Function at 0x41daf0
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45168c
mov eax, dword fs:[0]
push eax
mov eax, 0x18fc
call fcn.00429120
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x848]
push 0x20a
push 0
push eax
mov dword [ebp - 0x18e8], esi
call fcn.0042b800
test esi, esi
mov eax, 0x45d894
cmovne eax, esi
push eax
push dword [0x47bc04]
lea eax, [ebp - 0x848]
push str.InstEntrance
push str._ws____g_bRunningAsService_d__cmdline_ws
push 0x104
push eax
call fcn.00410d00
lea eax, [ebp - 0x848]
push eax
call fcn.00420880
add esp, 0x28
mov dword [ebp - 0x18c0], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18cc], 0
mov dword [ebp - 0x18f4], 0
mov dword [ebp - 0x18e0], 0
mov dword [ebp - 0x18c4], 0
mov dword [ebp - 0x18d4], 0
mov dword [ebp - 0x1904], 0
mov dword [ebp - 0x1908], 0
mov dword [ebp - 0x18f0], 0
mov dword [ebp - 0x18dc], 0
mov dword [ebp - 0x18ec], 0
mov dword [ebp - 0x18d8], 0xffffffff
mov dword [ebp - 0x18e4], 5
mov dword [ebp - 0x18c8], 0
mov dword [ebp - 0x1900], 0
mov dword [ebp - 0x18bc], 0
call fcn.00419520
cmp eax, 1
jne 0x41dcb0
push 0
lea eax, [ebp - 0x18b8]
mov dword [ebp - 0x18f8], 0
push eax
lea eax, [ebp - 0x18d0]
mov dword [ebp - 0x18d0], 0
push eax
lea eax, [ebp - 0x18f8]
mov dword [ebp - 0x18b8], 0
push eax
call fcn.00419380
push str.FA_Scheduler
call fcn.00416580
imul eax, dword [ebp - 0x18f8], 0x64
add esp, 0x14
add eax, dword [ebp - 0x18d0]
imul eax, eax, 0x64
add eax, dword [ebp - 0x18b8]
cmp eax, 0xc55c
jb 0x41dcb0
push str.FA_Scheduler
call fcn.00416580
add esp, 4
cmp eax, 2
je 0x41dd31
cmp eax, 4
je 0x41dd31
call fcn.00411c30
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x18d0], ecx
test eax, eax
je 0x41dd04
call fcn.00411a10
test eax, eax
jne 0x41dcd8
call fcn.004119c0
test eax, eax
je 0x41dce4
mov esi, dword [ebp - 0x18d0]
test esi, esi
jne 0x41dcfd
jmp 0x41dcea
mov esi, dword [ebp - 0x18d0]
call fcn.004119f0
test eax, eax
je 0x41dd0a
call fcn.00411cd0
cmp eax, 3
je 0x41dd0a
mov edi, 1
jmp 0x41dd0c
mov esi, dword [ebp - 0x18d0]
xor edi, edi
push edi
push esi
push str.bUserIsAdmin_d_bUserIsElevated_d
call fcn.0041d160
add esp, 0xc
test esi, esi
je 0x41fc53
test edi, edi
je 0x41fc53
mov esi, dword [ebp - 0x18e8]
lea eax, [ebp - 0x18c0]
mov dword [ebp - 0x18d0], 1
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x18b8], edi
test edi, edi
jne 0x41dda5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41dd6a
movzx esi, si
or esi, 0x80070000
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x10bd
push 0x460280
call fcn.00418700
push 0
push str.Failed_to_get_command_line.
push esi
push 4
push 0x10bd
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push 0x425cb0
call fcn.0041d4d0
mov esi, 1
mov dword [ebp - 0x18e8], 0
add esp, 8
cmp dword [ebp - 0x18c0], esi
jle 0x41df24
nop
mov eax, dword [edi + esi*4]
lea edi, [edi + esi*4]
movzx ecx, word [eax]
cmp ecx, 0x2d
je 0x41dde7
cmp ecx, 0x2f
jne 0x41e805
push 0xffffffffffffffff
push 0x4647f0
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41e7dd
mov eax, dword [edi]
push 0xffffffffffffffff
push str.extract
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41e7dd
mov eax, dword [edi]
push 0xffffffffffffffff
push 0x464838
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41de72
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e82a
mov edi, dword [ebp - 0x18b8]
mov dword [ebp - 0x18cc], 1
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x18e0], eax
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.msicl
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41debe
mov edi, dword [ebp - 0x18b8]
inc esi
push 0
mov eax, dword [edi + esi*4]
push eax
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
push 0
push 0x45d3d8
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
jmp 0x41df0d
mov eax, dword [edi]
push 1
push 0x46487c
push 1
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
mov eax, dword [edi]
jne 0x41e167
push 0
add eax, 4
push eax
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
push 0
push 0x45d3d8
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
mov edi, dword [ebp - 0x18b8]
mov eax, dword [ebp - 0x18bc]
inc esi
cmp esi, dword [ebp - 0x18c0]
jl 0x41ddd0
test eax, eax
jne 0x41df37
push 0
push str.DONT_PROMPT_REBOOT1
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
call fcn.0041c4a0
test eax, eax
jne 0x41e0ed
mov eax, dword [ebp - 0x18d4]
mov ecx, str._empty_
test eax, eax
cmovne ecx, eax
push ecx
push str.Log_path_is__s
call fcn.00420880
add esp, 8
cmp dword [0x47bc5c], 0
je 0x41e05c
push 0x20a
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dfa0
sub ecx, edx
lea eax, [ebp - 0x224]
sar ecx, 1
push ecx
push eax
mov ecx, 0x479b24
call fcn.0040cfe0
push 0x18
push str.FortiEMSInstaller_logs_
mov ecx, 0x479b24
call fcn.00413c10
cmp dword [0x479b38], 8
mov eax, 0x479b24
cmovae eax, dword [0x479b24]
push eax
call fcn.0043b2c1
add esp, 4
mov ecx, 0x479b24
push 0x11
push str.fctinstalllog.log
call fcn.00413c10
cmp dword [0x479b38], 8
mov eax, 0x479b24
cmovae eax, dword [0x479b24]
push eax
push str.Log_path_is__s
call fcn.00420880
mov eax, dword [ebp - 0x18d4]
add esp, 8
test eax, eax
je 0x41e03a
push eax
call fcn.00428900
mov dword [ebp - 0x18d4], 0
cmp dword [0x479b38], 8
mov eax, 0x479b24
push 0
cmovae eax, dword [0x479b24]
push eax
lea eax, [ebp - 0x18d4]
push eax
call fcn.00428800
mov eax, dword [ebp - 0x18d4]
mov ecx, str._still__empty_
test eax, eax
cmovne ecx, eax
push ecx
push str.Log_path_is__s
call fcn.00420880
add esp, 8
cmp dword [0x47bc58], 0
je 0x41eaae
push 0
call fcn.0041d310
add esp, 4
test eax, eax
jne 0x41eaae
push str.no_FCT_is_detected__uninstallation_is_success_
call fcn.00420880
push 1
push 0
push 0
push 0x136
call fcn.00422af0
add esp, 0x14
cmp dword [0x47bc5c], 0
je 0x41e0c9
push 0
call fcn.004172a0
add esp, 4
push str.FortiClientInstallerService
call fcn.004176d0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.RemoveService___return__d__err_d
call fcn.00420880
add esp, 0xc
xor esi, esi
mov eax, dword [ebp - 0x18c4]
test eax, eax
je 0x41e0ff
push eax
call fcn.00428900
mov eax, dword [ebp - 0x1904]
test eax, eax
je 0x41e10f
push eax
call fcn.00428900
mov eax, dword [ebp - 0x1908]
test eax, eax
je 0x41e11f
push eax
call fcn.00428900
mov eax, dword [ebp - 0x18d4]
test eax, eax
je 0x41e12f
push eax
call fcn.00428900
mov eax, dword [ebp - 0x18ec]
test eax, eax
je 0x41e13f
push eax
call fcn.00428900
mov eax, dword [ebp - 0x18f0]
test eax, eax
je 0x41e14f
push eax
call fcn.00428900
mov eax, dword [ebp - 0x18dc]
test eax, eax
je 0x41e15f
push eax
call fcn.00428900
movzx eax, si
jmp 0x41fee4
push 0xffffffffffffffff
push 0x464880
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e198
mov dword [ebp - 0x18e4], eax
mov dword [ebp - 0x18c8], 1
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.passive
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e1c5
mov dword [ebp - 0x18e4], 3
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.norestart
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e205
push 0
push str.REBOOTReallySuppress
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
mov dword [ebp - 0x18e8], 1
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.forcerestart
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e22f
push 0
push str.REBOOTForce
jmp 0x41defb
mov eax, dword [edi]
push 0xffffffffffffffff
push str.promptrestart
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e298
cmp dword [ebp - 0x1900], 0
jne 0x41e269
push 0
push str.REBOOTReallySuppress
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
push 0
push str.PROMPT_FOR_REBOOT1
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
mov edi, dword [ebp - 0x18b8]
mov eax, 1
mov dword [ebp - 0x18bc], eax
mov dword [ebp - 0x1900], eax
jmp 0x41df13
mov eax, dword [edi]
push 0xffffffffffffffff
push str.uninstall
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e2dc
mov eax, dword [ebp - 0x18e4]
mov ecx, 3
cmp eax, 5
mov dword [ebp - 0x18d0], 7
cmove eax, ecx
mov dword [ebp - 0x18e4], eax
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.log
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e331
mov edi, dword [ebp - 0x18b8]
inc esi
push 0
mov eax, dword [edi + esi*4]
push eax
lea eax, [ebp - 0x18d4]
push eax
call fcn.00428800
mov eax, dword [ebp - 0x18d4]
test eax, eax
je 0x41df0d
push eax
mov ecx, 0x479b24
call fcn.0040efe0
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push 0x460cd0
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e392
mov edi, dword [ebp - 0x18b8]
inc esi
push 0
mov eax, dword [edi + esi*4]
push eax
lea eax, [ebp - 0x18d4]
push eax
call fcn.00428800
mov eax, dword [ebp - 0x18d4]
test eax, eax
je 0x41df0d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x18d4]
mov ecx, 0x479b24
call fcn.0040efe0
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.lang
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e3da
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e850
mov edi, dword [ebp - 0x18b8]
mov eax, dword [edi + esi*4]
push eax
call fcn.0043a803
add esp, 4
mov dword [ebp - 0x18d8], eax
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push 0x4649bc
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41e7ce
mov eax, dword [edi]
push 0xffffffffffffffff
push 0x4649c0
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41e7ce
mov eax, dword [edi]
push 0xffffffffffffffff
push 0x4649c4
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41e7ce
mov eax, dword [edi]
push 0xffffffffffffffff
push str.schid
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e491
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e876
mov edi, dword [ebp - 0x18b8]
mov eax, dword [edi + esi*4]
push eax
call fcn.0043a803
add esp, 4
mov dword [0x47bc54], eax
mov dword [0x47bc5c], 1
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.deviceid
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e4e2
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e89c
mov edi, dword [ebp - 0x18b8]
mov eax, dword [edi + esi*4]
push eax
call fcn.0043a803
add esp, 4
mov dword [0x47bc50], eax
mov dword [0x47bc5c], 1
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.emsserver
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e530
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e8c2
mov edi, dword [ebp - 0x18b8]
mov ecx, 0x479b0c
mov eax, dword [edi + esi*4]
push eax
call fcn.0040efe0
mov dword [0x47bc5c], 1
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.importconfig
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e574
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e8e8
mov edi, dword [ebp - 0x18b8]
mov ecx, 0x479b54
mov eax, dword [edi + esi*4]
push eax
call fcn.0040efe0
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.uninstallfamily
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e5ab
mov dword [0x47bc58], 1
mov dword [ebp - 0x18d0], 9
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.notifyreboot
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41ea7e
mov eax, dword [edi]
push 0xffffffffffffffff
push str.requestreboot
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41e980
mov eax, dword [edi]
push 0xffffffffffffffff
push str.asservice
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e626
mov dword [0x47bc04], 1
mov dword [0x47c090], 1
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.schstart
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e678
lea edi, [esi + 1]
cmp edi, dword [ebp - 0x18c0]
jge 0x41df07
mov eax, dword [ebp - 0x18b8]
mov eax, dword [eax + esi*4 + 4]
movzx eax, word [eax]
push eax
call fcn.0043b5f3
add esp, 4
test eax, eax
je 0x41df07
mov esi, edi
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.schinst
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41df07
push 0xffffffffffffffff
push str._winsrvc
push 0xffffffffffffffff
push dword [edi]
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.schforcerebootdlg
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e6e5
mov dword [0x47bc68], 1
jmp 0x41df07
mov eax, dword [edi]
push 0xffffffffffffffff
push str.rebootpromptusers
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e72c
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e90e
mov edi, dword [ebp - 0x18b8]
mov eax, dword [edi + esi*4]
push eax
call fcn.0043a803
add esp, 4
mov dword [0x47bc68], eax
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.rebootwhenneeded
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e773
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e934
mov edi, dword [ebp - 0x18b8]
mov eax, dword [edi + esi*4]
push eax
call fcn.0043a803
add esp, 4
mov dword [0x479aec], eax
jmp 0x41df0d
mov eax, dword [edi]
push 0xffffffffffffffff
push str.autoreboot0users
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41e7ba
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41e95a
mov edi, dword [ebp - 0x18b8]
mov eax, dword [edi + esi*4]
push eax
call fcn.0043a803
add esp, 4
mov dword [0x479af0], eax
jmp 0x41df0d
push dword [edi]
push str.Unknown_argument:__s
call fcn.00420880
add esp, 8
jmp 0x41df07
mov dword [ebp - 0x18f4], 1
jmp 0x41df07
inc esi
cmp esi, dword [ebp - 0x18c0]
jge 0x41ea88
mov edi, dword [ebp - 0x18b8]
mov dword [ebp - 0x14], 1
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x18e0], eax
jmp 0x41df0d
push eax
push str.Bad_commandline_argument:__S
mov esi, 0x80070057
push esi
push 4
push 0x11a5
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_filename_with_the__o1_switch.
mov esi, 0x80070057
push esi
push 4
push 0x10d7
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_Locale_ID_with_the__lang_switch.
mov esi, 0x80070057
push esi
push 4
push 0x1122
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_schedule_ID_with_the__schid_switch.
mov esi, 0x80070057
push esi
push 4
push 0x1130
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_Device_ID_with_the__deviceid_switch.
mov esi, 0x80070057
push esi
push 4
push 0x1139
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_EMS_server_addr_with_the__emsserver_switch.
mov esi, 0x80070057
push esi
push 4
push 0x1142
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_config_file_name_with_the__importconfig_switch.
mov esi, 0x80070057
push esi
push 4
push 0x114b
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_value_for_rebootpromptusers.
mov esi, 0x80070057
push esi
push 4
push 0x118a
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_value_for_rebootwhenneeded.
mov esi, 0x80070057
push esi
push 4
push 0x1192
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0
push str.Must_specify_a_value_for_autoreboot0users.
mov esi, 0x80070057
push esi
push 4
push 0x119a
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
lea eax, [ebp - 0x18dc]
push eax
call fcn.00426470
mov esi, eax
add esp, 4
test esi, esi
jns 0x41e9b6
push 0
push str.Failed_to_load_product_name.
push esi
push 4
push 0x115f
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
lea eax, [ebp - 0x18f0]
push eax
push 0x7e2
push dword [0x47c094]
call fcn.00419af0
mov esi, eax
test esi, esi
jns 0x41e9f4
push 0
push str.Failed_to_load_reboot_message.
push esi
push 4
push 0x1162
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push dword [ebp - 0x18dc]
lea eax, [ebp - 0x18ec]
push dword [ebp - 0x18f0]
push eax
call fcn.004285e0
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x41ea3a
push dword [ebp - 0x18dc]
push str.Failed_to_set_display_with_product_name:__S
push esi
push 4
push 0x1165
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0x10040
push dword [ebp - 0x18dc]
push dword [ebp - 0x18ec]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x18ec]
test eax, eax
je 0x41ea63
push eax
call fcn.00428900
mov eax, dword [ebp - 0x18f0]
test eax, eax
je 0x41ea73
push eax
call fcn.00428900
mov eax, dword [ebp - 0x18dc]
jmp 0x41fed8
call fcn.00426730
jmp 0x41fee2
push 0
push str.Must_specify_a_filename_with_the__out_switch.
mov esi, 0x80070057
push esi
push 4
push 0x10cd
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push 0x20a
lea eax, [ebp - 0x63c]
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x63c]
push 0x104
push eax
push 2
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [0x47c2d0]
mov ecx, 0x47c2d0
mov dword [ebp - 4], 1
push dword [esi + 4]
call fcn.004238e0
mov eax, dword [0x47c2d0]
mov ecx, 0x464db0
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 4], esi
mov eax, dword [0x47c2d0]
mov dword [eax], esi
mov eax, dword [0x47c2d0]
mov dword [eax + 8], esi
lea eax, [ebp - 0x63c]
mov dword [0x47c2d4], 0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41eb4d
test dx, dx
je 0x41eb49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41eb4d
add eax, 4
add ecx, 4
test dx, dx
jne 0x41eb27
xor eax, eax
jmp 0x41eb52
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41ed01
mov dword [ebp - 0x87c], str.Feature_Core
xor edi, edi
mov dword [ebp - 0x878], str.Feature_Basic
mov esi, str.Feature_Core
mov dword [ebp - 0x874], str.Feature_AntiVirus
mov dword [ebp - 0x870], str.Feature_WebFilter
mov dword [ebp - 0x86c], str.Feature_VPN
mov dword [ebp - 0x868], str.Feature_SSLVPN
mov dword [ebp - 0x864], str.Feature_WanAcceleration
mov dword [ebp - 0x860], str.Feature_EndPointNAC
mov dword [ebp - 0x85c], str.Feature_SingleSignOnMobility
mov dword [ebp - 0x858], str.Feature_FireWall
mov dword [ebp - 0x854], str.Feature_Vulnerability
mov dword [ebp - 0x850], str.Feature_Sandbox
mov dword [ebp - 0x84c], eax
nop
mov ecx, str.Feature_Core
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ec0d
test dx, dx
je 0x41ec09
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ec0d
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ebe7
xor eax, eax
jmp 0x41ec12
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ecec
mov ecx, str.Feature_Basic
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ec47
test dx, dx
je 0x41ec43
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ec47
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ec21
xor eax, eax
jmp 0x41ec4c
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ecec
mov ecx, str.Feature_EndPointNAC
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ec86
test dx, dx
je 0x41ec82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ec86
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ec60
xor eax, eax
jmp 0x41ec8b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ecec
push esi
call fcn.0043b1ff
mov esi, eax
add esp, 4
test esi, esi
je 0x41ecec
push esi
lea ecx, [ebp - 0x18b4]
call fcn.0040e240
push dword [ebp - 0x18d8]
lea eax, [ebp - 0x18b4]
mov dword [ebp - 4], 2
push eax
push 0
lea eax, [ebp - 0x18fc]
mov ecx, 0x47c2d0
push eax
call fcn.004147a0
lea ecx, [ebp - 0x18b4]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c360
push esi
call fcn.0043b170
add esp, 4
mov esi, dword [ebp + edi*4 - 0x878]
inc edi
test esi, esi
jne 0x41ebe0
jmp 0x41edbe
push 1
xor eax, eax
mov dword [ebp - 0x18a4], 0
push 0x4609dc
lea ecx, [ebp - 0x18b4]
mov dword [ebp - 0x18a0], 7
mov word [ebp - 0x18b4], ax
call fcn.0040cfe0
xor eax, eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x63c]
mov dword [ebp - 0x188c], 0
mov dword [ebp - 0x1888], 7
lea edx, [ecx + 2]
mov word [ebp - 0x189c], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ed60
sub ecx, edx
lea eax, [ebp - 0x63c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x189c]
call fcn.0040cfe0
lea eax, [ebp - 0x18b4]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x189c]
push 0x47c2d0
push eax
call fcn.00426f80
add esp, 0xc
lea ecx, [ebp - 0x189c]
call fcn.0040c360
lea ecx, [ebp - 0x18b4]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c360
cmp dword [0x47bc58], 0
jne 0x41ee2c
cmp dword [0x47bc5c], 0
je 0x41ee2c
cmp dword [ebp - 0x18d0], 1
jne 0x41ee2c
lea eax, [ebp - 0x18f8]
mov dword [ebp - 0x18f8], 0
push eax
call fcn.0041d310
add esp, 4
test eax, eax
je 0x41ee2c
cmp dword [ebp - 0x18f8], 0
je 0x41ee15
push str.same_version_of_FCT_has_been_detected
call fcn.00420880
mov dword [ebp - 0x18d0], 1
jmp 0x41ee29
push str.setupexe_is_going_to_uninstall_any_existing_FCT_before_specified_version_can_be_deployed
mov dword [ebp - 0x18d0], 9
call fcn.00420880
add esp, 4
lea eax, [ebp - 0x18b4]
push eax
call fcn.00426140
mov esi, eax
add esp, 4
cmp esi, 0x479af4
je 0x41ee79
mov ecx, 0x479af4
call fcn.0040c360
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [0x479af4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x479b04], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x18a0]
cmp edx, 8
jb 0x41eeb9
mov ecx, dword [ebp - 0x18b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41eeaf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ff05
push edx
push ecx
call fcn.00428a68
add esp, 8
cmp dword [0x479b04], 0
je 0x41eed5
push 0
push str.DONT_START_FCT1
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
mov eax, dword [0x47bc04]
test eax, eax
je 0x41ef33
cmp dword [ebp - 0x18e8], 0
jne 0x41eeff
push 0
push str.REBOOTReallySuppress
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
mov eax, dword [0x47bc04]
cmp dword [0x47c090], 0
mov edi, 2
mov dword [ebp - 0x18e4], edi
je 0x41ef39
push 0
push str.g_bRunSelfAsService1
push 1
push 0x1206
push 0x460280
call fcn.00418730
add esp, 0x14
jmp 0x41fee2
mov edi, dword [ebp - 0x18e4]
mov ecx, dword [0x47bc5c]
test ecx, ecx
je 0x41ef6a
cmp dword [0x47c2e0], 0
jne 0x41ef6a
push 0
push str.UNINSTALL_PRESERVE_DATA1
lea eax, [ebp - 0x18c4]
push eax
call fcn.00428450
mov eax, dword [0x47bc04]
mov ecx, dword [0x47bc5c]
cmp dword [ebp - 0x18f4], 0
je 0x41f01b
lea eax, [ebp - 0x1904]
push eax
push 0xc739
push dword [0x47c094]
call fcn.00419af0
mov esi, eax
test esi, esi
jns 0x41efb5
push 0
push str.Failed_to_load_product_name.
push esi
push 4
push 0x1217
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
lea eax, [ebp - 0x1908]
push eax
push 0x7d5
push dword [0x47c094]
call fcn.00419af0
mov esi, eax
test esi, esi
jns 0x41eff3
push 0
push str.Failed_to_load_help.
push esi
push 4
push 0x1219
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
cmp dword [0x47bc5c], 0
jne 0x41f1bc
push 0
push dword [ebp - 0x1904]
push dword [ebp - 0x1908]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x41f1bc
cmp dword [ebp - 0x14], 0
je 0x41f05b
mov edi, dword [ebp - 0x18e0]
push edi
call fcn.0041d7d0
mov esi, eax
add esp, 4
test esi, esi
jns 0x41f1bc
push 0
push str.Failure_in_extracting_msi.
push esi
push 4
push 0x1221
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
cmp dword [ebp - 0x18cc], 0
je 0x41f0ff
lea eax, [ebp - 0x18d8]
mov dword [ebp - 0x18cc], 0
push eax
lea eax, [ebp - 0x18cc]
mov dword [ebp - 0x18d8], 0
push eax
push str.MANIFEST
push 0
call fcn.00419910
mov esi, eax
test esi, esi
jns 0x41f0bd
push 0
push str.Failed_to_get_manifest_for_setup_chain.
push esi
push 4
push 0x1229
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
mov eax, dword [ebp - 0x18cc]
mov edi, dword [ebp - 0x18e0]
add eax, 4
push 2
push edi
push eax
call fcn.004197b0
mov esi, eax
test esi, esi
jns 0x41f1bc
push edi
push str.Failed_to_write_msi_package_to__S.
push esi
push 4
push 0x122e
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
cmp dword [ebp - 0x18d0], 9
push eax
push ecx
jne 0x41f3ae
push str.Uninstall_FCT_family__g_bEMSDeploy_d__g_bRunningAsService_d
call fcn.00420880
push 1
push 0
push 0
push 0xdc
call fcn.00422af0
add esp, 0x1c
cmp dword [0x479b4c], 0
jne 0x41f2be
push 0
call fcn.0041d310
add esp, 4
cmp dword [0x479b4c], 0
jne 0x41f2be
push str.no_FCT_is_detected_on_target_system__CONFIGURE_ACTION_UNINSTALL_FAMILY_action_is_success
call fcn.00420880
cmp dword [0x47c2e0], 0
mov ecx, 0x136
push 1
push 0
mov eax, 0x104
cmovne eax, ecx
push 0
push eax
call fcn.00422af0
add esp, 0x14
cmp dword [0x47bc5c], 0
je 0x41f1ba
push 0
call fcn.004172a0
push str.remove_FCT_installer_service_if_there_is_one
call fcn.00420880
push str.FortiClientInstallerService
call fcn.004176d0
add esp, 0xc
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.RemoveService___return__d__err_d
call fcn.00420880
add esp, 0xc
xor esi, esi
push dword [0x47bc5c]
push dword [0x47bc60]
push str.before_InstEntrance___is_returned__g_bAskUserToReboot_d__g_bEMSDeploy_d
call fcn.00420880
add esp, 0xc
cmp dword [0x47bc60], 0
je 0x41e0ef
cmp dword [0x47bc5c], 0
je 0x41e0ef
cmp dword [0x479aec], 0
je 0x41e0ef
cmp dword [0x47bc68], 0
mov edi, 1
je 0x41fc37
push edi
push 0
push 0
push pe_nt_image_headers32
call fcn.00422af0
push 0x47bc48
push str.SchRebootPrompt
call fcn.00423050
add esp, 0x18
mov dword [ebp - 0x18d8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x18d8]
push str.ShowSchRebootRequest
push str._ws____ShowUserDialog_SchRebootPrompt__returned__d__err_d
call fcn.00420880
mov eax, dword [ebp - 0x18d8]
add esp, 0x10
test eax, eax
jne 0x41fbf8
call fcn.00416bc0
or eax, 4
push eax
call fcn.004172a0
add esp, 4
push 0xffffffffffffffff
push dword [0x47bc48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x18c8]
mov dword [ebp - 0x18c8], 0
push eax
push dword [0x47bc48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18c8]
push str.ShowSchRebootRequest
push str._ws____ShowUserDialog_SchRebootPrompt__process_terminated__exit_code_d
call fcn.00420880
mov edi, dword [ebp - 0x18c8]
jmp 0x41fc15
push str.FCT_is_detected_on_target_system__do_uninstallation_now
call fcn.00420880
mov eax, dword [0x47bc5c]
add esp, 4
test eax, eax
je 0x41f366
cmp dword [0x47bc04], 0
jne 0x41f354
push str.install_a_windows_service__so_the_installation_uninstallation_action_can_be_continued_after_reboot
call fcn.00420880
add esp, 4
push 0
push 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.FortiClientInstallerService
call fcn.00417360
push 0x20a
mov esi, eax
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.0042b800
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.InstallService___returned__d__err_d__cmd_s
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.00410d00
lea eax, [ebp - 0x224]
push eax
call fcn.00420880
mov eax, dword [0x47bc5c]
add esp, 0x1c
test eax, eax
je 0x41f366
cmp dword [0x47bc58], 0
jne 0x41f366
call fcn.0041b900
cmp dword [0x479b38], 8
mov ecx, 0x479b24
push 0
cmovae ecx, dword [0x479b24]
mov eax, 0x479b3c
cmp dword [0x479b50], 8
push 0
cmovae eax, dword [0x479b3c]
push edi
push 9
push ecx
push dword [ebp - 0x18c4]
push 0
push 0
push eax
call fcn.0041c770
add esp, 0x24
mov esi, eax
jmp 0x41f1bc
push str.Default_is_to_install_the_package__g_bEMSDeploy_d__g_bRunningAsService_d
call fcn.00420880
push 0
push str.Do_Install
push 1
push 0x1258
push 0x460280
call fcn.00418730
add esp, 0x20
cmp dword [0x47bc5c], 0
je 0x41f453
cmp dword [0x47bc04], 0
jne 0x41f453
push str.install_a_windows_service__so_the_installation_uninstallation_action_can_be_continued_after_reboot
call fcn.00420880
add esp, 4
push 0
push 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.FortiClientInstallerService
call fcn.00417360
push 0x20a
mov esi, eax
lea eax, [ebp - 0xa90]
push 0
push eax
call fcn.0042b800
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.InstallService___returned__d__err_d__cmd_s
lea eax, [ebp - 0xa90]
push 0x104
push eax
call fcn.00410d00
lea eax, [ebp - 0xa90]
push eax
call fcn.00420880
add esp, 0x1c
push 0x20a
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.0042b800
push 0x20a
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.0042b800
add esp, 0x18
mov dword [ebp - 0x18e0], 0
lea eax, [ebp - 0x430]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f4a3
sub ecx, edx
sar ecx, 1
je 0x41f7fc
lea eax, [ebp - 0x18e0]
push eax
lea eax, [ebp - 0x224]
push eax
push ecx
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x41f7fc
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f4e5
sub ecx, edx
sar ecx, 1
jne 0x41f53b
lea ecx, [ebp - 0x224]
mov edx, 0x82
lea esi, [ebp - 0x430]
mov eax, ecx
sub esi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7fffff7c]
test eax, eax
je 0x41f52e
movzx eax, word [esi + ecx]
test ax, ax
je 0x41f52e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x41f510
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x18e0], 0
jne 0x41f56a
lea eax, [ebp - 0x430]
push 0x5c
push eax
call fcn.0042ca77
add esp, 8
test eax, eax
je 0x41f55e
add eax, 2
jmp 0x41f564
lea eax, [ebp - 0x430]
mov dword [ebp - 0x18e0], eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x41f5c1
push eax
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.SHLWAPI.dll_PathBuildRootW]
lea ecx, [ebp - 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f595
sub ecx, edx
sar ecx, 1
je 0x41f7fc
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x41f5c1
test eax, eax
jne 0x41f7fc
push 0x20a
lea eax, [ebp - 0xa90]
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0xa90]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0xa90]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f5f2
sub ecx, edx
mov esi, 0x104
sar ecx, 1
mov eax, esi
push 0x459794
sub eax, ecx
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.00423460
lea ecx, [ebp - 0xa90]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f625
push dword [ebp - 0x18e0]
sub ecx, edx
lea eax, [ebp - 0xa90]
sar ecx, 1
sub esi, ecx
push esi
push eax
call fcn.00423460
push 0
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esi + 2]
nop word [eax + eax]
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x41f670
sub esi, eax
sar esi, 1
lea edi, [esi*2 + 2]
mov eax, edi
call fcn.004293d0
mov eax, esp
mov dword [ebp - 0x18f8], eax
test eax, eax
je 0x41f7fc
push edi
push 0
push eax
call fcn.0042b800
mov edi, 1
add esp, 0xc
cmp dword [ebp - 0x18c0], edi
jle 0x41f749
nop word [eax + eax]
mov edx, dword [ebp - 0x18f8]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x18cc], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f6d1
mov eax, dword [ebp - 0x18b8]
sub ecx, dword [ebp - 0x18cc]
sar ecx, 1
mov eax, dword [eax + edi*4]
push eax
mov eax, esi
sub eax, ecx
push eax
push edx
call fcn.00423460
mov ecx, dword [ebp - 0x18c0]
lea eax, [ecx - 1]
cmp edi, eax
jge 0x41f740
mov edx, dword [ebp - 0x18f8]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x18cc], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f717
sub ecx, dword [ebp - 0x18cc]
mov eax, esi
sar ecx, 1
push 0x45d3d8
sub eax, ecx
push eax
push edx
call fcn.00423460
mov ecx, dword [ebp - 0x18c0]
inc edi
cmp edi, ecx
jl 0x41f6c0
mov esi, dword [ebp - 0x18f8]
lea eax, [ebp - 0xa90]
xorps xmm0, xmm0
mov dword [ebp - 0x874], eax
lea eax, [ebp - 0x884]
mov dword [ebp - 0x880], 0
push eax
movlpd qword [ebp - 0x864], xmm0
movlpd qword [ebp - 0x85c], xmm0
movlpd qword [ebp - 0x854], xmm0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x884], 0x3c
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x878], str.runas
mov dword [ebp - 0x870], esi
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x868], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41f7f4
lea eax, [ebp - 0x884]
mov dword [ebp - 0x878], str.open
push eax
mov dword [ebp - 0x870], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41f7fc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004195c0
test al, al
jne 0x41f84d
call fcn.004196f0
test al, al
jne 0x41f84d
call fcn.004195e0
test al, al
je 0x41f823
mov dword [0x47c2bc], 5
jmp 0x41f857
call fcn.004196a0
test al, al
je 0x41f838
mov dword [0x47c2bc], 2
jmp 0x41f857
call fcn.00419570
test al, al
je 0x41f857
mov dword [0x47c2bc], 3
jmp 0x41f857
mov dword [0x47c2bc], 1
cmp dword [0x47bc5c], 0
jne 0x41f9e2
call fcn.004196d0
test al, al
jne 0x41f9e2
lea eax, [ebp - 0x18e8]
push eax
lea eax, [ebp - 0x18f4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18cc]
push eax
call fcn.00419380
add esp, 0x10
test al, al
je 0x41f9e2
mov eax, dword [ebp - 0x18cc]
mov ecx, 6
mov edx, dword [ebp - 0x14]
cmp ecx, eax
sbb ecx, ecx
neg ecx
cmp eax, 6
ja 0x41f8bb
jne 0x41f8c2
test edx, edx
je 0x41f8bf
jmp 0x41f8fd
test ecx, ecx
jne 0x41f8fd
cmp eax, 6
mov ecx, dword [ebp - 0x18f4]
jne 0x41f8d3
test edx, edx
jne 0x41f8d3
cmp ecx, 9
ja 0x41f8fd
cmp eax, 6
jne 0x41f9e2
test edx, edx
jne 0x41f9e2
cmp ecx, 9
jne 0x41f9e2
cmp dword [ebp - 0x18e8], 0x115
jbe 0x41f9e2
lea eax, [ebp - 0x18f0]
push eax
push 0x7d6
push dword [0x47c094]
call fcn.00419af0
mov esi, eax
test esi, esi
jns 0x41f93b
push 0
push str.Failed_to_load_IDS_SETUP_IS_STALE.
push esi
push 4
push 0x12dc
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
lea eax, [ebp - 0x18dc]
push eax
call fcn.00426470
mov esi, eax
add esp, 4
test esi, esi
jns 0x41f971
push 0
push str.Failed_to_load_product_name.
push esi
push 4
push 0x12df
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push dword [ebp - 0x18dc]
lea eax, [ebp - 0x18ec]
push dword [ebp - 0x18f0]
push eax
call fcn.004285e0
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x41f9b7
push dword [ebp - 0x18dc]
push str.Failed_to_set_display_with_product_name:__S
push esi
push 4
push 0x12e2
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
cmp dword [0x47bc5c], 0
jne 0x41e0ef
push 0x10010
push dword [ebp - 0x18dc]
push dword [ebp - 0x18ec]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x41e0ef
push 0
push str.call_ProcessSetupChain
push 1
push 0x12f7
push 0x460280
call fcn.00418730
mov eax, dword [ebp - 0x18d4]
mov ecx, str._still__empty_
test eax, eax
cmovne ecx, eax
push ecx
push str.Log_path_is__s
call fcn.00420880
push dword [ebp - 0x18d0]
mov eax, dword [ebp - 0x18e4]
push eax
push dword [ebp - 0x18d4]
push dword [ebp - 0x18d8]
push dword [ebp - 0x18c4]
push 0
call fcn.00420c30
mov esi, eax
add esp, 0x34
mov dword [ebp - 0x18cc], esi
test esi, esi
jns 0x41fa6b
push 0
push str.Failed_to_process_setup_chain.
push esi
push 4
push 0x12fa
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
push dword [0x47c2bc]
push str.g_CurrentlyInstalledProduct_d
call fcn.00420880
push dword [ebp - 0x18c8]
push str.bIsSilent_d
call fcn.00420880
mov edi, dword [ebp - 0x1900]
push edi
push str.bSuppressReboot_d
call fcn.00420880
push dword [ebp - 0x18bc]
push str.bPromptRestart_d
call fcn.00420880
add esp, 0x20
cmp dword [0x47bc5c], 0
jne 0x41f1bc
cmp dword [0x47c2bc], 0
je 0x41f1bc
cmp dword [ebp - 0x18c8], 0
je 0x41f1bc
test edi, edi
je 0x41f1bc
cmp dword [ebp - 0x18bc], 0
je 0x41f1bc
push str.__g_bEMSDeploy__g_CurrentlyInstalledProduct___ProductUnknown__bIsSilent__bSuppressReboot__bPromptRestart_
call fcn.00420880
push str.FA_Scheduler
call fcn.004166b0
add esp, 8
test al, al
jne 0x41fb54
push str._service_is_running_FA_SCH_
call fcn.00420880
push str.Create_EVENT_REBOOT_NEEDED
call fcn.00420880
push str.GlobalE608B543_C77D_4302_9D0D_613D9D92A2AA
push 0
push 0
push 0
call fcn.00414380
mov edi, eax
add esp, 0x18
test edi, edi
je 0x41f1bc
call fcn.00426e50
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41f1bc
push 1
push 0
push 0
push pe_nt_image_headers32
call fcn.00422af0
push 0
lea eax, [ebp - 0x1884]
push 0x400
push eax
call fcn.00415da0
xor ecx, ecx
mov edi, eax
mov edx, 4
mov dword [ebp - 0x14], edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00428a76
add esp, 0x20
mov ecx, eax
mov dword [ebp - 0x18f4], ecx
test edi, edi
je 0x41fbe7
lea eax, [ebp - 0x1884]
mov esi, ecx
sub eax, ecx
mov dword [ebp - 0x18d8], eax
mov eax, dword [eax + esi]
push 0
push 0
push eax
push 0x422670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
lea esi, [esi + 4]
mov eax, dword [ebp - 0x18d8]
sub edi, 1
jne 0x41fbb1
mov esi, dword [ebp - 0x18cc]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18f4]
push 0xffffffffffffffff
push 1
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x41f1bc
jns 0x41fc18
push dword [0x479af0]
push str.ShowSchRebootRequest
push str._ws____ShowUserDialog_SchRebootPrompt__failed__g_bAutoReboot0User_d
call fcn.00420880
mov edi, dword [0x479af0]
add esp, 0xc
call fcn.00425d70
test edi, edi
jne 0x41fc49
push 1
push edi
push edi
push 0x154
call fcn.00422af0
add esp, 0x10
jmp 0x41e0ef
push str.ShowSchRebootRequest
push str._ws___g_bShowRebootDlgOnSchFALSE_..._rebooting
call fcn.00420880
add esp, 8
call fcn.00422610
jmp 0x41e0ef
lea eax, [ebp - 0x18c0]
push eax
push dword [ebp - 0x18e8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [ebp - 0x18c0]
mov esi, 1
mov edi, eax
cmp edx, esi
jle 0x41fcb2
mov eax, dword [edi + esi*4]
movzx ecx, word [eax]
cmp ecx, 0x2d
je 0x41fc87
cmp ecx, 0x2f
jne 0x41fcad
push 0xffffffffffffffff
push str.elevated
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x41fee2
mov edx, dword [ebp - 0x18c0]
inc esi
cmp esi, edx
jl 0x41fc77
push 0x20a
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x188c], 0
mov dword [ebp - 0x1888], 7
mov word [ebp - 0x189c], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18c8], eax
lea eax, [ebp - 0x18c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18d8], eax
test eax, eax
je 0x41fd84
mov esi, 1
cmp dword [ebp - 0x18c8], esi
jle 0x41fd7d
nop dword [eax]
mov edx, dword [eax + esi*4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fd40
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x189c]
call fcn.00413c10
push 1
push 0x45d3d8
lea ecx, [ebp - 0x189c]
call fcn.00413c10
mov eax, dword [ebp - 0x18d8]
inc esi
cmp esi, dword [ebp - 0x18c8]
jl 0x41fd30
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xa
push str.__elevated
lea ecx, [ebp - 0x189c]
call fcn.00413c10
cmp dword [ebp - 0x1888], 8
lea eax, [ebp - 0x224]
mov dword [ebp - 0x874], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x189c]
mov dword [ebp - 0x880], 0
cmovae eax, dword [ebp - 0x189c]
mov dword [ebp - 0x870], eax
lea eax, [ebp - 0x884]
push eax
movlpd qword [ebp - 0x864], xmm0
movlpd qword [ebp - 0x85c], xmm0
movlpd qword [ebp - 0x854], xmm0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x884], 0x3c
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x878], str.runas
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x868], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x1888]
mov esi, eax
cmp edx, 8
jb 0x41fe6c
mov ecx, dword [ebp - 0x189c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ff0a
push edx
push ecx
call fcn.00428a68
add esp, 8
test esi, esi
jne 0x41fee2
lea eax, [ebp - 0x18c8]
mov dword [ebp - 0x18c8], esi
push eax
push 0x7e5
push dword [0x47c094]
call fcn.00419af0
mov esi, eax
test esi, esi
jns 0x41feb4
push 0
push str.Failed_to_load_product_conflict_message.
push esi
push 4
push 0x10aa
push 0x460280
call fcn.004188c0
add esp, 0x18
jmp 0x41e0ef
cmp dword [0x47bc5c], 0
jne 0x41fed2
push 0x10010
push 0
push dword [ebp - 0x18c8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x18c8]
test eax, eax
je 0x41fee2
push eax
call fcn.00428900
xor eax, eax
lea esp, [ebp - 0x1914]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
call fcn.0043af68
call fcn.0043af68
int3