Function at 0x401e20
Capabilities:
Create process on windows
Query environment variable
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x40492c
push eax
mov eax, 0x2604
mov dword fs:[0], esp
call fcn.004040f0
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x1618]
mov dword [esp + 0x1614], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x3ff
lea edi, [esp + 0x618]
mov dword [esp + 0x614], ebx
mov word [esp + 0x184], bx
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [esp + 0x186]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x3c], 2
mov dword [esp + 0x24], ebx
stosw word es:[edi], ax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x261c], ebx
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x261c], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x8c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x402
push eax
mov byte [esp + 0x262c], 2
call ebp
mov ecx, dword [esi + 0xcc]
push ebx
push ebx
push 0x184
push ecx
call ebp
push ebx
lea ecx, [esi + 0xec]
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esi + 0x12c]
push ebx
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esi + 0x16c]
push ebx
call sub.MFC42.DLL_CWnd::EnableWindow
lea ecx, [esi + 0x1ac]
push ebx
call sub.MFC42.DLL_CWnd::EnableWindow
mov edx, dword [esi + 0x8c]
push ebx
push 1
push 0x402
push edx
call ebp
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push str.____________________________________________
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
lea ecx, [esp + 0x10]
push 0x6d
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
push ebx
mov ecx, esi
call fcn.00402d40
mov ecx, dword [esi + 0x8c]
push ebx
push 5
push 0x402
push ecx
call ebp
push str.____________________________________________
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push 0x3e8
call edi
push 0x6e
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.004028b0
add esp, 8
lea eax, [esp + 0x24]
lea ecx, [esp + 0x184]
push eax
push 0x207
push ecx
mov ecx, esi
call fcn.00402a10
test eax, eax
jne 0x402037
push 0x6f
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
call fcn.004028b0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x70
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x402317
lea edx, [esp + 0x18]
lea eax, [esp + 0x184]
push edx
push eax
mov ecx, esi
call fcn.00403630
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push str.MSI:__s
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x2c]
add esp, 0xc
push eax
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push 0x1f4
call edi
push ebx
mov ecx, esi
call fcn.00402d30
test eax, eax
je 0x40227c
push 0x71
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004028b0
mov ecx, 0xa1
xor eax, eax
lea edi, [esp + 0x396]
mov word [esp + 0x394], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x48], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x3f
lea edi, [esp + 0x8e]
mov word [esp + 0x8c], bx
add esp, 8
rep stosd dword es:[edi], eax
xor edx, edx
push 0x7f
stosw word es:[edi], ax
mov dword [esp + 0x30], edx
lea eax, [esp + 0x88]
mov dword [esp + 0x34], edx
push eax
push str._SystemRoot_SslvpnInstall.log
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x184]
lea edx, [esp + 0x84]
push ecx
push edx
push str.msiexec__l___s___i___s_
lea eax, [esp + 0x398]
push 0x143
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x38c]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2624], 3
call fcn.00403630
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x40]
push ecx
push edx
push ebx
push ebx
push 8
push ebx
push ebx
lea eax, [esp + 0x3a8]
push ebx
push eax
push ebx
mov dword [esp + 0x68], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x40225e
mov ecx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push ecx
call edi
cmp eax, 0x102
jne 0x402221
mov edx, dword [esi + 0x8c]
push ebx
push ebx
push 0x408
push edx
call ebp
cmp eax, 0x5a
jge 0x40220e
mov eax, dword [esi + 0x8c]
push ebx
push ebx
push 0x408
push eax
call ebp
mov ecx, dword [esi + 0x8c]
inc eax
push ebx
push eax
push 0x402
push ecx
call ebp
mov edx, dword [esp + 0x28]
push 0x3e8
push edx
call edi
cmp eax, 0x102
je 0x4021d8
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x28]
push ecx
call edi
push 0x72
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
jmp 0x402266
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x261c], 2
call fcn.0040440c
jmp 0x4025f3
push 0x73
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
mov ecx, dword [esi + 0x8c]
add esp, 8
push ebx
push 0xa
push 0x402
push ecx
call ebp
push 0x74
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.004028b0
push ebx
lea eax, [esp + 0x190]
push str.Fortinet_Technologies
push eax
call fcn.004036f0
add esp, 0x14
test eax, eax
jne 0x40232d
push 0x75
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 0x407718
push ecx
push edx
push esi
call fcn.004028b0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0x70
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
add esp, 8
mov dword [esp + 0x14], 1
jmp 0x4025f3
push 0x76
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 0x407718
push ecx
push edx
push esi
call fcn.004028b0
add esp, 0x10
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push 0x1f4
call edi
mov eax, dword [esi + 0x8c]
push ebx
push 0xf
push 0x402
push eax
call ebp
push 0x77
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004028b0
add esp, 8
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push str..pipeFortiSslvpnNamedPipeEx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402419
push 0x78
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
call fcn.004028b0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x70
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
lea ecx, [esp + 0x10]
push 0x79
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
add esp, 8
mov dword [esp + 0x14], 1
jmp 0x4025ea
push 0
lea ecx, [esp + 0x40]
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x402462
push 0x7a
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
call fcn.004028b0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x70
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x10]
push edx
jmp 0x4025d5
push str._Connected_OK.
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
mov eax, dword [esi + 0x8c]
add esp, 8
push 0
push 0x10
push 0x402
push eax
call ebp
push 0x7b
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004028b0
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x161c]
lea edx, [esp + 0x18c]
rep stosd dword es:[edi], eax
push 0x13f
lea eax, [esp + 0x1640]
push edx
push eax
mov dword [esp + 0x1628], 0x1000
mov dword [esp + 0x162c], 0xa
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x14
lea ecx, [esp + 0x38]
lea edx, [esp + 0x1614]
push 0
push ecx
push 0x1000
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402510
push 0x7c
jmp 0x4025a7
push 0x7d
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
mov edx, dword [esi + 0x8c]
add esp, 8
push 0
push 0x11
push 0x402
push edx
call ebp
push 0x7e
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x61c]
add esp, 8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x61c]
push 0x1000
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4026b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x4026b6
push 0x7f
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
call fcn.004028b0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x70
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
add esp, 8
mov dword [esp + 0x14], 1
test ebx, ebx
je 0x4025f1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push 5
lea ecx, [esi + 0x12c]
call sub.MFC42.DLL_CWnd::ShowWindow
push 1
lea ecx, [esi + 0x1ac]
call sub.MFC42.DLL_CWnd::EnableWindow
cmp dword [esp + 0x14], ebx
jne 0x402839
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push str.____________________________________________
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
lea ecx, [esp + 0x10]
push 0x83
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
push ebx
mov ecx, esi
call fcn.00402d40
push str.____________________________________________
push esi
call fcn.004028b0
add esp, 8
lea ecx, [esp + 0x10]
push 0x8f
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004028b0
add esp, 8
push 0x3e8
call edi
jmp 0x402846
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.004028b0
mov edx, dword [esp + 0x640]
mov eax, dword [esp + 0x63c]
mov ecx, dword [esp + 0x628]
add esp, 8
push edx
mov edx, dword [esp + 0x620]
push eax
mov eax, dword [esp + 0x620]
push ecx
mov ecx, dword [esp + 0x620]
push edx
push eax
push ecx
push str._Size_d__ResCode_d__A_d__B_d__C_d__D_d.
push esi
call fcn.004028b0
add esp, 0x20
push 0x408d1c
push esi
call fcn.004028b0
mov edx, dword [esi + 0x8c]
add esp, 8
push 0
push 0x14
push 0x402
push edx
call ebp
push 0x81
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004028b0
mov eax, dword [esp + 0x63c]
add esp, 8
test eax, eax
je 0x4025f1
mov ecx, dword [esp + 0x61c]
push ecx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4027ad
push 0x82
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov ebx, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
call fcn.004028b0
add esp, 0xc
mov dword [esp + 0x14], 1
jmp 0x4025f1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1f4
push edi
call ebx
cmp eax, 0x102
jne 0x40280c
mov edx, dword [esi + 0x8c]
push 0
push 0
push 0x408
push edx
call ebp
cmp eax, 0x5a
jge 0x4027fd
mov eax, dword [esi + 0x8c]
push 0
push 0
push 0x408
push eax
call ebp
mov ecx, dword [esi + 0x8c]
inc eax
push 0
push eax
push 0x402
push ecx
call ebp
push 0x1f4
push edi
call ebx
cmp eax, 0x102
je 0x4027c2
push 0x72
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.004028b0
add esp, 8
push 0x408d1c
push esi
call fcn.004028b0
add esp, 8
push edi
jmp 0x4025eb
push 1
lea ecx, [esi + 0x16c]
call sub.MFC42.DLL_CWnd::EnableWindow
mov edx, dword [esi + 0x8c]
push ebx
push 0x64
push 0x402
push edx
call ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x261c], 1
call fcn.0040440c
lea ecx, [esp + 0x18]
mov byte [esp + 0x261c], 0
call fcn.0040440c
lea ecx, [esp + 0x20]
mov dword [esp + 0x261c], 0xffffffff
call fcn.0040440c
mov ecx, dword [esp + 0x2614]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2610
ret