Function at 0x41e13e
Capabilities:
Create directory
Query environment variable

Disassembly:
push 0x298
mov eax, 0x44c7a2
call fcn.00423e41
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x270], esi
mov ebx, eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
push str.06000000FVEN00100_0.0_0000000000
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], eax
call fcn.0040a1b3
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x258]
call fcn.00409fdb
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.0040b224
push str.06000000FVEN00600_0.0_0000000000
lea ecx, [ebp - 0x234]
call fcn.0040a1b3
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x258]
call fcn.00409fdb
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.0040b224
push str.06000000FVDB00000_0.0_0000000000
lea ecx, [ebp - 0x234]
call fcn.0040a1b3
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x258]
call fcn.00409fdb
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.0040b224
push str.06000000FVDB00100_0.0_0000000000
lea ecx, [ebp - 0x234]
call fcn.0040a1b3
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x258]
call fcn.00409fdb
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.0040b224
push str.06000000FVDB01300_0.0_0000000000
lea ecx, [ebp - 0x234]
call fcn.0040a1b3
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x258]
call fcn.00409fdb
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.0040b224
push str.06000000FVEN01200_0.0_0000000000
lea ecx, [ebp - 0x234]
call fcn.0040a1b3
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x258]
call fcn.00409fdb
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.0040b224
push 0x30
lea eax, [ebp - 0x2a4]
push ebx
push eax
call fcn.00425c30
lea eax, [ebp - 0x2a4]
push eax
call sym.FortiClientInstaller.exe_FCP_init_response
mov eax, dword [esi + 4]
add esp, 0x10
mov ecx, dword [esi]
xor edi, edi
sub eax, ecx
mov esi, 0x108
cdq
idiv esi
mov dword [ebp - 0x274], esi
test eax, eax
je 0x41e3ef
xor esi, esi
lea eax, [ecx + esi]
push 0
lea ecx, [ebp - 0x2a4]
push ecx
lea ecx, [ebp - 0x258]
push ecx
push eax
push 0
call fcn.0041cae1
add esp, 0x14
test eax, eax
lea eax, [ebp - 0x2a4]
jne 0x41e365
push eax
call fcn.0041d98e
lea eax, [ebp - 0x2a4]
push eax
call sym.FortiClientInstaller.exe_FCP_clear_response
mov eax, 0x108
inc edi
add esi, eax
mov eax, dword [ebp - 0x270]
pop ecx
pop ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
cdq
idiv dword [ebp - 0x274]
cmp edi, eax
jb 0x41e2fe
mov esi, dword [ebp - 0x25c]
jmp 0x41e3f1
push 0x453e44
mov edi, str.FVDB
push edi
push eax
call fcn.0041becd
push 0x453e48
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x2a4]
push edi
push eax
call fcn.0041becd
mov esi, 0x453e4c
mov dword [ebp - 0x268], eax
push esi
lea eax, [ebp - 0x2a4]
push edi
push eax
call fcn.0041becd
push esi
mov dword [ebp - 0x26c], eax
mov ebx, str.FVEN
lea eax, [ebp - 0x2a4]
push ebx
push eax
call fcn.0041becd
push 0x453e50
mov esi, eax
lea eax, [ebp - 0x2a4]
push ebx
push eax
call fcn.0041becd
push 0x453e54
mov edi, eax
lea eax, [ebp - 0x2a4]
push ebx
push eax
call fcn.0041becd
add esp, 0x48
mov ebx, eax
jmp 0x41e3f3
mov esi, edi
mov edi, esi
and dword [ebp - 0x23c], 0
xor eax, eax
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
mov byte [ebp - 4], 7
test ebx, ebx
je 0x41e53d
push 0x20a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00425c30
add esp, 0xc
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41e473
push str.c:FortiClient_temp_
call fcn.0042d325
pop ecx
push eax
push str.c:FortiClient_temp_
lea ecx, [ebp - 0x24c]
call fcn.004092cf
cmp dword [ebp - 0x238], 8
lea eax, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x24c]
push eax
call fcn.00431193
pop ecx
jmp 0x41e4aa
push 0x104
lea eax, [ebp - 0x21c]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
call fcn.0042d325
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.004092cf
cmp dword [ebp - 0x23c], 0
je 0x41e4cf
push 0x4658d0
call fcn.0042d325
pop ecx
push eax
push 0x4658d0
lea ecx, [ebp - 0x24c]
call fcn.00408729
push 0x453e58
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41e4f2
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x234]
call fcn.004086f1
push str.FCPreScan_vir_sig
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41e529
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x234]
call fcn.004086f1
push str.FortiClientOfflineVirusCleaner.exe
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 8
jb 0x41e564
mov eax, dword [eax]
push eax
push ebx
call fcn.0041c36c
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.004086f1
push str.FCPreScanlibav.dll
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
push 8
pop ebx
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], ebx
jb 0x41e5a5
mov eax, dword [eax]
push eax
push esi
call fcn.0041c36c
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.004086f1
push str.FCPreScanmdare.dll
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], ebx
jb 0x41e5e3
mov eax, dword [eax]
push eax
push edi
call fcn.0041c36c
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.004086f1
push str.FCPreScan_vir_sig_vir_high
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x14], ebx
jb 0x41e621
mov eax, dword [eax]
push eax
push dword [ebp - 0x264]
call fcn.0041c36c
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.004086f1
push str.FCPreScan_vir_sig_vir_ext
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], ebx
jb 0x41e664
mov eax, dword [eax]
push eax
push dword [ebp - 0x268]
call fcn.0041c36c
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.004086f1
push str.FCPreScan_vir_sigmdare_sig
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d592
add esp, 0xc
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x14], ebx
jb 0x41e6a7
mov eax, dword [eax]
push eax
push dword [ebp - 0x26c]
call fcn.0041c36c
pop ecx
pop ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.004086f1
lea eax, [ebp - 0x2a4]
push eax
call fcn.0041d98e
pop ecx
lea ecx, [ebp - 0x24c]
call fcn.004086f1
lea ecx, [ebp - 0x258]
call fcn.0040b1cb
xor eax, eax
call fcn.00423deb
ret