xfe0]
add esp, 0x20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421af7
sub ecx, edx
sar ecx, 1
je 0x421b3c
push 0xffffffffffffffff
push str.___msiparams
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
push 0xffffffffffffffff
push dword [ebp - 0xfe0]
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
add esp, 0x20
mov esi, dword [ebp - 0x1030]
test esi, esi
je 0x421b90
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421b50
sub ecx, edx
sar ecx, 1
je 0x421b90
push 0xffffffffffffffff
push str.___log
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x984]
push 0x411
push eax
call fcn.0043d09d
add esp, 0x20
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x984]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x421bf4
push 0xffffffffffffffff
push dword [ebp - 0x1050]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x104c]
test eax, eax
je 0x421bd9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x421bea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0xfcc], edi
jmp 0x421c1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jle 0x421c17
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xfcc], edi
test edi, edi
js 0x421e1e
lea ecx, [ebp - 0x10ac]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c3d0
mov esi, dword [ebp - 0x1004]
cmp dword [ebp - 0x100c], 0
jne 0x421ca5
mov ecx, dword [esi + 0xa4]
mov eax, ecx
and eax, 0x200
and ecx, 0x10
push eax
push ecx
push dword [ebp - 0x1008]
lea eax, [esi + 0xc]
mov esi, dword [ebp - 0xfe8]
push dword [ebp - 0xfd4]
push dword [ebp - 0x1030]
push dword [ebp - 0xfe0]
push dword [ebp - 0xff8]
push eax
push esi
call fcn.0041c770
mov edi, eax
add esp, 0x24
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x421cab
push dword [ebp - 0xff8]
push str.Failed_to_launch_and_wait_for_cached_MSI:__ls
push edi
push 4
push 0xbb3
jmp 0x42224f
mov esi, dword [ebp - 0xfe8]
cmp edi, 1
jne 0x421cdd
cmp dword [esi + 0x460], 0
je 0x421ce7
add esi, 0x256
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0xfe8]
mov dword [eax + 0x460], 0
jmp 0x421ce7
mov dword [esi + 0x464], 1
cmp dword [ebp - 0xff0], 0
je 0x421cfc
push dword [ebp - 0xff4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dl, byte [ebp - 0xfbd]
mov cl, byte [ebp - 0xfbe]
mov eax, dword [ebp - 0xfd8]
inc cl
mov byte [ebp - 0xfbe], cl
cmp cl, byte [eax + 1]
jae 0x42225c
mov edi, dword [ebp - 0x1040]
jmp 0x420fd0
push 0
push 0
lea eax, [ebp - 0x1028]
mov edi, 0x80070666
push eax
push 0x400
push edi
push 0
push 0x1100
mov dword [ebp - 0xfcc], edi
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x421d77
cmp dword [0x47bc5c], 0
jne 0x421d77
push 0
push 0x10
push str.Install_Error
push dword [ebp - 0x1028]
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
push str.Cannot_upgrade_previously_installed_package.
push 0x80070666
push 4
push 0xa6e
jmp 0x42224f
push 0
push str.Failed_to_cache_MST_file.
push edi
push 4
push 0xae0
jmp 0x42224f
push 0
push str.Failed_to_append_transform_filename_to_MSI_args.
push edi
push 4
push 0xaed
jmp 0x42224f
push 0
push str.Failed_to_append_TRANSFORMS_property_to_MSI_args.
push edi
push 4
push 0xada
jmp 0x42224f
push 0
push str.Failed_to_copy_cached_path_into_rollback_chain.
push edi
push 4
push 0xb01
jmp 0x42224f
push str.ProcessSetupChain
push str._ws____Failed_to_get_cached_MSI_file_path.
call fcn.00420880
add esp, 8
jmp 0x42225c
push 0
push str.Failed_to_cache_MSI_file.
push edi
push 4
push 0xaf6
jmp 0x42224f
push 0
push str.failed_to_format_properties:_REBOOTReallySuppress
push edi
push 4
push 0xb32
jmp 0x42224f
push edi
push 0xba7
push 0x460280
call fcn.00418700
lea eax, [ebp - 0x984]
push eax
push str.Failed_to_CreateProcess:__S
push edi
push 4
push 0xba7
push 0x460280
call fcn.004188c0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.0040c3d0
jmp 0x42225c
lea eax, [ebp - 0xfc8]
mov dword [ebp - 0xfc8], 0
push eax
push 0x7e5
push dword [0x47c094]
call fcn.00419af0
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x421ec6
push 0
push str.Failed_to_load_product_conflict_message.
push edi
push 4
push 0xb81
push 0x460280
call fcn.004188c0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.0040c3d0
jmp 0x42225c
cmp dword [0x47bc5c], 0
jne 0x421ee4
push 0x10010
push 0
push dword [ebp - 0xfc8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0xfc8]
test eax, eax
je 0x421ef4
push eax
call fcn.00428900
push 0
push str.msi_is_not_signed
push 4
push 0xb88
push 0x460280
call fcn.00418730
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.0040c3d0
jmp 0x42225c
lea eax, [ebp - 0xfc8]
mov dword [ebp - 0xfc8], 0
push eax
push 0x7e5
push dword [0x47c094]
call fcn.00419af0
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x421f86
push 0
push str.Failed_to_load_IDS_ADMIN_RIGHTS_message.
push edi
push 4
push 0xb6a
push 0x460280
call fcn.004188c0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.0040c3d0
jmp 0x42225c
cmp dword [0x47bc5c], 0
jne 0x421fa4
push 0x10010
push 0
push dword [ebp - 0xfc8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0xfc8]
test eax, eax
je 0x421fb4
push eax
call fcn.00428900
push 0
push str.FortiClientInstaller.exe_is_not_signed
push 4
push 0xb71
push 0x460280
call fcn.00418730
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ac]
call fcn.0040c3d0
jmp 0x42225c
push 0
push str.Failed_to_copy_temp_path_into_rollback_chain.
push edi
push 4
push 0xad3
jmp 0x42224f
lea eax, [ebp - 0xfc8]
mov dword [ebp - 0xfe4], 0
push eax
push 0xc739
push dword [0x47c094]
mov dword [ebp - 0xfc8], 0
mov dword [ebp - 0xff8], 0
mov dword [ebp - 0xffc], 0
call fcn.00419af0
lea eax, [ebp - 0xfe4]
push eax
push dword [0x47c2b8]
call fcn.004264a0
add esp, 8
lea eax, [ebp - 0xff8]
push eax
push 0x7e0
push dword [0x47c094]
call fcn.00419af0
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x422085
push 0
push str.Failed_to_load_product_conflict_message.
push edi
push 4
push 0xa99
jmp 0x42224f
push dword [ebp - 0xfc8]
lea eax, [ebp - 0xffc]
push dword [ebp - 0xff8]
push eax
call fcn.004285e0
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x4220c0
push 0
push str.Failed_to_set_display_with_product_names
push edi
push 4
push 0xa9c
jmp 0x42224f
cmp dword [0x47bc5c], 0
jne 0x4220e2
push 0x10010
push dword [ebp - 0xfe4]
push dword [ebp - 0xffc]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0xfc8]
test eax, eax
je 0x4220f2
push eax
call fcn.00428900
mov eax, dword [ebp - 0xfe4]
test eax, eax
je 0x422102
push eax
call fcn.00428900
mov eax, dword [ebp - 0xff8]
test eax, eax
je 0x422112
push eax
call fcn.00428900
mov eax, dword [ebp - 0xffc]
test eax, eax
je 0x42225c
push eax
call fcn.00428900
jmp 0x42225c
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0xfd0], 0
push eax
push dword [0x47c2b8]
mov dword [ebp - 0xfc8], 0
call fcn.004264a0
add esp, 8
mov edi, eax
cmp dword [ebp - 0xfd0], 0
mov dword [ebp - 0xfcc], edi
jne 0x422184
lea eax, [ebp - 0xfd0]
push eax
push 0xc739
push dword [0x47c094]
call fcn.00419af0
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x42219c
push 0
push str.Failed_to_load_product_name.
push edi
push 4
push 0xa82
jmp 0x42224f
lea eax, [ebp - 0xfc8]
push eax
call fcn.0040c1b0
neg eax
sbb eax, eax
add eax, 0x7df
push eax
push dword [0x47c094]
call fcn.00419af0
mov edi, eax
mov dword [ebp - 0xfcc], edi
test edi, edi
jns 0x4221da
push 0
push str.Failed_to_load_reboot_message.
push edi
push 4
push 0xa85
jmp 0x42224f
cmp dword [0x47bc5c], 0
jne 0x4221fc
push 0x10010
push dword [ebp - 0xfd0]
push dword [ebp - 0xfc8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0xfd0]
test eax, eax
je 0x42220c
push eax
call fcn.00428900
mov eax, dword [ebp - 0xfc8]
test eax, eax
je 0x42225c
push eax
call fcn.00428900
jmp 0x42225c
push 0
push str.Failed_to_extract_MSI_to_temp_path.
push edi
push 4
push 0xa75
jmp 0x42224f
push 0
push str.Failed_to_convert_ProductCode_GUID_to_string.
push edi
push 4
push 0xa47
jmp 0x42224f
push 0
push str.Failed_to_allocate_string_for_MSI_arguments.
push edi
push 4
push 0xa44
push 0x460280
call fcn.004188c0
add esp, 0x18
mov esi, dword [ebp - 0xfc4]
cmp dword [ebp - 0x100c], 0
je 0x4222d6
mov al, byte [ebp - 0xfbd]
test al, al
je 0x42256a
movzx ecx, al
add esi, 0x4e
mov dword [ebp - 0xfc8], ecx
nop word [eax + eax]
cmp word [esi + 0x208], 0
lea eax, [esi + 0x208]
je 0x4222ad
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfc8]
cmp word [esi], 0
je 0x4222c0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfc8]
add esi, 0x468
sub ecx, 1
mov dword [ebp - 0xfc8], ecx
jne 0x422290
jmp 0x42256a
push 0
push str.Install_Config
push 1
push 0xbde
push 0x460280
call fcn.00418730
push str.Install_config_file_s_
call fcn.00420880
add esp, 0x18
cmp dword [0x479b04], 0
je 0x422320
cmp dword [0x479b08], 8
mov eax, 0x479af4
cmovae eax, dword [0x479af4]
push eax
call fcn.0041ff10
add esp, 4
call fcn.004236c0
cmp dword [0x47c0a0], 0
je 0x422401
cmp dword [0x47c0a4], 0
je 0x422401
cmp dword [0x47c09c], 0
je 0x422401
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xff0], eax
test eax, eax
je 0x422401
cmp dword [str.Fortips], 0
je 0x4223fa
xor ecx, ecx
xor edi, edi
nop word [eax + eax]
push 0xf01ff
push dword [ecx + 0x45ef14]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x4223e1
lea eax, [ebp - 0xfbc]
mov dword [ebp - 0xfa4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0xfbc], xmm0
movq qword [ebp - 0xfac], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4223da
cmp dword [ebp - 0xfb8], 1
jne 0x4223da
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xff0]
inc edi
imul ecx, edi, 0x34
cmp dword [ecx + 0x45ef10], 0
jne 0x422380
mov edi, dword [ebp - 0xfcc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jns 0x422496
cmp edi, 0x80070bc2
je 0x422496
cmp edi, 0x80070bc3
je 0x422496
cmp edi, 0x80070669
je 0x422496
mov al, byte [ebp - 0xfbd]
test al, al
je 0x42256a
mov esi, dword [ebp - 0xfc4]
movzx ecx, al
add esi, 0x4e
mov dword [ebp - 0xfc8], ecx
nop word [eax + eax]
cmp word [esi + 0x208], 0
lea eax, [esi + 0x208]
je 0x42246d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfc8]
cmp word [esi], 0
je 0x422480
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfc8]
add esi, 0x468
sub ecx, 1
mov dword [ebp - 0xfc8], ecx
jne 0x422450
jmp 0x42256a
push 0
push str.Install_Config
push 1
push 0xc10
push 0x460280
call fcn.00418730
push str.Install_config_file_s_
call fcn.00420880
push 0
call fcn.0041ff10
add esp, 0x1c
call fcn.004236c0
cmp dword [0x479b64], 0
je 0x4224ff
cmp dword [0x479b68], 8
mov eax, 0x479b54
cmovae eax, dword [0x479b54]
push eax
call fcn.0041ff10
add esp, 4
cmp dword [0x47bc5c], 0
je 0x4224fa
call fcn.00422740
call fcn.00426e50
cmp dword [0x47bc04], 0
je 0x422541
cmp dword [0x47c2b4], 0
push 0
je 0x422533
push str.Notify_reboot
push 1
push 0xc20
push 0x460280
call fcn.00418730
add esp, 0x14
call fcn.00426730
jmp 0x42256a
push str.StartFCT
push 1
push 0xc26
jmp 0x422558
cmp dword [0x479b04], 0
je 0x42256a
push 0
push str.StartFCT
push 1
push 0xc2d
push 0x460280
call fcn.00418730
add esp, 0x14
call fcn.00426e50
mov eax, dword [ebp - 0xfdc]
test eax, eax
je 0x42257b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xfc4]
test eax, eax
je 0x42258b
push eax
call fcn.004190d0
mov eax, dword [ebp - 0x1028]
test eax, eax
je 0x42259c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xff4]
test eax, eax
je 0x4225ac
push eax
call fcn.00428900
mov eax, dword [ebp - 0xfdc]
test eax, eax
je 0x4225bc
push eax
call fcn.00428900
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x4225cf
push eax
call fcn.0043b170
add esp, 4
mov eax, dword [ebp - 0x1018]
test eax, eax
je 0x4225df
push eax
call fcn.00428900
mov eax, dword [ebp - 0xfe0]
test eax, eax
je 0x4225ef
push eax
call fcn.00428900
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret